@agentkeychain/cli

Bootstrap autonomous agents (OpenClaw, Claude Code, Devin, custom) against AgentKeychain without copy-pasting tokens.

npm install -g @agentkeychain/cli
akc login

This opens a browser to AgentKeychain, you click Authorize, a one-time code lands on a short-lived 127.0.0.1 callback the CLI is listening on, and the CLI trades it for an agent refresh token. The token is written to ~/.agentkeychain/tokens.json (mode 0600). Your autonomous agent reads from that file via the @agentkeychain/agent SDK.

The default flow is RFC 8252 + PKCE — the same pattern used by gcloud auth login, gh auth login, and stripe login.

Commands

• akc login — authorize a new agent on this machine (loopback flow, falls back to device flow automatically when loopback binding fails)
• akc login --device — force the RFC 8628 device flow (see below)
• akc status — show the current agent ID and token state
• akc logout — delete the local credential file

Headless environments: akc login --device

On machines without a browser or where loopback ports can't be bound (EC2, Docker containers, CI runners, SSH sessions), the loopback flow doesn't work. Pass --device (or let the CLI auto-fall-back) to use the RFC 8628 device authorization grant instead — the same pattern gh auth login uses on headless machines:

$ akc login --device

To authorize this CLI, visit:
  https://agentkeychain.com/device

and enter code:  BCDF-GHJK

(or open: https://agentkeychain.com/device?user_code=BCDF-GHJK)

Waiting for approval…

You open the URL in any browser (on your laptop, phone, wherever you can sign in), type the 8-letter code, and approve. The CLI polls until the server confirms, then writes tokens as usual. The two machines never talk to each other directly — each one independently talks to AgentKeychain.

Phishing-resistance

The consent page on /device displays the requester IP and a client hint (hostname@platform) for the machine that ran akc login --device. If someone DMs you a user_code and asks you to approve it, those fields will show a machine that isn't yours — cancel in that case. The page includes an explicit warning: "Only approve if YOU started this process."

Env vars

• AKC_AUTH_SERVER — auth server URL. Default: https://agentkeychain.com.
• AKC_DASHBOARD_URL — /cli-login page URL. Defaults to AKC_AUTH_SERVER. Only set this if the dashboard is on a different origin from the API (e.g. local dev).

Local dev

AKC_AUTH_SERVER=http://localhost:3000 \
AKC_DASHBOARD_URL=https://app.lvh.me:5173 \
  node dist/index.js login