NamoID CLI

Deterministic local setup and diagnostics for NamoID Customer Identity.

Install

Run without installing globally:

npx @namoidhq/cli --help

Or install the namoid command:

npm install --global @namoidhq/cli
namoid --help

Requires Node.js 20 or newer.

Commands

Start from the application repository with one command. init signs in when needed, detects the local setup, and creates the NamoID Application after one confirmation:

npx @namoidhq/cli init

After browser sign-in, the CLI loads the workspaces and projects available to the signed-in account and asks which human-readable destination to use. When no suitable workspace or project exists, init offers to create it and uses its Test environment automatically. UUID flags remain optional overrides for CI or other non-interactive automation; people do not need to copy identifiers from the Console.

Detection, diagnostics, previews, and optional session controls remain available independently:

namoid detect
namoid doctor
namoid init --dry-run
namoid login
namoid whoami
namoid logout
node ./bin/namoid.js doctor --json
node ./bin/namoid.js ai setup codex --dry-run
node ./bin/namoid.js ai setup claude --dry-run
node ./bin/namoid.js setup
node ./bin/namoid.js setup codex --dry-run
node ./bin/namoid.js plugin status
node ./bin/namoid.js plugin update claude --dry-run

It detects supported frameworks, installed NamoID SDKs, callback routes, and required environment-variable names. It never prints environment-variable values.

namoid doctor recognizes Next.js, React, Express + React, FastAPI, Flask, and Django. It checks supported SDK versions and looks for static evidence of state, nonce, S256 PKCE, ID-token validation, refresh rotation, revocation, and logout. Missing source evidence is reported as a warning because an application may encapsulate the control in shared middleware; it is never presented as proof of runtime security.

namoid init is the recommended first command. It detects the framework, package name, dev port, callback route, and SDK. When no CLI session exists it opens browser login automatically. After login, it asks for the Application name and clearly identifies that name as public on hosted sign-in and consent screens. The detected package name is only a suggested default. After one confirmation it creates the Application. For a confidential web Application, the Client Secret is returned once and must be stored immediately as NAMOID_CLIENT_SECRET in server-only secret storage. Non-interactive runs must provide --name. AI extension setup is separate and opt-in through namoid setup codex or namoid setup claude.

The CLI is an OAuth public native client. namoid login opens the system browser, uses Authorization Code with S256 PKCE, and receives the callback on a random loopback port. It has no client secret. Rotating tokens are stored in the current user's private NamoID configuration directory with owner-only file permissions and are revoked by namoid logout.

AI host plugins remain separate OAuth clients owned by Codex or Claude; the CLI does not copy or share their credentials.

Host plugins live in separate official NamoID repositories. The CLI registers those repositories as native Codex or Claude marketplaces and asks the host's plugin manager to install and update the plugin. Plugin releases therefore do not require a matching npm release of the NamoID CLI.

Run namoid ai setup codex or namoid ai setup claude to verify and install the corresponding marketplace for the current user. Add --dry-run to preview the release identity and installation steps without changing host settings.

Plugin lifecycle

namoid setup                         # detect supported AI hosts
namoid setup codex                   # verified install with confirmation
namoid plugin install cc             # aliases: cc, claude-code, openai
namoid plugin status                 # inspect all supported hosts
namoid plugin update claude --dry-run
namoid plugin uninstall codex

Customer Identity skills

The published CLI contains six versioned, portable Customer Identity skills: setup, diagnosis, verification, secure logout, session review, and production readiness. setup installs both the verified host extension and these skills; they can also be managed independently:

namoid skills install codex
namoid skills install claude
namoid skills status
namoid skills update codex --dry-run
namoid skills uninstall claude

Mutating commands prompt by default. Use --yes only for an intentional non-interactive run. --json returns the stable schema used by automation, and --plain keeps output decoration-free.

Security

The CLI does not print environment-variable values. AI plugins are installed only from the official NamoID marketplace repositories through each host's native plugin manager. Review repository changes and protect releases with GitHub branch protection, required reviews, and release immutability. Report vulnerabilities privately according to SECURITY.md.

Links

• NamoID
• Documentation
• Issues
• npm package

License

MIT © PolyMindsLabs Pvt. Ltd.