CLI Authentication

Interactive Login#

provon auth login

The command opens a browser, completes authorization through a loopback callback, and stores a user-access credential in the active profile. Use --no-open to print the authorization URL instead.

Optional flags:

--profile <name>      Profile name
--timeout-ms <ms>     Maximum time to wait for browser authorization (default 120000)
--no-open             Print the authorization URL instead of opening a browser

Inspect or remove the profile:

provon auth status
provon auth logout

Project API Key#

Use an API key for service automation:

provon auth token set \
  --api-key "$PROVON_API_KEY" \
  --project "$PROVON_PROJECT_ID"

Optional flags:

--api-key <key>       Provon project API key
--project <id>        Default project id for workspace-scoped routes
--profile <name>      Profile name

The key's capabilities determine which commands can run. For example, trace reads require telemetry:read, Finding mutations require diagnostics:write, and Gateway calls require gateway:invoke.

See API authentication for the complete capability model.

Project Context#

List available projects and select the default:

provon workspace projects list
provon project use <project-id>
provon project current

Commands that use project-qualified Workspace routes require a selected project.

Profiles And Overrides#

Use --profile <name> to keep multiple environments or identities separate. Resolution follows this order:

1. command-line flags;
2. environment variables;
3. the selected local profile;
4. built-in defaults.

Common environment variables are:

PROVON_API_KEY
PROVON_PROJECT_ID
PROVON_PROFILE
PROVON_API_URL

Configure Origins#

provon config get
provon config set api-url http://127.0.0.1:3000/v1
provon config set otel-url http://127.0.0.1:3000/v1

Set the API and OTLP origins independently for split or self-hosted deployments. Supported settings are api-url and otel-url.