pixee-auth
starsforks
How to install pixee-auth?
pixee/pixee-cli/pixee-auth
$npx -y skills add pixee/pixee-cli --skill pixee-authStore and validate Pixee API tokens and inspect the current authentication state.
SKILL.md
| 1 | # pixee auth |
| 2 | |
| 3 | > **PREREQUISITE:** Read `../pixee-shared/SKILL.md` for global flags, exit codes, and error |
| 4 | > handling. Exit code 2 is the signal that authentication failed — this skill is the fix. |
| 5 | |
| 6 | `pixee auth` manages the credentials `pixee` uses to talk to a Pixee deployment: it stores an API |
| 7 | token, configures which server to target, validates, and surfaces the current authentication |
| 8 | state. |
| 9 | |
| 10 | ## Commands |
| 11 | |
| 12 | ### pixee auth login |
| 13 | |
| 14 | Store and validate a Pixee API token. The token is written to a platform-appropriate config file |
| 15 | (`~/Library/Preferences/pixee` on macOS, `$XDG_CONFIG_HOME/pixee` on Linux, |
| 16 | `%APPDATA%\pixee\Config` on Windows) with `0600` permissions on Unix (Windows inherits the |
| 17 | per-user directory's NTFS ACL). `pixee auth login` confirms the token against |
| 18 | `GET /api/v1/users/me` — success exits 0, invalid token exits 2. |
| 19 | |
| 20 | Flags: |
| 21 | |
| 22 | - `--server <url>` — deployment to authenticate against. Required on first login. |
| 23 | - `--token <value>` — API token from the admin console's **API Tokens** page. |
| 24 | - `--token -` — read the token from stdin. Prefer this over `--token <value>`: flag arguments land |
| 25 | in shell history. |
| 26 | |
| 27 | ```bash |
| 28 | # Interactive login |
| 29 | pixee auth login --server https://pixee.example.com --token pixee_xxx |
| 30 | |
| 31 | # Stdin form — keeps the token off the command line |
| 32 | echo -n "$PIXEE_TOKEN" | pixee auth login --server https://pixee.example.com --token - |
| 33 | ``` |
| 34 | |
| 35 | ### pixee auth status |
| 36 | |
| 37 | Print the current authentication state: configured server, whether the stored token validates, and |
| 38 | the authenticated identity. API-token auth surfaces a generic `api-token` identity rather than a |
| 39 | real user's name or email — the device-code flow (future) provides real identity. |
| 40 | |
| 41 | ```bash |
| 42 | pixee auth status |
| 43 | # Logged in to https://pixee.example.com as api-token |
| 44 | # Token: valid |
| 45 | ``` |
| 46 | |
| 47 | ## Credential resolution |
| 48 | |
| 49 | For every subcommand except `pixee auth login`, token and server are resolved in order: |
| 50 | |
| 51 | - **Token:** `PIXEE_TOKEN` env var → stored config. |
| 52 | - **Server:** `--server` flag → `PIXEE_SERVER` env var → stored config. |
| 53 | |
| 54 | Setting `PIXEE_TOKEN` + `PIXEE_SERVER` is the CI/CD and agent-automation path — no |
| 55 | `pixee auth login` step is required. The `--token` flag exists only on `pixee auth login` itself |
| 56 | (to *store* a token); it is not a per-invocation override for other subcommands. |
| 57 | |
| 58 | There is no hardcoded default server. If no server is configured via any mechanism, commands exit |
| 59 | with an error directing the user to run `pixee auth login` or set `PIXEE_SERVER`. |
| 60 | |
| 61 | ## Fixing exit code 2 |
| 62 | |
| 63 | When a command exits with code 2 ("Authentication failed"): |
| 64 | |
| 65 | 1. Run `pixee auth status` to check which server is configured and whether the current token |
| 66 | validates. |
| 67 | 2. If the server is wrong, re-run `pixee auth login --server <correct-url>` or set |
| 68 | `PIXEE_SERVER`. |
| 69 | 3. If the token is expired or revoked, generate a new one in the admin console's **API Tokens** |
| 70 | page and log in again — preferably via `--token -` stdin or the `PIXEE_TOKEN` env var. |
| 71 | |
| 72 | ## Best practices |
| 73 | |
| 74 | - Generate a separate API token per automation context so tokens can be rotated or revoked |
| 75 | independently. |
| 76 | - Prefer `PIXEE_TOKEN` / `PIXEE_SERVER` env vars for CI/CD and agent automation — no local state, |
| 77 | nothing to commit. |
| 78 | - Use `pixee auth status` to confirm the configured server matches the deployment where the token |
| 79 | was issued; mismatched server is the most common cause of 401s. |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
