Authenticate

Create an API client in the console on the API page — /console/api on whichever host you're using — to get a client ID and secret, then:

pxb auth

You are prompted for both values; the secret is not echoed. The credentials are exchanged at the token endpoint before anything is stored, so a typo fails immediately rather than later.

The prompt prints the exact link for the host you're authenticating against, so you don't have to work out which console it means.

For CI, skip the prompts:

pxb auth --client-id "$PXB_CLIENT_ID" --client-secret "$PXB_CLIENT_SECRET"

Point at a non-production host with --base-url. It is saved on the profile, so you pass it once:

pxb auth --base-url http://localhost:3000

Where credentials live

The client secret and access token go into the operating system keychain — the macOS keychain, or the system keyring via secret-tool on Linux. They are handed to those tools over stdin, never as command line arguments, so they never appear in ps output or your shell history.

Only non-secret metadata is written to disk, in ~/.pxb/config.json at 0600: client ID, API host, pinned company and location, and token expiry.

Where no keychain is reachable — Windows, a headless box, CI — it falls back to ~/.pxb/secrets.json at 0600 and says so. pxb whoami always reports which store is in use.

Access tokens are short-lived and refreshed automatically from the stored secret. You never manage a token yourself.