The envless command ships in @goenvless/cli. Install it with npm i -g @goenvless/cli@latest.
Usage
envless loginStarts a device-authorization flow. The CLI prints a one-time code, opens your browser to the Envless dashboard, and polls in the background until you approve the session.
What happens
Request a device code
The CLI calls /cli/device to mint a short-lived device code and a human-readable user code (e.g. ABC-123).
Approve in the browser
Your default browser opens to the verification URL with the code pre-filled. Confirm the code matches the one shown in your terminal, then approve the session while signed in to Envless.
Prove it is you
Approval is a step-up guarded action. Unless you verified something in the last hour, the page asks for a verification code before the device is authorized, then completes the approval for you.
CLI receives the token
The CLI polls /cli/token on the interval the API hands back, 5 seconds today. A slow_down response adds 5 seconds to it. Once approved, the token and user profile are written to ~/.envless/config.json with 0600 permissions (directory 0700).
The device code expires 5 minutes after it is issued, and the spinner counts that window down. When it runs out the CLI stops polling, prints "Code expired. Run envless login again." and exits 1. A step-up prompt eats into that window, so have your inbox or authenticator open before you start.
Approval needs a browser session, and only a browser session. POST /cli/approve refuses an env_cli_ token outright with auth.cli_token_not_accepted, so a CLI session already on the machine cannot authorize a second one, and there is no envless approve command. A device is authorized by a signed-in human in the dashboard or it is not authorized at all. If two factor authentication is on for that account, the app code is asked for before the dashboard loads at all, so that gate comes first and the step-up code second.
Already signed in
If a session already exists, envless login is a no-op and prints the current account. Run envless logout first to switch users.
$ envless login
› Already signed in as jane@acme.dev
› Run envless logout first to switch accounts.Where credentials live
| Path | Mode | Contents |
|---|---|---|
~/.envless/ | 700 | Per-user CLI state directory. |
~/.envless/config.json | 600 | Bearer token and cached user profile. |
Treat config.json like an SSH key: don't commit it, don't sync it to shared machines, and revoke the session with envless logout if it's ever exposed.