Skip to content
Oluso

Platform

API keys

The credential is the session from sign-in. The CLI stores a bearer token. The desk stores a cookie.

On this page

The session is the key

Oluso Swift and Oluso Sentinel run on your account. You do not configure a separate model key. oluso login issues an access token and a refresh token. The CLI sends the access token as Authorization: Bearer on later requests, and refreshes it after a 401.

SurfaceHow you sign inWhere the secret lives
CLIoluso login device code~/.oluso/credentials.json, or $OLUSO_HOME/credentials.json. Directory mode 0700, file mode 0600.
DeskEmail and password at /loginHttpOnly session cookie. Changes send x-oluso-request: 1.
VS CodeOluso: Sign in, email and passwordEditor secret storage, keys oluso.access and oluso.refresh.

Device code

  1. Run oluso login. The CLI calls POST /v1/device/start.
  2. It prints a user code and a verification URL on your desk (/device).
  3. Sign in on the desk and approve that code. The desk calls POST /v1/device/approve.
  4. The CLI polls POST /v1/device/token until the status is approved, then writes the tokens.
  5. A successful sign-in prints Signed in as <name>.

The code expires after 15 minutes. The poll interval comes from the start response, and the CLI waits two seconds when the server omits one.

Use the token

Commands that need an account (oluso, oluso chat, oluso whoami, oluso balance, oluso scan --upload) read the access token from disk. There is no second command that mints a key. To call the HTTP API yourself, use that bearer token, or sign in from the desk and use the cookie.

bash

oluso whoami
oluso balance
oluso logout

oluso logout clears the access token and the refresh token in the credential file. It prints Signed out. Deleting ~/.oluso removes the file. See API for the routes those commands call.