CLI Authentication

qumod supports two authentication workflows:

Interactive Browser Login (Device Authorization Flow): Ideal for developers working locally on workstations.
Headless Token Authentication (QUMO_TOKEN): Ideal for CI/CD runners, Docker containers, and Coding Agents.

1. Interactive Device Authorization Flow

Run the login command:

qumod login

qumod will initiate the OAuth 2.0 Device Authorization Flow (RFC 8628):

Initiating device authorization flow on https://api.qumo.dev...

  To authenticate, visit:
    https://console.qumo-deploy.com/device

  And enter this one-time code:
    ABCD-EFGH

✔ Browser opened automatically. Polling for authorization...

The CLI will attempt to launch your system browser automatically.
If running over SSH or a headless display, open the displayed URL manually and enter the one-time user code.
Sign in using your Qumo Deploy account and click Approve.
The CLI polls the control plane and automatically saves the issued session token to ~/.qumo/config.json.

2. Headless Authentication (CI/CD & Coding Agents)

In automated environments where interactive prompts are impossible, pass credentials via an environment variable or flag:

Environment Variable (Recommended for CI/CD)

Export QUMO_TOKEN with an API Key or Personal Access Token (PAT):

export QUMO_TOKEN="sec_live_example123..."
qumod whoami

Command Flag

You can also pass the token per-invocation using --token:

qumod whoami --token "sec_live_example123..."

Flags take precedence over environment variables, which take precedence over saved tokens in ~/.qumo/config.json.

Checking Current Identity (`whoami`)

To confirm authentication status, organization details, and IAM roles:

qumod whoami

Sample output:

  Logged in as:   [email protected]
  Organization:   Acme Streaming Corp
  Role:           tenant_admin
  API Endpoint:   https://api.qumo.dev

  Tenants:
    - Acme Streaming Corp (ten_8f29acb0) [tenant_admin]

JSON Mode for Scripts and Agents

Pass --json for structured, machine-readable output:

qumod whoami --json

{
  "user": {
    "id": "usr_9918231",
    "email": "[email protected]",
    "name": "Alice Developer"
  },
  "organization": {
    "id": "ten_8f29acb0",
    "name": "Acme Streaming Corp"
  },
  "role": "tenant_admin",
  "apiUrl": "https://api.qumo.dev",
  "memberships": [
    {
      "tenant_id": "ten_8f29acb0",
      "tenant_name": "Acme Streaming Corp",
      "role_id": "tenant_admin"
    }
  ]
}

Logging Out

To clear local credentials and invalidate the active session:

qumod logout

✔ Successfully logged out. Removed cached credentials.

​CLI Authentication

​1. Interactive Device Authorization Flow

​2. Headless Authentication (CI/CD & Coding Agents)

​Environment Variable (Recommended for CI/CD)

​Command Flag

​Checking Current Identity (whoami)

​JSON Mode for Scripts and Agents

​Logging Out

CLI Authentication

1. Interactive Device Authorization Flow

2. Headless Authentication (CI/CD & Coding Agents)

Environment Variable (Recommended for CI/CD)

Command Flag

Checking Current Identity (`whoami`)

JSON Mode for Scripts and Agents

Logging Out