Auth

The CLI authenticates as you so every command runs under the same row-level security as the web app.

Recommended: learnos login

pnpm learnos -- login
# or, once published: learnos login

This opens a browser, runs OAuth 2.1 + PKCE against Supabase Auth, and stores access + refresh tokens in ~/.config/learnos/credentials.json (mode 0600).

learnos whoami
learnos logout

One-time project setup

1. In the Supabase dashboard: Authentication → OAuth Server — enable OAuth 2.1, set Authorization Path to /oauth/consent, and allow dynamic client registration for MCP clients.
2. Register the public CLI client (needs SUPABASE_SECRET_KEY):

pnpm learnos -- oauth register-cli

3. Put the printed client_id in .env.local:

LEARNOS_OAUTH_CLIENT_ID=<client_id>

The CLI callback listens on http://127.0.0.1:19876/callback.

Fallback: personal access token

export LEARNOS_TOKEN=los_...

Issue a token from Settings → Personal access tokens. Useful for CI.

Resolution order

1. LEARNOS_TOKEN environment variable
2. Stored OAuth credentials from learnos login
3. Bootstrap user (local-dev only; refuse with LEARNOS_REQUIRE_TOKEN=1)