Authentication

The CLI authenticates to your AKOS workspace via a device-code OAuth flow. Once logged in, provider credentials and secrets are managed separately through the creds, vault, secrets, and connections commands.

Logging in

akos auth login

This starts a device-code flow:

1. The CLI prints a verification URL and a short user code.
2. Open the URL in a browser and enter the code.
3. After approval, the CLI saves your session token locally and prints Logged in as <userId>.

Login options

CI environments

If the environment variable AKOS_TOKEN is already set, auth login exits immediately with a success message. Use this for non-interactive pipelines.

Checking your session

akos auth whoami

Prints Logged in as <userId> on tenant <tenantId> and confirms the workspace is reachable. Add --json for machine-readable output.

Switching tenants

When your account belongs to multiple tenants (OEM multi-tenancy), use the tenant commands to list and switch:

akos tenant list

Lists all tenants your account can access. If you do not have the oem:tenant:admin role, the command falls back to reporting the current tenant.

akos tenant use <tenant-id>

Sets the active tenant. The new tenant ID is persisted to your local session and used for subsequent sidecar calls.

Logging out

akos auth logout

Clears the locally stored session token. Safe to call when no session exists (idempotent).

Managing provider credentials

The creds command lists, verifies, and stores the API keys required by AI providers and integrations. Values are never printed.

List known providers

akos creds list

Shows each provider, its kind, and the vault keys it requires.

Filter by kind or provider:

akos creds list --kind llm
akos creds list --provider anthropic

Output as JSON:

akos creds list --json

Check credential presence

akos creds check

Scans the environment (and optionally a secrets file) for each required key. Exits with code 0 when all keys are present, code 7 when any are missing.

# Check against a local dotenv-style file (key names only — values never shown)
akos creds check --secrets-file .env.local
 
# Skip cloud providers (air-gapped workspace)
akos creds check --air-gap
 
# Restrict to a specific provider
akos creds check --provider openai

Set a credential

akos creds set

Interactive guided flow for storing a credential. Follows the same vault backend as vault put.

Onboarding guide

Print the full credential onboarding playbook:

akos creds guide

Vault: workspace secrets

The vault command reads and writes secrets in the workspace vault. Secret values are never printed — only key names and their source are shown.

Store a secret

akos vault put OPENAI_API_KEY sk-...

Scope the secret to a tenant instead of the workspace:

akos vault put STRIPE_SECRET_KEY sk_live_... --scope tenant

Scopes: workspace (default), tenant.

List stored secrets

akos vault list

Shows key names and their source (e.g. os-keychain). Add --json for machine-readable output.

Secrets: headless provisioning

The secrets command is a headless alternative to vault, operating through the running workspace sidecar. Use it when scripting in environments where the sidecar is already running.

# Store a secret
akos secrets set GITHUB_TOKEN ghp_...
 
# List stored keys (values hidden)
akos secrets list
 
# Filter output as JSON
akos secrets list --json

Scope options (--scope workspace|tenant) work the same as vault put.

Integration connections

Integration connections link your workspace to external services (Slack, GitHub, Stripe, and others). Authentication always references a vault key — never a plaintext token.

Provision a connection

First, store the credential in the vault:

akos vault put SLACK_BOT_TOKEN xoxb-...

Then create the connection, referencing the vault key:

akos connections set \
  --id slack-main \
  --kind slack \
  --label "Main Slack workspace" \
  --secret-id SLACK_BOT_TOKEN

For integrations that require no auth:

akos connections set \
  --id public-webhook \
  --kind webhook \
  --label "Inbound webhook" \
  --no-auth

Supported kinds: slack, github, linear, discord, email, cron, file, webhook, cdc, twilio, sentry, pagerduty, stripe, s3, mcp, llm.

List connections

akos connections list
 
# Filter by kind
akos connections list --kind slack
 
# JSON output
akos connections list --json

Inspect a connection

akos connections get slack-main

Remove a connection

akos connections rm slack-main

Removing a connection does not delete the underlying vault secret.