pxb auth

Your browser opens on Pixelbase, the same page an assistant like Claude uses to connect. Choose which of your companies the CLI may reach and what it may do in each — nothing is selected until you pick it, and you can only give what you hold yourself. Approve, and the terminal carries on.

If the browser doesn't open, the link is printed; --no-browser skips trying. That browser has to be on the same machine — the approval comes back to a listener on 127.0.0.1.

From another machine

Over SSH, in a container, anywhere the browser is somewhere else, sign in with a code instead:

pxb auth --device

The terminal prints a link and a code like BCDF-GHJK. Open the link on any device, sign in, check the code matches and approve — the terminal is polling, and carries on by itself. In an SSH session pxb auth does this without the flag. The code is good for 30 minutes.

Afterwards, every sign-in is listed under Dev Tools → CLI in the console, with its requests per day, every call it made, and who changed what it may do. Change its permissions there and the next command uses them; disconnect it there, or run pxb logout, and it stops working at once.

With an API client instead

For CI, and anywhere nobody is around to approve a sign-in, use an API client from Dev Tools → API (/dev-tools/api):

export PXB_CLIENT_ID=pxb_client_…
export PXB_CLIENT_SECRET=pxb_secret_…   # from your CI's secret store
pxb auth

Or give only --client-id and you're prompted for the secret, which is not echoed. Keep the secret out of --client-secret: anything on the command line shows up in ps for every user on the machine, and often in shell history and CI logs. Either way the credentials are exchanged for a token before anything is stored, so a typo fails immediately.

Another host

Point at a non-production host with --base-url. It is saved on the profile, so you pass it once. It must be https — plain http is accepted only for localhost. For a local dev server, pxb-dev (see pxb help install) already defaults to it:

pxb auth --base-url http://localhost:3000

Where credentials live

Tokens and client secrets go into the operating system keychain — the macOS keychain, or the system keyring via secret-tool on Linux. They are handed to those tools over stdin, never as command line arguments, so they never appear in ps output or your shell history.

Only non-secret metadata is written to disk, in ~/.pxb/config.json at 0600: API host, pinned company and location, and token expiry.

Where no keychain is reachable — Windows, a headless box, CI — it falls back to ~/.pxb/secrets.json at 0600 and says so. pxb whoami always reports which store is in use.

Access tokens last an hour and renew themselves — a browser sign-in from its refresh token, an API client from its stored secret. A refresh token is good once; if one is ever used twice, the sign-in is cut off, since that means a copy exists somewhere it shouldn't.