Sign in from the CLI: tv-sdk login

login is the interactive credential path for the SDK CLI. You sign in once in your browser; after that, every sandbox command authenticates itself from your OS keyring — no keys to mint, no environment variables to export.

npx @tv/extension-sdk login

The CLI prints a short confirmation code, opens your browser to the platform sign-in page (or prints the URL if it can't — --no-browser skips the attempt entirely), and waits. You sign in with your developer account, check that the code on the page matches the one in your terminal, and approve. The terminal side finishes on its own:

  Confirm this code in the browser: ABCD-EFGH

  Opening your browser. If it did not open, visit:
  https://auth.k8s.tangovision.dev/realms/developers/device?user_code=ABCD-EFGH

  Waiting for approval… (Ctrl-C to abort)

✓ Logged in as dev@example.com
  Credentials stored in the OS keyring.

This is the standard OAuth 2.0 device authorization flow — the CLI never sees your password, and tokens are never printed to the terminal.

Where credentials live

Tokens are stored in your operating system's keyring: Keychain on macOS, Secret Service (libsecret) on Linux desktops, Credential Manager on Windows.

When no keyring is usable — a headless Linux box with no D-Bus secret service, say — the CLI falls back to ~/.config/tv-sdk/credentials.json with 0600 permissions and warns you on stderr that it did. You can force either backend with TV_SDK_TOKEN_STORE:

Value	Behaviour
(unset)	Keyring, falling back to the file with a warning
file	Always the file — the right setting for headless CI
keyring	Keyring or fail — turns a silent fallback into a hard error

Session lifetime and refresh

Access tokens are short-lived (minutes); the CLI refreshes them automatically before each command, so you never see the expiry. The session itself survives until it goes 30 days unused — the flow requests offline_access for exactly this reason, so a CLI session doesn't die with the browser's 30-minute SSO idle timeout.

Check who you are signed in as at any time:

npx @tv/extension-sdk whoami

whoami exercises the full chain — stored credentials, automatic refresh, and the realm accepting the result — so it doubles as a health check for your session.

Signing out

npx @tv/extension-sdk logout

logout revokes the session server-side (so the stored refresh token is dead even if a backup of your keyring exists somewhere) and then clears local storage. Clearing happens even when the realm is unreachable — logging out never leaves tokens behind.

Login or API key?

Both credentials work against the same sandbox API; they serve different callers:

	tv-sdk login	API key (tvk_…)
For	You, interactively	CI and other non-interactive automation
Obtained	Browser sign-in from the CLI	Minted in the developer portal
Lives in	OS keyring	Your secret store / CI secrets
Expires	After 30 days unused	Per-key expiry chosen at mint time

Sandbox commands resolve their credential in this order: the --token= flag, then the TV_API_TOKEN environment variable, then your stored login session. So a shell with TV_API_TOKEN exported keeps behaving exactly as before — login only fills the gap when neither explicit credential is present.

Options

Flag	Meaning
--no-browser	Don't try to open a browser; just print the URL and code
--issuer=<url>	Sign in against a different realm (default: the developers realm)
--client-id=<id>	Use a different OAuth client (default: tv-sdk-cli)
--format=json	Machine-readable output, for scripting

Accounts are currently created by invitation — see Developer account for how the preview onboarding works.