Authenticate rvs and manage local profiles

Interactive rvs sessions use browser-backed device login. The CLI never asks for your Ravenstash password.

rvs auth login

Follow the browser prompt, review the device request, and approve it. Then check the local session and verify the user with Ravenstash:

rvs auth status
rvs auth whoami

Request a particular device-session duration when needed:

rvs auth login --duration 12h

The default is 180 days. Requested durations range from 12 hours to 180 days.

Understand users, profiles, and accounts

The authenticated user is the person recorded as the actor. A local profile is named CLI configuration and a credential slot; it is not the user. An acting account is the personal account or organization used for authorization and usage attribution.

Signing in does not require a separate login for every organization. After login, choose among the accounts available to that user:

rvs account list
rvs account use personal
rvs account use org:acme

See Accounts and package targets for the selection rules and terminal prompt.

Use multiple local profiles

Use multiple profiles when the same computer needs separate Ravenstash users or environments:

rvs auth login --profile work
rvs auth login --profile personal

Manage profiles with:

rvs profile list
rvs profile current
rvs profile use work
rvs profile rename work company
rvs profile delete personal

Two profiles may represent two different users who both belong to the same organization. They can select the same org:... account and repositories; Ravenstash attributes usage to the organization and retains each user as the individual actor.

Use the intended profile before selecting its account and package target:

rvs profile use company
rvs account use org:acme
rvs art select platform/packages
rvs npm ci

Set RVS_PROFILE when several commands in a shell should use one profile:

export RVS_PROFILE=company

Credential storage

rvs stores access and rotating refresh credentials in the configured credential store: an available operating-system keyring, an initialized pass store, or the encrypted Ravenstash vault. Plaintext storage is available only after an explicit insecure-storage acknowledgement. Non-secret profile, account, and target metadata lives in ~/.rvs/config.toml.

Credentials refresh when required. Use rvs auth storage doctor to inspect the available stores without exposing credentials.

Use an automation token

For an unattended process, inject an eligible token through RVS_TOKEN:

export RVS_TOKEN="${TOKEN_FROM_SECRET_STORE}"
rvs auth whoami

RVS_TOKEN takes precedence over stored profile credentials and is not refreshed. Its target account, explicit grants, and current source permissions determine access. An empty or invalid value fails without falling back to stored credentials.

Sign out locally

Remove the active profile’s credentials:

rvs auth logout

Or remove credentials from every local profile:

rvs auth logout --all

This does not delete repositories or revoke automation tokens. Revoke an unrecognized device session from Ravenstash account settings.