Authentication

The CLI uses a ck_live_… API token, created in the portal on the API tokens page. The token is shown only once.

On a workstation

checkops auth login            # paste the token (read from standard input)
checkops auth status           # organization and token name in use
checkops auth logout           # remove the saved connection

auth login also reads the token from CHECKOPS_TOKEN or from a pipe (echo "$TOKEN" | checkops auth login). --token still works but prints a warning: the token stays visible in the shell history and the process list.

The saved token is only sent to the URL it was saved with. To use another URL (--url or CHECKOPS_URL), pass a token explicitly with CHECKOPS_TOKEN.

The connection is saved in checkops/config.json under $XDG_CONFIG_HOME (otherwise %APPDATA% on Windows, or ~/.config), readable by you only (mode 0600). CHECKOPS_CONFIG sets another path.

In CI

Set two masked, protected variables:

Variable	Value
CHECKOPS_TOKEN	The ck_live_… token
CHECKOPS_URL	https://api.checkops.eu (default)

Variables take precedence over the saved connection. CHECKOPS_APP files the uploaded products under an application.

HTTPS only

The CLI refuses to send a token or a password over plain http://, except to localhost, 127.0.0.1 or ::1. This applies to the CheckOps URL and to the Harbor URL of checkops harbor sync. For a test instance without TLS, add --insecure-http or set CHECKOPS_INSECURE_HTTP=1.