Skip to content
Docs

Hosted authentication

Authenticate the CLI with the repository-scoped API token from Radforge onboarding.

Before you begin

Section titled “Before you begin”

Store the token in an operating-system keychain, password manager, or your CI provider’s protected secret store. Do not type it into a shell command, save it in shell history, or place it in a repository file.

Load the token into RADFORGE_API_TOKEN by using your secret tool’s shell integration. The exact command depends on that tool.

Verify the credentials

Section titled “Verify the credentials”
  1. Set the hosted API origin and confirm that the token is present without printing it:
Terminal window
export RADFORGE_REMOTE_URL="https://api.radforge.dev"
test -n "${RADFORGE_API_TOKEN:-}" && printf 'RADFORGE_API_TOKEN is set\n'
  1. Verify access:
Terminal window
rad remote doctor

If authentication succeeds, rad remote doctor reports the repository and hosted capabilities available to the token.

RADFORGE_API_TOKEN is a bearer token. Anyone who has it can use its access. The CLI reads it only from the environment, and remote commands do not accept it as an argument.

The --endpoint flag or RADFORGE_REMOTE_URL must contain an HTTPS origin without a path, query, or embedded credentials. Use the production URL from onboarding unless Radforge support tells you otherwise.

Replace an exposed token

Section titled “Replace an exposed token”

Stop using the token and use the support channel from your onboarding message to revoke and replace it. Installing the GitHub App does not authenticate the CLI. The two paths use separate credentials.