Hosted authentication

Authenticate the CLI with the repository-scoped API token from Radforge onboarding.

Set the credentials

Export the API URL and token, then verify access:

export RADFORGE_REMOTE_URL="https://api.radforge.dev"
export RADFORGE_API_TOKEN="..."
rad remote doctor

If authentication succeeds, rad remote doctor reports the repository and hosted capabilities available to the token.

RADFORGE_API_TOKEN is a bearer token. Anyone who has it can use its access. The CLI reads it only from the environment, and remote commands do not accept it as an argument.

The --endpoint flag or RADFORGE_REMOTE_URL must contain an HTTPS origin without a path, query, or embedded credentials. Use the production URL from onboarding unless Radforge support tells you otherwise.

Store the token

Store the token in an operating-system keychain or your CI provider’s protected secret store. For local use, export it into the current shell without saving it in shell history. Never commit it, paste it into an issue, include it in a plan, or pass it on the command line.

Replace an exposed token

Stop using the token and contact Radforge to revoke and replace it. Installing the GitHub App does not authenticate the CLI. The two paths use separate credentials.