Command Reference

brainbase token

Issue and manage long-lived personal access tokens (PATs) for CI and unattended scripts. Tokens are prefixed bbpat_…. See Authentication for how they're resolved.

brainbase token create

Issue a long-lived CLI key. Set the result as BRAINBASE_TOKEN to authenticate without brainbase login. It is also saved in ~/.brainbase/token.json with the minting account id. If the signed-in account changes while creation is in progress, the CLI shows the new token but does not save it under the other account.

bash

brainbase token create --scope publish

Flag	Description
`--name <label>`	Token label (alias `-n`).
`--scopes <list>`	Comma-separated scopes. Allowed: `read`, `publish`, `admin`. Default `read,publish`. `--scope` is accepted as an alias.

brainbase token list

Show your active tokens. This works with a login session or a user-level PAT.

bash

brainbase token list

brainbase token rename <id>

Change a token's label. Nothing else about the token changes — it keeps its key, scopes and expiry. Without --name the command prompts for the new label, and with no terminal it exits non-zero naming the flag.

bash

brainbase token rename <token-id> --name ci-deploy

Flag	Description
`--name <label>`	The new label (alias `-n`). At most 128 characters, and not a label another active token already uses — labels are how `token list` tells keys apart.

Revoked and expired tokens cannot be renamed, and the command says which of the two applies. --scope and --scopes are refused rather than ignored: a token's scopes are fixed when it is minted, so mint a replacement with token create --scopes <list> to change them.

brainbase token revoke <id>

Revoke a token by id. When ~/.brainbase/token.json holds the key you revoked, the command clears it too and says so, since a dead key there would only produce failed requests. A local token that is a different key is left alone. If the server reports the token already gone while it still looked live a moment earlier, the local copy is kept, because that key may still work.

bash

brainbase token revoke <token-id>

Flag	Description
`--yes`, `-y`	Confirm the revoke without a prompt.

--yes is required in CI and pipes

Revoking is irreversible, so with no interactive terminal the command refuses and names the flag instead of going ahead. Add --yes to any unattended token revoke — see Destructive commands.

brainbase token clear

Forget the locally stored PAT without revoking it server-side (use revoke <id> to revoke).

bash

brainbase token clear