Authentication

gigadrive login signs the CLI in to your Gigadrive Network account using the OAuth 2.0 device grant. Run it once per machine, and every other command reuses the stored refresh token.

Signing in

gigadrive login

The CLI prints a URL and a short code, then waits:

Initiating login...

To sign in, visit:

    https://account.gigadrive.de/device

and enter the code:

    K7QM-3XPD

We tried to open your browser automatically. If it did not open, use the URL above.
Press "c" to copy the URL to your clipboard, or Ctrl+C to cancel.

Waiting for you to approve the login…
You are now logged in as Ada Lovelace.

When stdin is a terminal the CLI also tries to open the browser for you, and pressing c copies the URL to your clipboard. Piped or redirected stdin skips both, and the URL and code still print. Approving the request in the browser ends the wait.

Two failures are worth recognising. The login request was denied. means you rejected the request in the browser. The login code expired before it was approved. means the code timed out, and the fix is to run gigadrive login again.

Where the credential is stored

Everything lives under ~/.gigadrive/, a directory the CLI creates with mode 0700.

The access token refreshes on its own when it expires. If the identity provider rejects the refresh token, the CLI deletes auth.json and reports Refresh token is invalid or expired. Please log in again.

Scopes requested at login

The device grant asks for exactly this set:

offline_access openid profile email
platform:organizations:read
network:applications:read network:applications:write
network:env_vars:read network:env_vars:write network:env_vars:delete
network:deployments:read network:deployments:write network:deployments:trigger
network:ai_gateway:chat network:ai_gateway:models
platform:api_keys:read platform:api_keys:write platform:api_keys:delete

AI Gateway governance scopes are absent on purpose. The identity provider grants those only to OAuth clients bound to a Gigadrive Network application, and asking for one would reject the whole login.

Checking and clearing the session

gigadrive whoami prints the OpenID Connect userinfo response as JSON. With no stored credential it prints You are not logged in. Run "gigadrive login" to authenticate. instead of failing, so read its output rather than treating it as a gate.

gigadrive whoami

gigadrive logout deletes ~/.gigadrive/auth.json. It leaves dev-keys.json in place and does not revoke any API keys the CLI provisioned for local development.

CI and other non-interactive use

Set any one of these four variables and the CLI builds its API client from them, ignoring the stored login entirely. This is the supported way to run gigadrive in a pipeline without gigadrive login.

GIGADRIVE_API_BASE_URL points the client at a different API host and defaults to https://api.gigadrive.network.