Export tokens for downstream tools

`delta-forge-cli auth` prints `session_token=...`, `access_token=...`, and `refresh_token=...` as key=value lines on stdout (one per line). Parse with shell to export as env vars, or pass directly to tools that honour DF_SESSION_TOKEN.

Syntax

delta-forge-cli auth

Description

## Overview `delta-forge-cli auth` authenticates against the current profile and writes the resulting tokens to stdout in `key=value` form, one per line. Metadata (profile name, user, expiry hints) is written to stderr so it does not contaminate the machine-readable stdout stream. Downstream tools either parse stdout directly or consume the tokens through the `DF_SESSION_TOKEN` / `DF_ACCESS_TOKEN` environment variables. ## Recipe ```bash #!/usr/bin/env bash set -euo pipefail # Load fresh tokens into env vars named DF_session_token, DF_access_token, DF_refresh_token eval "$(delta-forge-cli --profile prod auth | sed 's/^/export DF_/')" curl -fsS \ -H "Authorization: Bearer $DF_session_token" \ "$DF_CONTROL_URL/v1/workspaces" \ | jq '.workspaces[] | .name' ``` The `eval` step rewrites each `key=value` line into `export DF_key=value`, making the tokens available to any process inherited by the current shell. ## Output format Stdout (one entry per line, exactly these keys): ``` session_token=eyJhbGciOi... access_token=eyJhbGciOi... refresh_token=eyJhbGciOi... ``` Stderr carries human-readable context such as profile name, user identity, and refresh-after hints. ## Behavior - Tokens are emitted in plain text; no base64 or other encoding. - The command refreshes tokens if the cached pair is near expiry, then prints whatever is current. - The subcommand exits 0 on success, 1 on authentication failure, 2 on client init failure. - If the profile uses a keychain-backed credential, the OS may prompt for unlock before the tokens are printed.

Examples

# Export each token as DF_<KEY> in the current shell:
eval "$(delta-forge-cli auth | sed 's/^/export DF_/')"
echo "$DF_access_token"

# Extract just the session token for a curl call:
TOKEN=$(delta-forge-cli auth | awk -F= '/^session_token=/ { print $2 }')
curl -sS -H "Authorization: Bearer $TOKEN" "$DF_CONTROL_URL/v1/workspaces"

# Pipe into a .env file (mind the file permissions):
umask 077
delta-forge-cli auth > .df.env
chmod 600 .df.env

Pitfalls

• Tokens are written to stdout as plain text. Any CI step that logs stdout (for example, `set -x` tracing or a verbose log aggregator) publishes the tokens into the build log where anyone with read access can replay them.
• A file captured with `delta-forge-cli auth > .df.env` inherits the umask of the invoking process. Set `umask 077` first or `chmod 600` after, otherwise world-readable tokens sit on disk.
• The keys are snake_case (`session_token`, `access_token`, `refresh_token`). Scripts that grep for `SESSION_TOKEN=` or `accessToken=` will not match.
• Token lifetime is bounded. A long-running pipeline that caches the output once and re-uses it later will see 401s once the access token expires; re-run `delta-forge-cli auth` (which triggers a refresh) to get fresh tokens.

See Also

• CLI_AUTH