Skip to main content

​
Create a profile

A fresh installation has no profile. Check existing profiles before creating one:
Use the API origin as --host, without /rest/v1. The first profile becomes active. Creating another profile does not switch the active one.

​
Sign in

Complete the browser sign-in and choose an organization. Check the identity returned by auth status before making changes. auth whoami also retrieves your identity. Use --reauth when fresh browser authentication is required. To request a narrower set of scopes, pass --scope for each scope you need; check parkes auth login --help for the defaults.

​
Use a remote shell

Open the printed URL on a device with a browser and complete the authorization. The CLI waits for completion. --no-browser alone keeps the regular login flow and prints its URL instead of opening a browser.

​
Work across organizations

Every grant belongs to one organization. Authorize each organization separately. A profile can remember its organization and select a cached account for it. For a second organization, create another profile and sign in to it:
Select a profile for one command with --profile, or change the active profile explicitly:
--org ORGANIZATION_UUID and parkes organizations use ORGANIZATION_UUID select context for an already authorized organization. They cannot expand a token’s access. If you supply a token for a different organization, the CLI rejects the mismatch.

​
Scripts and unattended access

Supply a personal token through PARKES_TOKEN, using your secret manager or runner’s secret environment. This overrides the credential store for API requests. You still need a profile for the API host. Personal tokens retain their scopes and organization restrictions. They can write Knowledge only in your own namespace. See API authentication for credential management. parkes auth tokens create requires recent first-party browser authorization and a new --output-file destination. It writes the secret to that file, not stdout. A lost issuance secret cannot be recovered by replaying the request; revoke it and issue another.

​
Credential storage

Login and refresh credentials use the OS credential store. Profile configuration contains nonsecret host and identity information. If the credential store is unavailable, the CLI requires an explicitly supplied environment token; there is no plaintext token-file fallback. If a refresh request is interrupted and its outcome is uncertain, sign in again. Do not repeatedly replay a rotating refresh token.

​
Sign out

This revokes the selected authorization and removes its stored credential. Use parkes auth logout --all to visit all cached accounts.