Appearance
Authentication
Console APIs require the HTTP header:
http
access-token: <JWT>(Defined as Constants.ACCESS_TOKEN in sp-tr-api.)
Non-interactive login (agents + CI)
Email verification flow
Request code (human step or separate automation):
httpGET /api/login/getVerificationCode/{userName}Exchange code for token:
bashsp auth login --email user@corp.com --code 123456 --jsonREST:
POST /api/login/verifywith body{ "userName", "verifyCode", ... }CLI writes token to active profile in
~/.config/softprobe/config.yamlunless--no-save.
CI / agent hosts
Set a long-lived token from your secret store:
bash
export SP_TOKEN="eyJ..."
sp app list --jsonNever commit tokens to git. Rotate on leak.
Token refresh
bash
sp auth refresh --user user@corp.com --jsonREST: GET /api/login/refresh/{userName}
Guest login
If enabled on the server:
bash
sp auth login --guest --jsonREST: POST /api/login/loginAsGuest
OAuth
OAuth flows are browser-based. Agents should use pre-provisioned SP_TOKEN rather than driving OAuth interactively.
Document for humans: GET /api/login/oauthInfo/{oauthType}, POST /api/login/oauthLogin.
Who am I
bash
sp auth whoami --jsonDecodes JWT userName or calls profile endpoint when implemented.
Errors
| Situation | Exit code |
|---|---|
Missing token with --json | 3 (AUTH_REQUIRED) |
| Expired or invalid token | 1 (API_ERROR) |