OverviewInstallFirst commandAuthenticateInject secretsTerminal UIExport dotenvGenerate TOTPAutomateCommandsTroubleshooting
GETTING STARTEDGuide

Authenticate the CLI

The CLI uses a Vault personal access token. Browser login is the default path; --token, --stdin, and MOVITERA_TOKEN cover CI, SSH, and containers.

Browser login

bash
$ movitera login
✓ Logged in as token movitera-cli @ workstation (expires 2026-08-21).
Stored in macOS Keychain.
Default team set to Acme IT.

The server mints the PAT after approval. The CLI stores the token in the system keyring and tries to save the approved team as the default.

Headless login

bash
$ movitera login --token mvt_pat_xxx
✓ Token saved to file fallback.

$ pass show movitera/pat | movitera login --stdin
✓ Token saved to file fallback.

PATs start with mvt_pat_

The CLI rejects empty tokens and tokens without the mvt_pat_ prefix before saving anything.

Token through environment

bash
$ export MOVITERA_TOKEN=mvt_pat_xxx
$ movitera secrets pull --team <team-id> -c myapp-prod

MOVITERA_TOKEN overrides the stored keyring token. Use it in CI runners and temporary sessions.

Logout

bash
$ movitera logout
✓ Stored token removed.

Next

AutomateTroubleshooting