Authentication

The CLI needs to sign in before it can access your games or push builds. You sign in once per machine — credentials are stored in your home directory.

Browser login

wavedash auth login

Opens your browser for OAuth. After you authorize, the CLI writes an API key to its credentials file. Use this option on any machine with a browser.

Browser login only runs in an interactive terminal. If CI is set (to anything but 0 or false) or stdin isn't a terminal, the command exits with an error pointing you at WAVEDASH_TOKEN or --token-stdin instead.

Headless / CI login

Machines without a browser — build servers, CI runners — have two options. Generate an API key in the Developer Portal first.

Pass a token directly

wavedash auth login --token YOUR_API_KEY

Writes the token to the credentials file, same as browser login.

Pipe a token

echo "$WAVEDASH_API_KEY" | wavedash auth login --token-stdin

Reads the key from stdin, so it never appears in a process list or shell history. Can't be combined with --token.

Use WAVEDASH_TOKEN

export WAVEDASH_TOKEN=your_api_key

When set, WAVEDASH_TOKEN takes priority over the credentials file, so there's no separate login step on every run. This is usually the right choice for CI pipelines and ephemeral runners.

It follows the same rules as the other WAVEDASH_* variables: the value is trimmed, so reading a key out of a file keeps working —

export WAVEDASH_TOKEN=$(cat key.txt)

— and a variable that's set but empty counts as unset, so an unpopulated CI secret falls back to stored credentials instead of failing the request with a blank key.

Status and logout

wavedash auth status
wavedash auth logout

auth status verifies the key with the server and reports the account it belongs to, where the credentials came from (file or environment variable), and a masked key preview. It exits non-zero when there are no credentials, the server rejects the key, or the server can't be reached, so wavedash auth status || wavedash auth login works as a guard.

--json prints the same result as an object: authenticated: true with source, username, and email, or authenticated: false with a reason of not_authenticated, rejected, or unverified.

auth logout removes the stored credentials — it does not unset WAVEDASH_TOKEN.

Next steps

With the CLI installed and signed in, set up your project's wavedash.toml — or drive it entirely from environment variables if you're scripting it.