login

Authenticate against the SPLENT marketplace and store the token, the way docker login does.

Usage
Options
What it does
Where the token is stored
Environment
Example
When it refuses
See also

Usage

splent login [--registry URL] [--token-stdin] [--name LABEL]

Options

Option	Description
`--registry URL`	Marketplace to log in to. Defaults to `SPLENT_MARKETPLACE_URL`, then `https://marketplace.splent.io`.
`--token-stdin`	Read an existing token from stdin instead of prompting. For CI.
`--name LABEL`	Label for the new token on the server. Defaults to `splent-cli@<hostname>`. Ignored with `--token-stdin`, since that token already has one.

There is deliberately no --token option. A secret passed in argv lands in the shell history and in the process table of every user on the machine, so CI pipes it in instead.

echo "$SPLENT_MARKETPLACE_TOKEN" | splent login --token-stdin

What it does

Prompts for e-mail and password and exchanges them for an API token (POST /api/v1/auth/tokens, requested with a 90 day lifetime).
Validates the token with whoami before anything is written, so a dead credential is never persisted.
Stores it per registry, together with the identity, scopes, token name and expiry it just read back.

Nothing is stored if step 2 fails, and the command says so.

Where the token is stored

<WORKING_DIR>/.splent/credentials.json      (mode 0600, in a 0700 directory)

The CLI normally runs inside splent_cli_container, whose home directory is part of the image and is recreated empty on every rebuild. The workspace is the only path that is reliably mounted and survives make setup-rebuild, so that is where the store lives. It is not .splent_cache/ (a regenerable cache that commands are free to wipe) and not the workspace .env.

Precedence	Path
1	`SPLENT_CREDENTIALS`, when set, overrides the path completely
2	`<WORKING_DIR>/.splent/credentials.json`, when a workspace is visible
3	`~/.splent/credentials.json`, for a CLI installed from PyPI outside a workspace

One entry per registry URL, so a production marketplace and a local one coexist without overwriting each other. The token is never printed, never logged and never passed on a command line.

Environment

Variable	Effect
`SPLENT_MARKETPLACE_URL`	Default registry when `--registry` is not given.
`SPLENT_MARKETPLACE_TOKEN`	A token supplied by the environment. It wins over the stored one, which is what CI expects. `login` warns when it is set, because the token it just stored will not be the one in use.
`SPLENT_CREDENTIALS`	Absolute path of the credential store.

The registry URL is normalised before it is used as a store key, so https://marketplace.splent.io and https://marketplace.splent.io/ are one entry and not two. A URL carrying a user or password is refused.

From inside splent_cli_container a local marketplace answers at http://splent_marketplace_app_web:5000; from the host it is http://localhost:5818. Those are different registries as far as the store is concerned, which is exactly why it is keyed by URL.

Example

splent login --registry http://localhost:5818

  Logging in to http://localhost:5818

  E-mail: dev@example.com
  Password:

  Logged in to http://localhost:5818
  Identity   dev@example.com
  Scopes     spl:publish
  Token      splent-cli@laptop
  Expires    2026-10-26T10:00:00+00:00 (in 90 days)
  Stored in  /workspace/.splent/credentials.json (mode 0600)

When it refuses

Every failure mode has one wording, and each says what to do next.

Situation	What you get
Wrong e-mail or password	The marketplace rejected that e-mail and password.
Account not activated yet	Accounts are created inactive until an administrator activates them. Nothing is wrong with your password.
Token expired or revoked	Run `splent login` to get a new one.
Missing scope	Your token is valid but not allowed to do that.
HTTP 429	The marketplace is rate limiting this client, reported with its `Retry-After` when the server sends one. It is never reported as a credential problem.
Marketplace unreachable	The URL is quoted back, with the container and host URLs above.
Publishing switched off	Reported apart from a server error, because nothing is broken and retrying will not help.