Complete an interactive CLI sign-in
Finish an interactive CLI sign-in after the user picks a workspace and scopes. Send the selection_token from the poll response. The workspace must be one of the user’s memberships. The server always includes the minimum scopes and the member’s role limits the final set. When workspace_name is present, the server checks that the user is an admin, mints the token, and then renames the chosen workspace. A failed rename does not fail the sign-in. The selection token expires after 10 minutes. This endpoint does not require authentication.
Body
Selection token from POST /cli/login/poll with interactive set to true.
Workspace that receives the token. Without this field, the server uses the user's first workspace.
New name for the chosen workspace. Use it when the workspace option has has_default_name set to true. The user must be an admin of the workspace. An empty value keeps the current name. When the value equals the current default name, the server records that the user chose the name and onboarding.workspace_named becomes true. If the rename fails, the sign-in still completes and organization_name shows the current name.
100Scopes the user selected. The server always includes the minimum scopes scans:read, scans:write, and billing:read. The member's role limits the final set.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Named CLI authority preference. Minimal grants scans and billing:read. Recommended adds every scope that everyday strix cloud commands use: vulnerabilities, dependencies, supply chain, schedules, assets, knowledge, PR reviews, connectors, chat, uploads, integrations, analytics, license, webhooks:read, audit:read, organizations:read, organizations:write, and billing:write. Full means the session's approved ceiling after login and adds account administration (members, invitations, tokens, webhooks:write, LLM, test users). Custom requires an explicit scopes array. The member's role caps every profile.
minimal, recommended, full, custom Response
Sign-in complete. The api_token field contains the raw secret — store it securely.
Raw personal API token secret. Only returned at sign-in time.
Expiry of the API token.
True when this sign-in created the account.
Scopes granted to the minted token.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Maximum authority approved for this session at login.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Named CLI authority preference. Minimal grants scans and billing:read. Recommended adds every scope that everyday strix cloud commands use: vulnerabilities, dependencies, supply chain, schedules, assets, knowledge, PR reviews, connectors, chat, uploads, integrations, analytics, license, webhooks:read, audit:read, organizations:read, organizations:write, and billing:write. Full means the session's approved ceiling after login and adds account administration (members, invitations, tokens, webhooks:write, LLM, test users). Custom requires an explicit scopes array. The member's role caps every profile.
minimal, recommended, full, custom api, cli Setup state of the workspace that received the token. Omitted when the server cannot read the live workspace state. The token is still valid in that case.
One short paragraph with the first commands to run after sign-in. When the workspace still has its default name, the text names the rename command for a session with organizations:write, and tells other sessions to ask a workspace admin or to sign in again with the full profile. When onboarding.github_install_url is present, the text tells the person to open the link. When the session also has integrations:write, the text names the command that creates a new link. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the text also offers the trial. The session must have the billing:write scope and no asset scopes.
Suggested first actions, in order. Each item names the CLI command and the matching API operation. Setup steps come first: name the workspace when the session has organizations:write and the workspace still has its default name, and connect GitHub when the session has integrations:write, no asset scopes, and onboarding.github_install_url is present. A deployment without the GitHub App never gets the GitHub step. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the last item starts the trial. The session must have the billing:write scope and no asset scopes.
URL of the Strix dashboard.