nebula-scorm-auth

One-time login CLI for the SCORM Builder MCP server. You sign in once with your SCORM Builder (Firebase) account and it issues a long-lived API key (sk-mcp-…) that any MCP-compatible coding agent (Claude Code, OpenCode, Cursor, …) sends as a Bearer token. The key never expires — no more re-authenticating every hour.

Zero dependencies — uses only Node built-ins and the Firebase REST API.

Quick Start

npx nebula-scorm-auth login         # sign in (browser) → issues your API key
npx nebula-scorm-auth token         # → sk-mcp-...   (use in your agent config)

Install

Run on demand with npx (no install):

npx nebula-scorm-auth login

Or install globally so you can type scorm-auth directly:

npm install -g nebula-scorm-auth
scorm-auth login

Commands

| Command | Description | |---------|-------------| | scorm-auth login | Sign in via your browser; issues and stores a long-lived API key | | scorm-auth token | Prints your API key (sk-mcp-…) — for your agent config | | scorm-auth status | Shows who you're signed in as and the active key (masked) | | scorm-auth revoke | Revokes the stored API key (stops working immediately) and clears it | | scorm-auth logout | Clears local credentials (does not revoke the key) |

Run via npx nebula-scorm-auth <command> if you didn't install globally.

How login works

1. login starts a tiny HTTP server on a random localhost port and opens your browser to a sign-in page served from it.
2. You enter your email/password; the page sends them to the localhost server, which exchanges them with Firebase for a short-lived ID token (your password is never stored).
3. The CLI calls the SCORM Builder server with that ID token to issue a long-lived API key (sk-mcp-…).
4. The API key is saved to ~/.scorm-auth/credentials.json (directory 0700, file 0600) and shown to you once. From then on, scorm-auth token just prints it — there's nothing to refresh.

Configure your agent

Claude Code

claude mcp add scorm-builder \
  --transport http \
  --url https://scorm-builder-app-759854934093.asia-south1.run.app/mcp \
  --header "Authorization: Bearer $(scorm-auth token)"

OpenCode (opencode.json)

{
  "mcpServers": {
    "scorm-builder": {
      "url": "https://scorm-builder-app-759854934093.asia-south1.run.app/mcp",
      "headers": { "Authorization": "Bearer ${SCORM_TOKEN}" }
    }
  }
}

export SCORM_TOKEN=$(scorm-auth token)
opencode

Since the key doesn't expire, you can also paste the sk-mcp-… value directly into any agent that takes a static Authorization: Bearer <token> header.

Environment variables

| Variable | Purpose | |----------|---------| | SCORM_AUTH_DIR | Override the credential directory (default ~/.scorm-auth) | | SCORM_SERVER_URL | Override the server base URL (default: production Cloud Run) | | SCORM_MCP_URL | Override the MCP endpoint URL shown in the post-login hint | | NO_COLOR | Disable colored output |

Security

• API keys don't expire. They stop working immediately when your account is deactivated by an admin — or when you run scorm-auth revoke.
• The server stores only a SHA-256 hash of your key (never the raw key). The raw key lives solely in ~/.scorm-auth/credentials.json (0600) on your machine.
• The Firebase Web API key embedded in the CLI is a public client identifier (the same one the web app ships), not a secret.
• The MCP server verifies every request and enforces the same role-based access as the web UI.