Commands

Verbs

Verb	Action
`token` (default)	Print the access token to stdout; used as Claude Code’s `apiKeyHelper`.
`login`	Force a new PKCE login (re-auth, switch accounts, pre-flight for offline work). A browser opens.
`whoami`	Print the current user, tenant slug, scopes, and token expiry.
`logout`	Revoke the refresh token (Cognito `AdminUserGlobalSignOut`) and clear the keychain.

Flags

--env prod|dev (default prod)
--client-id <id>
--auth-domain <domain>

Building


cd tools/agent-runner-auth
 
# Local build
go build -o agent-runner-auth .
 
# With OAuth defaults baked in
go build \
  -ldflags "-X main.prodClientID=<prod-client-id> -X main.devClientID=<dev-client-id>" \
  -o agent-runner-auth .
 
# Tests
go test ./...

Cross-compile for distribution (run with a build matrix, not in plain CI):


GOOS=darwin  GOARCH=arm64 go build -o dist/agent-runner-auth-darwin-arm64 .
GOOS=darwin  GOARCH=amd64 go build -o dist/agent-runner-auth-darwin-amd64 .
GOOS=linux   GOARCH=amd64 go build -o dist/agent-runner-auth-linux-amd64 .
GOOS=windows GOARCH=amd64 go build -o dist/agent-runner-auth-windows-amd64.exe .

See Concepts → Terminology for the project’s vocabulary rules — tenant, grant, key, slug, caller, and “client” (never “customer”).