Authentication

Install the CLI first. The Dev Environment Setup guide covers npm i -g @phystack/cli and the first phy login.

Log in

phy login runs the browser device flow and stores a personal access token in the operating system keychain. When the keychain is not available, it stores the token in a file.

On a machine with no browser, print the URL and code instead:

phy login --no-browser

phy whoami prints the user that credential belongs to. phy auth status prints how the credential was resolved. phy auth print-access-token prints only the bearer token. It exits 3 when no bearer token is available.

phy logout removes the credential from the keychain or file. When phy login stored the session id, logout also revokes that session on the server. A token stored with phy auth set-token has no session id, so logout removes the local copy and tells you to revoke it with phy token list and phy token delete <id>.

Choose a tenant

phy tenant set accepts a tenant id or a slug and saves it as the default for the active context:

phy tenant set <id-or-slug>

--tenant <id-or-slug> overrides that default for one command.

Tokens for CI

Create a personal access token and export it as PHY_TOKEN. The secret is printed once.

phy token create ci-pipeline --ttl-days 30
export PHY_TOKEN=<token>

Omit --ttl-days and the token lasts 90 days. The maximum is 365. phy token list prints metadata, not the secret. phy token delete <id> revokes a token.

phy auth set-token --name <name> --token <token> stores a bearer token under a name. Point a context at it with phy config set-context <name> --auth <name>.

Contexts

A context remembers which API, tenant, and login a command uses. The first phy login creates a context named default, pointed at https://api.phystack.com. Later commands use that context. You do not create one yourself for a normal login.

Create a second context when you switch between tenants or logins. The name is yours. phy config set-context only saves it. On a machine that already has default, it does not switch. Run phy config use-context <name>, then phy login, then phy tenant set <id-or-slug>.

phy config set-context client-a
phy config use-context client-a
phy login
phy tenant set <id-or-slug>

phy tenant set looks the tenant up and saves it on the active context.

phy config view prints the resolved config. phy config get-contexts lists contexts. phy config current-context prints the active name.

phy config set-context <name> --tenant <id-or-slug> writes that value onto the context without looking it up. --replace clears every field you do not pass, and the base URL falls back to production.