CLI Authentication

The doover login command authenticates you with the Doover platform using an OAuth2 device authorisation flow. Your credentials are saved to a named profile in ~/.doover/config and reused automatically for subsequent commands.

doover login

This triggers the device authorisation flow:

1. The CLI requests a device code from the Doover auth server
2. A user code is displayed in your terminal
3. Your browser opens to the Doover login page (or you navigate there manually)
4. You enter the user code and authorise the CLI
5. The CLI polls until authorisation completes, then saves your tokens

User Code:

ABCD-EFGH

Waiting for authorisation...
✓ Logged in successfully. Profile: default

To log in to the staging environment:

doover login --staging

This creates a profile named staging (unless --profile overrides it) and configures the auth server, Control API, and Data API URLs to point to the staging environment.

Profiles store your authentication state so you do not need to log in every time. Each profile contains your access token, refresh token, agent ID, and API URLs.

When you run doover login without --profile, credentials are saved to the default profile. All commands use this profile unless you specify otherwise.

Create profiles for different environments or accounts:

# Production profile
doover login --profile production

# Staging profile
doover login --staging --profile staging

# Customer-specific profile
doover login --profile acme-corp

Use --profile on any command to select which credentials to use:

doover app list --profile production
doover device list --profile staging

Profiles are stored in ~/.doover/config in an INI-style format:

[profile=default]
TOKEN=eyJhbGciOiJSUzI1NiIs...
TOKEN_EXPIRES=1748880000.0
AGENT_ID=12345
BASE_URL=https://api.doover.com
REFRESH_TOKEN=refresh_token_value
BASE_DATA_URL=https://data.doover.com/api
AUTH_SERVER_URL=https://auth.doover.com

Each profile block stores the fields needed to authenticate API requests and refresh expired tokens.

Tokens are refreshed automatically. When a command runs, the CLI checks whether the current access token is about to expire (within 30 seconds) and uses the stored refresh token to obtain a new one. The updated token is saved back to the profile.

You do not need to re-run doover login unless your refresh token itself has expired or been revoked.

The CLI reads profile configuration from ~/.doover/config. There are no environment variables for overriding credentials directly — use named profiles instead.

The CLI uses the same ConfigManager and AuthProfile classes as pydoover's Python API. Profiles created by doover login can be used directly in Python code:

from pydoover.api import DataClient

# Uses the same profile created by `doover login`
client = DataClient(profile="default")

See pydoover Authentication for details on using profiles programmatically.

• Doover CLI Overview -- global options and command groups
• pydoover Authentication -- profile-based auth in Python code