Scripto docs
View as Markdown

CLI auth (OTP)

The two public endpoints behind scripto auth — POST /api/cli/login-request and POST /api/cli/login-complete — that provision a CLI key over email OTP.

The CLI command equivalents are scripto auth login-request and scripto auth login-complete. Prefer those — they store the minted key as a profile for you. See Auth.

These two routes are public (no key required). Together they implement open signup over email OTP: an unknown email is registered when the code is verified.

POST /api/cli/login-request

Send a sign-in OTP to an email.

POST https://scripto.codika.io/api/cli/login-request

Request

{ "email": "you@example.com" }

Response (200)

{ "success": true, "data": { "ok": true, "email": "you@example.com" } }

Errors

HTTPcodeCause
400invalid-argumentMissing or malformed email.
500internalOTP send failed — retry shortly.

curl

curl -sS -X POST https://scripto.codika.io/api/cli/login-request \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com"}'

POST /api/cli/login-complete

Verify the OTP and mint a long-lived scripto_ key. The raw key is returned once.

POST https://scripto.codika.io/api/cli/login-complete

Request

{ "email": "you@example.com", "otp": "123456", "name": "scripto-cli" }

name is optional (defaults to scripto-cli) and names the minted key.

Response (200)

{
  "success": true,
  "data": {
    "apiKey": "scripto_…",
    "keyId": "key_…",
    "userId": "user_…",
    "email": "you@example.com"
  }
}

Errors

HTTPcodeCausenextAction
400invalid-argumentMissing email.—
400invalid-argumentMissing otp.request a new code with: scripto auth login-request
400invalid-argumentWrong or expired code.request a new code with: scripto auth login-request
500internalSigned in but key mint failed — retry.—

curl

curl -sS -X POST https://scripto.codika.io/api/cli/login-complete \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","otp":"123456"}'

The OTP send is awaited server-side; the raw key in the login-complete response is the only time you’ll see it. Store it immediately (the CLI does this for you).

Next