StackieAlpha Preview

Authentication

Stackie uses a browser-based login flow to obtain a long-lived device token (90 days). The CLI and the dashboard share the same session — logging in from either one authenticates both simultaneously. Your token is stored in the OS credential store (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux), so it survives daemon restarts.

Login Flow

1. You run `stackie auth login` (or click Login in the dashboard)
2. Your browser opens to the Stackie authentication page
3. After you approve, the browser redirects back to the local daemon
4. The daemon stores your device token in the OS credential store
5. Both the CLI and dashboard are now authenticated
OS credential storeStackie CloudBrowserstackiedCLI or dashboardUserStart loginRequest local auth URLCreate CSRF stateAuth URL with loopback callbackOpen approval pageUser approves loginRedirect callback with device tokenValidate CSRF statePersist tokenAuthenticated session
Stackie documentation diagram: OS credential store, Stackie Cloud, Browser, stackied, CLI or dashboard. Use horizontal scrolling when the full diagram is wider than the visible frame. Generated from Stackie public documentation source.

CLI Commands

# Log in via browser
stackie auth login

# Check current auth status
stackie auth status

# Log out and clear stored credentials
stackie auth logout

# Mint a temporary anonymous identity (no account required)
stackie auth anonymous

The anonymous identity uses the locked default source order (Ecosystem > Managed > Native) and cannot persist custom preferences across sessions. See Source Classification for how category and location affect which sources Stackie uses.

Dashboard Auth API

The daemon exposes HTTP endpoints for the embedded dashboard UI:

  • POST /api/auth/login — initiates browser-based login flow
  • GET /api/auth/status — returns authentication state, email, and expiry
  • POST /api/auth/logout — revokes the session and clears the credential store
  • GET /api/auth/callback — receives the device token from the browser redirect

Credentials are stored in the OS-native credential store, not in plain-text files. The device token expires after 90 days and must be renewed by logging in again.