Skip to content

Authentication

exalsius requires authentication to interact with the platform. The exls login command authenticates you and stores credentials in your system keyring. Use exls logout to remove them.

Log in

exls login

The CLI asks for your email address. Based on the email domain, exalsius routes you to your organization's SSO provider (e.g., Google Workspace, GitHub, Okta, Microsoft Entra ID). If your organization does not use SSO, you are directed to the default exalsius login page.

After entering your email, the CLI auto-detects the best authentication flow for your environment:

  • PKCE (browser) — used when a graphical browser is available. Opens a browser tab to complete authentication via your SSO provider.
  • Device code (headless) — used on servers or CI systems without a browser. Displays a device code and QR code so you can authenticate from another device.

If PKCE times out (for example, the browser did not open), the CLI automatically falls back to the device code flow.

Override the authentication flow

Use --auth-flow to force a specific flow:

exls login --auth-flow device_code

Available values: pkce, device_code, auto (default).

Log out

exls logout

This removes all stored authentication tokens from the system keyring. If you are not currently logged in, the command exits with an informational message.

exls get-token prints your current access (bearer) token to stdout so it can be captured in scripts that call the exalsius API directly. The token is refreshed automatically if it has expired.

exls get-token

Inject the token into an API request:

curl -H "Authorization: Bearer $(exls get-token)" https://api.exalsius.ai/...

To emit the token as a JSON object ({"access_token": "<token>"}) instead of the bare value, pass the global --format option before the command:

exls --format json get-token

Diagnostics and exit codes

Diagnostic messages are written to stderr, never stdout. If you are not logged in or the token cannot be refreshed, nothing is written to stdout and the command exits non-zero — so $(exls get-token) stays empty rather than capturing an error message.

How credentials are stored

exalsius stores authentication tokens (access token, ID token, refresh token, and expiry) in your operating system's keyring under the service name exalsius_cli. The keyring backend depends on your OS:

  • macOS — Keychain
  • Linux — Secret Service (e.g., GNOME Keyring, KWallet)
  • Windows — Windows Credential Locker

No tokens are written to disk as plain text.

Troubleshooting

exls login opens a browser but authentication fails

Verify that you have an active exalsius account. During the closed beta, reach out to run.it@exalsius.ai to request access.

exls login hangs on a headless server

The CLI may be attempting the PKCE flow. Force the device code flow:

exls login --auth-flow device_code

Failed to store token or Failed to load token

The system keyring is not available or not unlocked. On Linux, ensure a Secret Service provider (GNOME Keyring, KWallet) is running. On headless Linux systems, you may need to configure keyrings.alt or keyring --disable and use an alternative backend.

Switching accounts

Log out first, then log in with the new account:

exls logout
exls login

Reference

exls login

exls login [OPTIONS]
Flag Default Description
--auth-flow auto Authentication flow: pkce, device_code, or auto

exls logout

exls logout

No options. Removes stored tokens from the system keyring.

exls get-token

exls [--format json] get-token

Prints the current access token to stdout, refreshing it if expired. With --format json (a global option, placed before the command) the output is {"access_token": "<token>"}; otherwise the bare token is printed. On failure, nothing is written to stdout and the command exits with code 1.