Skip to main content
golain stores credentials per profile at ~/.config/golain/profiles/{name}.json (mode 0600). Legacy profiles under ~/.config/platform-tui/profiles/ are still read.

​
Device authorization login

The CLI prompts for: It prints a user code, opens the verification URL, and polls until you approve. Only the access token is persisted — re-run login when it expires. Check identity:

​
Zitadel application setup

Create a Native or User Agent application with Device Authorization enabled (not Web + client secret).
  1. Zitadel console → Projects → create or select project.
  2. New Application → type Native / User Agent.
  3. Enable Device Authorization grant.
  4. Scopes: openid, profile, email.
  5. Copy Client ID into the login prompt.
Optional: enable User roles in token if you rely on custom Zitadel roles.

​
Dev and bypass modes

Local vm-edge stack defaults (from infra/deploy/vm-edge/env/apis.vm.env): Override with env vars: GOLAIN_API_URL, GOLAIN_ZITADEL_ENDPOINT, GOLAIN_ZITADEL_CLIENT_ID (legacy PLATFORM_* aliases work). When apis runs with AUTH_BYPASS=true, any bearer token works:

​
CI without interactive login

For automated jobs against a bypass or service-account endpoint:
Prefer short-lived tokens and locked-down staging environments for CI.

​
Credential file contents

Each profile stores: API URL, Zitadel endpoint, client ID, access token, expiry, and active org/project context. → Set context