publier login

Signs you in to Publier. The browser flow is the default: publier login opens your browser, you sign in, and the CLI stores the result at ~/.config/publier/auth.json (mode 0600). Subsequent publier dev and publier build runs pick it up automatically.

Usage

publier login                  # browser sign-in (default)
publier login --device         # headless host — approve on another machine
publier login --token <token>  # install a token you already have

Options

Option	Description
`--device`	Use the device-code flow instead of the browser. `--no-browser` is accepted as an alias.
`--token <token>`	Import an existing human access token. Requires client configuration already cached by browser or device sign-in on this machine. It does not fetch that configuration or mint CI credentials.
`--api <url>`	Publier deployment to read the browser/device sign-in configuration from. Defaults to `https://atestum.com`; the `PUBLIER_ATESTUM_URL` environment variable does the same. It does not seed configuration for `--token` imports.
`--help`, `-h`	Print usage and exit `0`.

publier login binds a loopback port, opens your browser at the sign-in page, and waits for the redirect back. You have five minutes to finish.

If no browser can be opened, or no loopback address can be bound, the CLI prints a note and falls back to device sign-in on its own — you don’t have to retry with a different flag.

For an interactive sign-in on a headless host, such as an SSH session, use publier login --device. The CLI prints a URL and a short code:

To sign in, visit:

  https://atestum.com/device

and enter the code:

  WDJB-MJHT

Or open this link, which fills the code in for you:

  https://atestum.com/device?user_code=WDJB-MJHT

Waiting for sign-in...

Open the URL on any machine that has a browser, approve the sign-in, and the CLI picks up the result where it’s running.

Signing in is not the same as holding a seat

Signing in is authentication. A seat is entitlement, and the seat is what publier dev and publier build require. The two are reported separately on purpose.

With a seat:

Signed in. Production builds now active.

Without one:

Signed in, but this account has no Publier seat — `publier build` will refuse to run until an administrator assigns one.

The second message means the sign-in worked and there’s nothing wrong with it. Running publier login again will not change the outcome — ask whoever administers your Publier subscription to assign you a seat. Both cases exit 0.

Token precedence

On a fresh machine, use browser or device sign-in first. publier login --token does not provision the client-configuration cache, even when the machine is online. An imported token also has no refresh token and cannot renew itself.

If PUBLIER_TOKEN is set in your environment, it takes precedence over the stored sign-in. publier login only writes the stored file — it does not touch environment variables. See the token model.

Staying signed in

The stored sign-in renews itself: publier dev, publier build, and publier doctor refresh the access token when it’s close to expiring. You stay signed in until you run publier logout or your seat is withdrawn — a withdrawn seat makes the renewal fail, and builds stop once the current token expires.

Signing in also caches the public signing keys and client configuration. A valid cached human JWT can be checked offline; refreshing it requires network access. For unattended CI, use the per-job claim action and its proof key instead of interactive device sign-in.

Exit codes

Code	Meaning
`0`	Signed in. Also returned when the account holds no seat — read the message.
`1`	Sign-in failed, the supplied token was rejected, or the result could not be saved.