SkyState

sky login, logout, and project auth ​

This page covers developer CLI login/logout and the sky project auth settings commands for end-user hosted auth.

sky login ​

Start the hosted developer login flow.

bash
sky login

sky login opens the hosted PKCE login flow. After successful authorization, the CLI stores the SkyState developer bearer session in ~/.config/skystate/token.json.

If a valid session already exists, interactive terminals are prompted before re-authenticating. Non-interactive sessions keep the existing valid session.

Global flags such as --quiet, --verbose, --api-url, and --auth-url are accepted.

sky logout ​

Clear the local developer session and best-effort revoke its refresh session server-side.

bash
sky logout

The command deletes local credentials first, then starts server-side logout without blocking local logout.

Project Auth Settings ​

sky project auth configures hosted auth for end users of your app.

bash
sky project auth show --project <slug>
sky project auth enable --project <slug>
sky project auth disable --project <slug>
sky project auth callback-urls list --project <slug>
sky project auth callback-urls add --project <slug> --url <url> --env <env>
sky project auth callback-urls remove --project <slug> --url <url> --env <env>

--project <slug> is required for these commands. Run sky project list to see available slugs.

Callback URL environments accept development, staging, production, or aliases dev, stg, prod.

Advanced Provider Commands ​

The identity-provider subtree is available for advanced auth configuration:

bash
sky project auth providers list --project <slug>
sky project auth providers add --project <slug> --provider <provider>
sky project auth providers remove --project <slug> --provider <provider>

Valid provider values are google and github. The remove command refuses to remove the last configured provider.