Sign in to CliqHub

Signs the daemon in to CliqHub with a username and password or a personal token, and settles which realm it belongs to. Send credentials to sign in; send only realm (with or without confirm_switch) to finish a realm choice with the sign-in already stored.

What happens to the realm:

Already enrolled: it stays in its realm. Asking for another realm is refused unless cliqd runs with --allow-realm-override; then the first call lists the teams that would be removed (switch_requires_confirm) and a second call with confirm_switch: true moves it.
New daemon, one realm (or realm given): it enrolls there. If it already has teams or runs made offline, the first call lists them (enroll_requires_confirm) and nothing changes until you confirm.
New daemon, several realms, no realm: needs_realm_choice; call again with realm.

A refused sign-in stores nothing and ends the session it opened on CliqHub. Moving realm is refused while runs are going or work for the old realm has not synced.

From the CLI: cliq login.

No credential is needed from this machine. From another host, send Authorization: Bearer with a dispatch token CliqHub signed for this daemon or a cliq_tok_… personal token of a user in the daemon’s realm; this only works once the daemon is connected to CliqHub. See Authentication.

POST

curl --request POST \
  --url http://127.0.0.1:4900/v1/login \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "credentials": {
    "username": "sshah",
    "password": "<your-password>"
  }
}
'

{
  "ok": true,
  "data": {
    "identity": "sshah",
    "expires_at": null,
    "realm": "acme.production",
    "realm_locked": true,
    "enrolled": false,
    "authorized_realms": [
      {
        "slug": "production",
        "qualified_slug": "acme.production",
        "name": "Production",
        "active": true
      },
      {
        "slug": "staging",
        "qualified_slug": "acme.staging",
        "name": "Staging",
        "active": false
      }
    ],
    "default_realm": "acme.production"
  }
}

Authorizations

Authorization

string

header

required

Not needed from the same machine. From another host: a dispatch JWT CliqHub signed for this daemon, or a cliq_tok_… personal token whose user is in the daemon's realm.

Body

application/json

credentials

object

Provider credentials (username+password, or a user PAT as token); omit to reuse the stored session

Show child attributes

realm

string

Realm to enroll in / switch to (org.slug); omit to keep the current one or get the list to choose from

Minimum string length: 1

confirm_switch

boolean

Confirm the realm change: moving an enrolled daemon (needs --allow-realm-override) after seeing teams_to_remove, or enrolling with local teams/runs after seeing enroll_requires_confirm

Response

Success.

boolean

required

data

object

required

What happened. Three replies ask you to call again: needs_realm_choice (pick a realm), switch_requires_confirm and enroll_requires_confirm (send the same realm with confirm_switch: true).

Show child attributes

curl --request POST \
  --url http://127.0.0.1:4900/v1/login \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "credentials": {
    "username": "sshah",
    "password": "<your-password>"
  }
}
'

{
  "ok": true,
  "data": {
    "identity": "sshah",
    "expires_at": null,
    "realm": "acme.production",
    "realm_locked": true,
    "enrolled": false,
    "authorized_realms": [
      {
        "slug": "production",
        "qualified_slug": "acme.production",
        "name": "Production",
        "active": true
      },
      {
        "slug": "staging",
        "qualified_slug": "acme.staging",
        "name": "Staging",
        "active": false
      }
    ],
    "default_realm": "acme.production"
  }
}

Introduction

System

Teams

Workspaces

Runs

Artifacts

Agents

Settings

Instances

Daemon

Sign-in

Local tokens

HUG

Hub commands

Sign in to CliqHub

Authorizations

Body

Response