CLI Authentication

qumod supports two authentication workflows:

Interactive Browser Login (Device Authorization Flow): Ideal for developers working locally on workstations.
Headless Token Authentication (QUMO_TOKEN): Ideal for CI/CD runners, Docker containers, and Coding Agents.

1. Interactive Device Authorization Flow

Run the login command:

qumod login

qumod will initiate the OAuth 2.0 Device Authorization Flow (RFC 8628):

Initiating device authorization flow on https://api.qumo-deploy.com...

  To authenticate, visit:
    https://console.qumo-deploy.com/device

  And enter this one-time code:
    ABCD-EFGH

Waiting for verification in browser for up to 15 minutes... (Press Ctrl+C to cancel)

The CLI will attempt to launch your system browser automatically.
If running over SSH or a headless display, open the displayed URL manually and enter the one-time user code.
Sign in using your Qumo Deploy account and click Approve.
The CLI polls the control plane and automatically saves the issued session token to ~/.qumo/config.json. If a session was already stored there, the CLI ends it on the control plane once the new sign-in succeeds.

2. Headless Authentication (CI/CD & Coding Agents)

In automated environments where interactive prompts are impossible, pass credentials via an environment variable or flag:

Environment Variable (Recommended for CI/CD)

Export QUMO_TOKEN with a User or Identity Token:

export QUMO_TOKEN="qumo_pat_example123..."
qumod whoami

Command Flag

You can also pass the token per-invocation using --token:

qumod whoami --token "qumo_pat_example123..."

Flags take precedence over environment variables, which take precedence over saved tokens in ~/.qumo/config.json.

Checking Current Identity (`whoami`)

To confirm authentication status, the active organization, and the IAM role:

qumod whoami

Sample output:

  Logged in as:   [email protected]
  Organization:   Acme Streaming Corp
  Role:           roles/organization.admin
  API Endpoint:   https://api.qumo-deploy.com

  Organizations:
    - Acme Streaming Corp (9b2f6e1c-3a4d-4c8b-a7e5-0d1f2c3b4a5e) [roles/organization.admin]

JSON Mode for Scripts and Agents

Pass --json for structured, machine-readable output:

qumod whoami --json

{
  "auth": "session",
  "user": {
    "id": "5a1e7c3b-8d2f-4b6a-9e0c-4f3d2a1b8c7e",
    "email": "[email protected]",
    "name": "Alice Developer",
    "avatar_url": null
  },
  "organization": {
    "id": "9b2f6e1c-3a4d-4c8b-a7e5-0d1f2c3b4a5e",
    "name": "Acme Streaming Corp"
  },
  "role": "roles/organization.admin",
  "api_url": "https://api.qumo-deploy.com",
  "memberships": [
    {
      "organization_id": "9b2f6e1c-3a4d-4c8b-a7e5-0d1f2c3b4a5e",
      "organization_name": "Acme Streaming Corp",
      "role_id": "roles/organization.admin"
    }
  ]
}

Logging Out

To clear local credentials and end the qumod login session on the control plane (a personal access token stays valid until you revoke it in the console):

qumod logout

✔ Logged out and cleared local credentials.

​CLI Authentication

​1. Interactive Device Authorization Flow

​2. Headless Authentication (CI/CD & Coding Agents)

​Environment Variable (Recommended for CI/CD)

​Command Flag

​Checking Current Identity (whoami)

​JSON Mode for Scripts and Agents

​Logging Out

CLI Authentication

1. Interactive Device Authorization Flow

2. Headless Authentication (CI/CD & Coding Agents)

Environment Variable (Recommended for CI/CD)

Command Flag

Checking Current Identity (`whoami`)

JSON Mode for Scripts and Agents

Logging Out