Authentication

The CLI uses the OAuth device authorization flow (RFC 8628) — the same pattern used by the GitHub CLI. No passwords are entered in the terminal.

How the Device Flow Works

Rendering diagram...

If you already have an API key (e.g., for CI/CD or scripts), skip the browser flow:

1dm login --key dm_sk_live_xxxxx

This verifies the key against the API and saves it locally.

If you do not have an API key yet, use the public API onboarding flow first:

dm signup developer@example.com --login creates the account, returns an API key, and stores it locally. Add --phone-number +15551234567 if the API environment requires phone numbers.
dm plans lists public self-serve Basic and Pro plan prices.
dm checkout --price-id price_xxx_monthly creates a Stripe checkout session with that API key.

You can also call POST /v1/signup, GET /v1/plans, and POST /v1/checkout directly.

Logout

1dm logout

Removes stored credentials from ~/.dealmachine/config.json.

Check Auth Status

1dm whoami

12345678Current authentication:

  Organization: My Company (my-company)
  Org ID:       1
  API Key:      dm_sk_live_VMgXKyJQ...
  Key ID:       key_abc123def456

Config file: /Users/you/.dealmachine/config.json

Use --verify to test your key against the server:

1dm whoami --verify

Credential Storage

Credentials are stored at:

1~/.dealmachine/config.json

The file has 0600 permissions (owner-only read/write) and contains:

1234567{
  "apiKey": "dm_sk_live_xxx",
  "keyId": "key_abc123",
  "organizationId": 1,
  "organizationName": "My Company",
  "organizationSlug": "my-company"
}

Never share your config.json file or commit it to version control. The API key provides full access to your organization's data.

Revoking Access

To revoke a CLI key:

Go to Developer Settings
Find the key (named "CLI" or the device name)
Click Revoke

After revoking, run dm logout to clean up local credentials, then dm login to re-authenticate.

Troubleshooting

Browser doesn't open automatically

Use the --no-browser flag and manually visit the URL:

1dm login --no-browser

Code expired

Device codes expire after 30 days. Run dm login again to get a fresh code.

Wrong organization

Run dm logout first, then dm login again. Make sure you select the correct organization in the browser.

Invalid credentials

Your key may have been revoked. Run:

1dm whoami --verify

If it fails, run dm logout && dm login to re-authenticate.