Tokens and login
Three ways to prove who you are to the CLI, the MCP server, or the API, each scoped to how much damage a leaked one could do.
The three shapes
| Prefix | Name | Can do | Expires |
|---|---|---|---|
| vb_live_ | Full key | Everything the account can do | Never, until revoked |
| vb_up_ | Upload token | Uploading manifests to one app | 7 days |
| vb_new_ | Onboarding token | Creating one new app, or up to 25 | 7 days, or first use for the one-app scope |
A full key can do anything your account can do through the API, so treat it like a password. An upload token can only add or update manifests on the one app it names. An onboarding token exists to hand a teammate a single command that creates their app and nothing else, and it stops working after 7 days or, for the single-app scope, after its first use.
Device login
The easiest way to get a full key without typing one in: sign in from a terminal.
npx vibebeacon login- The CLI asks VibeBeacon for a device code and an 8-character user code, then opens your browser to a page showing that code (or prints the URL if it cannot open one).
- You approve it there, signed in the normal way (magic link or GitHub). Approving mints a full key named after this machine's hostname.
- The CLI polls in the background and stores the key once you approve, or stops if you deny it or ten minutes pass.
Once stored, the CLI and the MCP server both use it automatically, so you do not pass --key or set an environment variable for everyday use.
whoami and logout
Check which account a stored credential (or --key) belongs to:
npx vibebeacon whoamiRemove the stored credential from this machine:
npx vibebeacon logoutWhere the credential lives
| OS | Path |
|---|---|
| Windows | %APPDATA%\vibebeacon\credentials.json |
| Linux / macOS | ~/.config/vibebeacon/credentials.json |
The file holds the key, the API base URL if you set one, and when it was created, as plain JSON. It is written with file mode 0600 where the filesystem supports it, so only your own account can read it, but it is not encrypted at rest by an OS keychain. Nothing in the file is ever logged or printed unmasked; the CLI shows only the prefix and last four characters, for example vb_live_****a1B2.
Treat the credential file like a password
vibebeacon logout on a machine you are decommissioning, and revoke the key from Settings, API keys if you cannot get to the file itself.See also
For the API endpoints behind device login and scoped tokens, see the API page. For every CLI command that uses a credential, see the CLI page.