Dibbla Docs Get started Guides Workflows Changelog
Open Console
Reference · CLI

dibbla login

Authenticate with the Dibbla API and store your token securely. Browser OAuth, paste-token, or pre-generated `--api-key` — all three work, and the latter two are non-TTY safe.

dibbla login validates an API token against your Dibbla API endpoint and persists it to the OS keyring (macOS Keychain, Windows Credential Manager, libsecret/pass on Linux). dibbla logout removes it.

In CI, scripts, or any non-TTY context, you can skip login and set DIBBLA_API_TOKEN directly — the CLI will read it from the shell or from a ./.env file.

Get an API token at app.dibbla.com/api-keys.

dibbla login

Pick one of three auth flows. The first is interactive (TTY required); the other two work anywhere.

Flags

FlagPurpose
[api_url] (positional)API endpoint, e.g. api.dibbla.net or https://api.dibbla.net. Default: https://api.dibbla.com.
--api-url <url>Same as the positional arg; mutually exclusive with it.
--api-key <token>Pre-generated token. Works in any context, including agent shells and CI.
--browserSkip the interactive menu and go straight to browser-based OAuth. Non-TTY safe (uses a localhost callback).
--write-envAfter validation, write DIBBLA_API_TOKEN and DIBBLA_API_URL to ./.env (atomic merge, preserves existing keys/comments) and ensure .env is in ./.gitignore.
--no-keychainSkip the OS keyring entirely. Useful on cloud VMs / SSH / Docker where libsecret or gnome-keyring aren’t installed. Combine with --write-env to persist credentials in .env instead.

Interactive (TTY)

$dibbla login
? How would you like to log in?
  ▸ Log in with browser
    Paste an API token
 
🌐 Opening browser for login...
  📋 Login URL copied to clipboard!
 
Waiting for browser login... (press Ctrl+C to cancel)
✅ Browser login successful! Creating API token...
✅ Logged in to https://api.dibbla.com

Browser OAuth (non-TTY safe)

Forces the browser flow, including from agent shells like Claude Code’s ! prefix.

$dibbla login --browser
🌐 Opening browser for login...
  📋 Login URL copied to clipboard!
  If the browser didn't open, visit:
  https://app.dibbla.com/cli-auth?code=...
 
Waiting for browser login... (press Ctrl+C to cancel)
✅ Browser login successful! Creating API token...
✅ Logged in to https://api.dibbla.com

API key (CI / scripts)

$dibbla login --api-key $DIBBLA_API_TOKEN
✅ Logged in to https://api.dibbla.com
# Point at a non-default API
$dibbla login api.dibbla.net --api-key $TOKEN
✅ Logged in to https://api.dibbla.net

Cloud VM / SSH / Docker (no keyring)

When the host has no keyring service, persist to ./.env instead.

$dibbla login \
  --api-key $DIBBLA_API_TOKEN \
  --api-url https://api.dibbla.com \
  --write-env --no-keychain
 
✅ Validated https://api.dibbla.com (keychain skipped, credentials in .env)
✅ Wrote DIBBLA_API_TOKEN, DIBBLA_API_URL to /Users/jane/projects/.env
✅ Added .env to /Users/jane/projects/.gitignore
No login required in CI.

If you set DIBBLA_API_TOKEN (and optionally DIBBLA_API_URL) in the shell or in ./.env, every other dibbla command works without login. Use login when you want to validate the token interactively or persist it for future shells.

dibbla logout

Removes the token from the OS keyring. Does not touch ./.env.

$dibbla logout
✅ Logged out; credentials removed from keychain

Token resolution order

When any other command needs a token, the CLI resolves it in this order — the first hit wins:

  1. DIBBLA_API_TOKEN in the shell environment.
  2. DIBBLA_API_TOKEN in ./.env (loaded automatically at startup).
  3. The OS keyring entry written by dibbla login.

DIBBLA_API_URL follows the same order, with DIBBLA_AUTH_SERVICE_URL as a legacy fallback before the default https://api.dibbla.com.

Don't commit `.env`.

dibbla login --write-env adds .env to ./.gitignore, but if you create the file manually, make sure it’s ignored. A leaked token can deploy, read databases, and exfiltrate secrets.

See also

← Previous
CLI reference