Agent index (llms.txt) — fetch this first, then the page it names.
orama auth
Sign in, approve a login from another machine, and manage sessions. Every command and flag below comes from the orama command tree, so it matches the binary.
Global conventions are on the CLI overview.
orama auth
Authentication management
orama auth
Manage authentication with the Orama network. Signing in is a wallet signature over a gateway challenge. On a machine with RootWallet running it is signed here; on one without — a server reached over SSH, a container, CI — 'orama auth login' prints a code and 'orama auth approve' on a machine that does have a wallet approves it. What is stored is a session, not a key: an access token lasting 15 minutes, renewed transparently from a refresh token.
Subcommands: approve, list, login, logout, sessions, status, switch, whoami
orama auth approve
Approve a login waiting on another machine
orama auth approve <code> [flags]
Approve the code 'orama auth login' printed on a machine with no wallet on it. It costs the same wallet signature signing in does, which is what makes the code on its own worthless. --deny refuses instead, so the waiting machine stops rather than polling until the code expires.
| Flag | Default | Description |
|---|---|---|
--deny | false | Refuse the login instead of approving it |
--namespace | — | Namespace to sign in to (defaults to the one this machine is signed in to) |
orama auth list
List all stored credentials
orama auth list
orama auth login
Sign in, here or from another machine
orama auth login [flags]
Sign in, here or from another machine. Run at a terminal with no --namespace and a credential already saved, it first offers the saved ones to switch to. With --namespace, or without a terminal (a script, CI), it signs in straight away. --device-key enrolls that Ed25519 key with this sign-in. The file is a private JWK and stays on this machine; the gateway receives the public half and the device's signature over the same message the wallet signs.
| Flag | Default | Description |
|---|---|---|
--device-key | — | Ed25519 private JWK file to enroll with this sign-in |
--namespace | — | Namespace name |
orama auth logout
End this session on the gateway and clear it here
orama auth logout [flags]
| Flag | Default | Description |
|---|---|---|
--all | false | End every session for this wallet, not only this machine's |
orama auth sessions
Which machines are signed in as this wallet
orama auth sessions
Subcommands: revoke
orama auth sessions revoke
End one session, or every one
orama auth sessions revoke [id] [flags]
End a session listed by 'orama auth sessions'. Ending a session stops it minting new access tokens, and refuses the access tokens it already minted — and closes the sockets they hold open — within ten seconds. A session issued before sessions carried an id cannot be named that way: its access tokens work until they expire, at most 15 minutes, and the command says so.
| Flag | Default | Description |
|---|---|---|
--all | false | End every session for this wallet |
orama auth status
Show what is stored on this machine, without asking the gateway
orama auth status
orama auth switch
Switch between stored credentials
orama auth switch
orama auth whoami
Ask the gateway who this credential is and what it may do
orama auth whoami