​
Authentication

The CLI uses a device-code style browser approval flow. The terminal asks the API to create a device authorization, then a signed-in browser approves that user code.

​
Login

For SSH, CI-like shells, or terminals where opening a browser is not useful:

​
Device login flow

The API only accepts the fixed selltraces-cli client id for CLI device login. Polling returns:

​
Machine token storage

After approval, the CLI writes the token to:
API requests use that token as a bearer credential:
The web app also supports authenticated browser sessions for the same user-scoped API routes. Routes that can be used by the CLI call the shared getRequestUserId() path, which accepts legacy machine bearer tokens and Better Auth bearer sessions before falling back to browser session cookies.

​
Logout

Logout removes this machine’s saved credentials. It does not delete the saved upload policy or local trace ledger, so returning users keep source approvals, blocked terms, and already-synced history.

​
Local development auth test

Run the web app with real Better Auth enabled:
Then link the source-backed local CLI and run it with an isolated home:
The local selltraces shim defaults to http://localhost:3000. The published CLI defaults to https://selltraces.com; use --api or SELLTRACES_API_URL only when intentionally targeting another origin.