Redeem an approved CLI sign-in
Works without credentials; the `code_verifier` is the proof. `202` while nobody approved yet (poll again after `interval` seconds); `200` once, with a new API key of the approving user (source `cli`, name from the start request); afterwards, and after a denial or the expiry, `409 cli-login-closed`. A wrong verifier is `404`, like an unknown sign-in.
openapi/harthelm.yaml at v1.5.0login*stringA CLI sign-in's id from POST /cli/logins.
uuidapplication/json- body
code_verifier*string^[A-Za-z0-9._~-]{43,128}$The new API key.
application/json- response
token*stringhart_<id>_<secret>, shown this once.
api_key*A personal API key without its secret.
user*curl -X POST 'https://console.example.com/api/v1/cli/logins/497f6eca-6276-4993-bfeb-53cbbbba6f08/token' \ -H 'Content-Type: application/json' \ -d '{ "code_verifier": "string"}'{ "token": "string", "api_key": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "source": "console", "prefix": "string", "created_at": "2019-08-24T14:15:22Z", "regenerated_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z" }, "user": { "id": 1, "email": "string", "name": "string", "is_cluster_admin": true, "email_verified": true, "picture_url": "string", "issuer": "string" }}A pending CLI sign-in, for the console's confirmation
What `hart login` asked for: the console's `/cli-login?code=<user code>` page shows it before the user approves. 404 when the code is unknown, expired, or already approved or denied.
Start a CLI sign-in
`hart login`. Works without credentials; rate-limited per client address (429). The CLI sends the S256 challenge of a verifier only it knows (PKCE, RFC 7636), so nobody but the CLI can redeem the sign-in. - `loopback`: the CLI listens on `127.0.0.1:<redirect_port>` and opens `verification_url`; after the approval the console navigates to `http://127.0.0.1:<redirect_port>/callback` and the CLI redeems. - `code` (`hart login --code`, for SSH sessions and workspaces): the CLI prints `verification_url` and `user_code` and polls the redeem every `interval` seconds. A sign-in expires after 10 minutes. `Idempotency-Key` is accepted like on any create, but a CLI sends none.