Auth
@create api offers seven auth kinds. The secret fields follow the kind. A blank secret on a later edit keeps the stored one.
| Kind | What you fill in | Where the secret lives |
|---|---|---|
| None | Base URL only | Nowhere |
| API key | Header name, default X-Api-Key, and the key | Keychain, or a vault reference |
| Bearer | The token | Keychain, or a vault reference |
| Basic | Username and password | Password in the keychain, or a vault reference |
| Client credentials | Azure tenant id, client id, client secret, scope | Client secret in the keychain, or a vault reference |
| OAuth (browser) | Authorization URL, token URL, client id, optional client secret | Tokens in memory. Optional secret in the keychain |
| OAuth (device code) | Token URL, device URL, client id, optional client secret | Tokens in memory. Optional secret in the keychain |
Client credentials are the Azure app-only flow: the app asks Entra for a token with the tenant, the client id, and the secret, then sends that token on the call.
Browser sign-in
OAuth (browser) is authorization code with PKCE S256. The app listens on 127.0.0.1, opens your browser, checks state, and exchanges the code at the token URL. The client secret is optional.
@signin GitHub
@signout GitHubA call with no valid token tells you to run @signin <connection>. @signout <connection> forgets the tokens. Ctrl+C cancels a sign-in.
Tokens are cached in memory only, per connection, and refresh themselves when the server sent a refresh token. A restart means signing in again.
Device code
OAuth (device code) prints the code and the verification URL in the terminal and polls the token URL. It honours interval and slow_down. Ctrl+C cancels the wait.
Browser and device-code connections cannot run headless. termorq-cli refuses them. Client credentials, a bearer token, an API key, and basic auth can run in termorq-cli when the secret is in AIT_SECRET_…, a vault reference, or the app secret store.
Headers that do not belong on the endpoint
@create endpoint refuses Authorization, Cookie, and API-key headers. Those belong on the connection. Endpoint headers are for values that are not the credential.