Auth and keys

You sign in once per machine. The token you get is the only credential the CLI uses, and it is either personal or bound to one workspace. This page covers login, logout, projects and the keys commands.

intentdocs login

Signs you in through the browser and stores a token on this machine.

intentdocs login

No arguments or options.

What happens:

1. The CLI starts a login request and opens your browser at https://www.intentdocs.com/cli/auth?code=.... If the browser does not open, it prints the URL for you to visit.
2. In the browser you approve the request and choose where the token reads: your personal projects, or one workspace.
3. The CLI checks for approval every 3 seconds. When it arrives, it saves the token to ~/.intent/auth.json and prints who you are and where the token reads.

✅ Logged in as <your user id> — token bound to Acme

Behaviour to know:

• If you are already logged in and the stored token is still valid, the command says so and exits. Run intentdocs logout first to switch accounts or workspaces.
• If the stored token was revoked or no longer exists, the CLI deletes it and starts a fresh login.
• The CLI waits 5 minutes, then asks Keep waiting? (y/n). Answer y to wait 2 more minutes. The login request itself expires on the server after 10 minutes; run intentdocs login again after that.
• If the CLI cannot reach intentdocs.com to check an existing token, it exits with status 1.

intentdocs logout

Deletes the stored token from this machine.

intentdocs logout

No arguments or options. Prints Logged out., or Not logged in. when there was no token. It only removes ~/.intent/auth.json; it does not contact the server.

Workspaces and tokens

A token reads one place: your personal projects, or one workspace you belong to. login, projects and init all say which.

Some workspaces need an admin to approve each new agent token. When you choose one of those at login, the CLI tells you An admin has been asked to approve it. The CLI refreshes the token's state each time it verifies your login, so an approval or revocation reaches the terminal without logging in again.

Each checkout records the workspace it was connected for. If your token is bound somewhere else, or is personal while the checkout belongs to a workspace, the CLI refuses before it sends anything and names both:

This checkout is Acme's — "Checkout app" — but your token is bound to Globex. Run `npx intentdocs login` and choose Acme, or work from a checkout of Globex's.

The server also checks your membership on every call. If you leave a workspace, its projects stop answering your token.

intentdocs projects

Lists the projects your token can reach.

intentdocs projects

No arguments or options. Needs a valid login, not a connected checkout.

The first lines say where the token reads and how it is bound. Then each project prints its full ID, its name, its workspace when it has one, and the first 100 characters of its description.

  Personal workspace — only you can see what's here.
  Token personal
 
  3f9c2a1e-...  Checkout app
    One-page checkout for small shops
 
  1 project. Check one out with: npx intentdocs init

When the server refuses (for example, the token is bound to a workspace you have left), the command prints the reason and exits 1.

intentdocs keys

Manage your own Anthropic API key. With a key saved, complexity, research, import and implement --stub run on your key on any plan, for story maps you own. On a map someone else owns, the owner's plan and key apply. The key is encrypted at rest and used only for your AI operations.

All three subcommands need a valid login. They do not need a connected checkout.

intentdocs keys set

Saves your key.

intentdocs keys set [key]

intentdocs keys set            # prompts, and links to console.anthropic.com/settings/keys
intentdocs keys set sk-ant-...

On success it prints the masked key. It exits 1 when you give no key, when the server rejects the key (it prints the server's reason), or when it cannot reach intentdocs.

Note: Passing the key as an argument leaves it in your shell history. Run intentdocs keys set with no argument to be prompted instead.

intentdocs keys status

Shows whether a key is saved.

intentdocs keys status

Prints the masked key when one is saved, or No Anthropic API key set. when none is.

intentdocs keys remove

Deletes your saved key.

intentdocs keys remove

AI features go back to your plan's limits.