Authenticate the Fencer CLI
Overview
Section titled “Overview”The CLI must authenticate before it can list organizations or call organization-scoped APIs. Humans use a browser OAuth flow. Automation uses a service-account token.
Prerequisites
Section titled “Prerequisites”- The CLI is installed.
- For interactive login: a browser on the same machine.
- For CI: a Fencer service-account token (
fcr_…).
Interactive login
Section titled “Interactive login”fencer loginThe CLI registers a public OAuth client, opens your browser, and waits up to 5 minutes for you to
approve access. If the browser does not open, copy the URL the CLI prints. Tokens are saved to
~/.config/fencer/tokens.json (or $XDG_CONFIG_HOME/fencer/tokens.json), and the CLI refreshes the
access token on its own when it expires. The CLI connects to https://app.fencer.dev.
Log out, revoke the stored token, and delete the local copy:
fencer logoutService accounts (CI)
Section titled “Service accounts (CI)”An organization admin (or anyone whose role can create API keys) creates a service account under Settings > Service Accounts with Create service account: give it a Name, pick its Role and Token expiry, and copy the token, which is shown only once. The token acts with the account’s role and can only reach its own organization (see API Access). Then either:
fencer login --token fcr_...or set FENCER_TOKEN in the environment. When FENCER_TOKEN is set, the CLI uses it instead of a
saved login, and sends it only to the configured API origin.
export FENCER_TOKEN=fcr_...export FENCER_ORG=your-org-slugfencer vuln listfencer login also saves FENCER_TOKEN when it is set, instead of opening the browser. For a
service-account token, fencer logout only deletes the local copy; revoke the token by revoking the
service account under Settings > Service Accounts.
Do not commit tokens. Prefer the secret store of your CI system.