Authenticate the CLI

The CLI authenticates against the Soxom API with a personal access token scoped to the actions it can perform. soxom login walks you through the browser-based flow and stores the resulting token on your machine.

Run soxom login. The CLI opens your default browser to a one-time authorization page.
Confirm the request in the dashboard. The page shows the scopes the CLI is asking for (see below) and which Organization the resulting token will belong to.
The CLI receives the token back over a loopback callback and stores it locally.

soxom login
# Opening https://app.soxom.com/cli/auth?state=…
# Waiting for authorization…
# Signed in as Jane Smith (Acme Inc.).

Scopes

CLI tokens carry only the scopes needed for local workflows:

Scope	Allows
`cli:validate`	Calling the validate endpoint (a no-op today; reserved).
`cli:preview`	Uploading a source bundle and triggering a preview build.

Tokens cannot create projects, modify SDK targets, or trigger production builds. For administrative actions, use the dashboard.

Token lifetime

CLI tokens are valid for 90 days by default, after which the next CLI call will prompt you to re-authenticate. You can revoke a token at any time from Settings → CLI tokens in the dashboard.

Where the token is stored

The CLI stores its credentials in a single JSON file, scoped to the API base URL you authenticated against:

OS	Path
Linux	`${XDG_CONFIG_HOME:-$HOME/.config}/soxom/credentials.json`
macOS	`$HOME/Library/Application Support/com.soxom.cli/credentials.json`
Windows	`%APPDATA%\soxom\credentials.json`

The file is created with 0600 permissions on Unix and is rewritten atomically when you log in again.

Optional: OS keychain

On macOS the CLI can optionally store the token in the system Keychain instead of the credentials file. Enable it with:

soxom login --keychain

Linux users with libsecret and Windows users with Credential Manager have the same flag available; see the reference page for the full matrix.

Pointing at a different environment

By default the CLI talks to https://api.soxom.com. Set SOXOM_API_BASE to override:

export SOXOM_API_BASE=https://api.staging.soxom.dev
soxom login

Tokens are scoped to the API base they were issued against — switching environments triggers a fresh login.

Revoking a token

Open Settings → CLI tokens in the Soxom dashboard.
Find the token you want to revoke. The list shows when each token was created, when it was last used, and from which IP.
Click Revoke. The next CLI call using that token will return a 401 Unauthorized and you can re-run soxom login.

Using a token in CI

For CI environments, prefer setting SOXOM_TOKEN over running soxom login. See the reference page for details.