Sign in from the CLI

Commands that talk to a Blixel server, such as blixel room list, need the
CLI's own sign-in. It is separate from the app's: signing the CLI in or out
never changes the app's sign-in. Commands that work with the running app or
this Mac's transcripts need no sign-in.

Sign in

blixel auth login

The CLI opens the approval page in your browser and prints the link and a
code. Over SSH it only prints them; --no-browser does the same anywhere.
Approve the sign-in as described in
Sign in and approve a device, then return to
the terminal.

blixel auth login signs in to https://blixel.app. For another server, give
its address and a name for the connection:

blixel auth login --server https://blixel.example --name work

Use more than one server

Each sign-in is a connection. The first one becomes active; commands use the
active connection unless you pass --connection <name>.

blixel connection list
blixel connection use work
blixel room list --connection work

Check and sign out

blixel auth status shows the active connection's account and whether its
credential is stored. It does not contact the server, so a credential revoked
elsewhere shows as present until the next server command fails with
not_authenticated.

blixel auth logout removes the credential and asks the server to revoke that
session. To revoke a CLI session from another machine, open Sessions on the
server's website and revoke its Blixel CLI row.

Where credentials are kept

The CLI keeps its credentials in the Keychain. Where the Keychain needs a
person to unlock it, such as over SSH, commands fail with
secret_store_unavailable. Set BLIXEL_TOKEN_STORAGE=file to keep them in
~/.blixel/cli/secrets.json, readable only by you, then sign in again.
Nothing is copied between the two.