Auth & Account

This page collects the commands that decide "who" the CLI talks to axhub as. On a fresh install, one axhub auth login completes the browser OAuth login; in CI and agents, use a PAT (auth pat). Switch environments with profile and, if you belong to several companies, switch targets with tenants. When something looks off, doctor diagnoses install, auth, and connectivity in one pass. The full path from install to first login is covered step by step in the Quickstart.

`axhub auth`

Authentication: login, logout, status, PAT, OAuth, and IdP config.

`axhub auth idp`

Manage tenant identity providers (IdP config for SSO login).

`axhub auth idp providers`

List supported identity-provider types.

Flag	Type	Description	Default
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub auth idp test`

Test an identity provider's configuration.

Flag	Type	Description	Default
`<provider_id>`	string (positional)	—	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—

Flag	Type	Description	Default
`--device-code`	string	Resume an already-issued `AxHub` OAuth device code (env: `AXHUB_AUTH_DEVICE_CODE`)	—
`--force`	boolean	Bypass the normal safety prompt for this operation.	—
`--no-browser`	boolean	Do not open a browser automatically.	—
`--resource`	string	Value for the `--resource` option. Can also be provided via `AXHUB_OAUTH_RESOURCE`.	—
`--resume-last`	boolean	Resume the latest locally cached `AxHub` OAuth device flow for this profile	—
`--scopes`	string	Comma-separated OAuth or token scopes.	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—
`--wait-approval`	string	Keep waiting for the user's approval inside this one command, up to the given duration (6s–10m; e.g. 90s). Without it the resume polls once and exits. Use it instead of re-running the resume in a loop. Use with `--device-code` or `--resume-last`	—

`axhub auth logout`

Log out and clear stored credentials.

Flag	Type	Description	Default
`--dry-run`	boolean	Preview the operation without applying state changes.	—

`axhub auth oauth`

Manage OAuth tokens, clients, and consent.

`axhub auth oauth client`

Manage OAuth clients.

`axhub auth oauth client create`

Create a new OAuth client (dry-run by default; use --execute).

Flag	Type	Description	Default
`--allowed-resource`	string	—	—
`--app`	string	App slug or ID to operate on.	—
`--auth-method`	string	—	—
`--copy`	boolean	—	—
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—
`--grant-type`	string	—	—
`--name`	string	Resource display name.	—
`--redirect-uri`	string	—	—
`--scope`	string	—	—
`--type`	string	—	—

`axhub auth oauth client get`

Show one OAuth client's details.

Flag	Type	Description	Default
`<client_id>`	string (positional)	—	—

Manage OAuth consent grants.

Revoke a consent grant for an OAuth client.

Flag	Type	Description	Default
`<client_id>`	string (positional)	—	—
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—

`axhub auth oauth revoke`

Revoke an OAuth token (dry-run by default; use --execute).

Flag	Type	Description	Default
`<token>`	string (positional)	Token value or token identifier.	—
`--client-id`	string	—	`00000000-0000-4000-8000-000000000001`
`--client-secret`	string	—	—
`--client-secret-file`	string	—	—
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—
`--token-type-hint`	string	—	—

`axhub auth pat`

Manage personal access tokens (PAT).

`axhub auth pat issue`

Issue a new personal access token.

Flag	Type	Description	Default
`--expires-in-days`	string	Number of days before the generated credential expires.	—
`--name`	string	Resource display name.	—
`--no-save`	boolean	Print the credential without saving it locally.	—
`--show-token`	boolean	Print the generated token once after creation.	—
`--use`	boolean	—	—

`axhub auth pat list`

List your personal access tokens.

Flag	Type	Description	Default
`--reconcile`	boolean	—	—

`axhub auth pat revoke`

Revoke a personal access token (dry-run by default; use --execute).

Flag	Type	Description	Default
`<id>`	string (positional)	Resource identifier.	—
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—

`axhub auth pat rotate`

Rotate a personal access token (revoke and reissue; dry-run by default, use --execute).

Flag	Type	Description	Default
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—
`--expires-in-days`	string	Number of days before the generated credential expires.	—
`--name`	string	Resource display name.	—
`--show-token`	boolean	Print the generated token once after creation.	—

`axhub auth pat unset`

Clear the locally stored active PAT.

(no options)

`axhub auth pat use`

Save a PAT as the active local credential.

Flag	Type	Description	Default
`<id>`	string (positional)	Resource identifier.	—

`axhub auth pat whoami`

Show the user the active PAT authenticates as.

(no options)

`axhub auth refresh`

Refresh the stored OAuth access token.

Flag	Type	Description	Default
`--no-browser`	boolean	Do not open a browser automatically.	—
`--resource`	string	Value for the `--resource` option. Can also be provided via `AXHUB_OAUTH_RESOURCE`.	—
`--scopes`	string	Comma-separated OAuth or token scopes.	—

`axhub auth status`

Show the current authentication status.

(no options)

`axhub auth whoami`

Show the currently authenticated user.

(no options)

`axhub profile`

Manage local CLI profiles: add, list, switch, and remove.

`axhub profile add`

Add a new local CLI profile.

Flag	Type	Description	Default
`<name>`	string (positional)	Resource display name.	—
`--default`	boolean	—	—
`--endpoint`	string	AxHub API endpoint URL.	—

`axhub profile current`

Show the currently active profile.

(no options)

`axhub profile list`

List configured profiles.

(no options)

`axhub profile remove`

Remove a local CLI profile.

Flag	Type	Description	Default
`<name>`	string (positional)	Resource display name.	—

`axhub profile use`

Switch the active profile.

Flag	Type	Description	Default
`<name>`	string (positional)	Resource display name.	—

`axhub tenants`

Manage tenants and the active-tenant selection.

`axhub tenants get`

Show one tenant's details by slug or id.

Flag	Type	Description	Default
`<slug_or_id>`	string (positional)	Stable slug or identifier for the resource.	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub tenants invite-links`

Manage tenant invite links.

`axhub tenants invite-links accept`

Accept a tenant invite link token (dry-run by default).

Flag	Type	Description	Default
`<token>`	string (positional)	Token value or token identifier.	—
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—
`--yes` `-y`	boolean	Assume yes for non-destructive confirmation prompts.	—

`axhub tenants invite-links create`

Create a tenant invite link (dry-run by default).

Flag	Type	Description	Default
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—
`--expires-at`	string	Optional RFC3339 expiry timestamp	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub tenants invite-links list`

List tenant invite links.

Flag	Type	Description	Default
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub tenants invite-links preview`

Preview a tenant invite link token (read-only).

Flag	Type	Description	Default
`<token>`	string (positional)	Token value or token identifier.	—

`axhub tenants invite-links revoke`

Revoke a tenant invite link (dry-run by default).

Flag	Type	Description	Default
`<link_id>`	string (positional)	—	—
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—
`--yes` `-y`	boolean	Assume yes for non-destructive confirmation prompts.	—

`axhub tenants whoami`

Show your membership and role in the active tenant.

Flag	Type	Description	Default
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub config`

Read and explain local CLI configuration.

`axhub config explain`

Explain the resolved CLI configuration and its sources.

(no options)

`axhub doctor`

Run local diagnostics against config, auth, and backend reachability.

Flag	Type	Description	Default
`<args>`	string (positional)	—	—
`--offline`	boolean	Skip the network reachability probe	—

`axhub update`

Self-update the axhub CLI binary.

`axhub update apply`

Download and install the latest axhub release.

Flag	Type	Description	Default
`--dry-run`	boolean	Preview mode: print the apply plan without downloading or swapping. Defaults true — destructive paths require explicit `--execute` per `.claude/rules/product-development.md` "Destructive Command Safety"	`true`
`--execute`	boolean	Commit the apply plan: download, verify, and atomically swap the running binary. Conflicts with `--dry-run`	—
`--force`	boolean	Allow applying an older release that would otherwise be rejected by the downgrade gate. Does NOT bypass cosign verification — a signature/certificate failure still blocks the swap	—
`--yes` `-y`	boolean	Skip the interactive confirmation shown before the binary swap during `--execute`. Already bypassed under `--json`, `--no-input`, `--non-interactive`, or a non-TTY stdin. No effect in dry-run	—

`axhub update check`

Check whether a newer axhub release is available.

Flag	Type	Description	Default
`--plugin-version`	string	Also report whether the axhub Claude Code plugin is outdated. The caller (the plugin's skill) passes its installed `plugin.json` version here; the CLI fetches the published marketplace version and compares. Omitted ⇒ CLI-only check (backward compatible)	—