Glassity Auth

Glassity authentication

When to use

• The user says "log in to Glassity", "connect Glassity", "auth with Glassity"
• The user asks "who am I on Glassity", "which tenant am I using", "show my scopes"
• The user wants to clear credentials ("log out of Glassity")
• Any Glassity skill reports not authenticated (exit code 3)

Binary check

Run command -v glassity before the first CLI call. If it is missing, stop and tell the user to install it with brew install glassity/tap/glassity or from . No account yet? Sign up at app.glassity.cloud.

Signing in

glassity auth login

This prints a URL and a short code. The user opens the URL in a browser on any device, signs in, and the credential is written to the OS keychain. Nothing has to launch a browser on this machine, so it works over SSH, in dev containers, and under WSL.

Show the user the printed URL and code verbatim, then wait — the command completes once they finish in the browser.

Checking the active tenant

glassity --output=json auth whoami

Returns the tenant name, account_prefix_id, AWS account ids, scopes, and token expiry. Always repeat the tenant and AWS account back to the user so a wrong-tenant session is caught before anything is read or written.

Headless and CI

A CI runner has no browser and often no keychain. Mint a Personal Access Token in the Glassity web app and pass it through the environment:

export GLASSITY_TOKEN=
glassity --output=json opp list

GLASSITY_TOKEN takes precedence over the keychain, so nothing is written to disk on the runner.

Where a keychain does exist and the user wants a token stored persistently instead of an OAuth session, pipe the secret so it never reaches argv:

echo "$GLASSITY_PAT" | glassity auth set-token --token=-

The binary validates the token against the API before persisting it, then writes the resolved tenant defaults into the profile so later commands do not need --account.

Signing out

glassity auth logout

Deletes the stored credential and clears the tenant defaults. The profile itself is kept, so a later login does not need the base URL re-entered.

What not to do

• Never print a token back to the user or echo it into your output.
• Never pass a token on argv — pipe it with --token=-, or use the

GLASSITY_TOKEN environment variable.

• If whoami reports the credential is invalid or expired, say so and run

glassity auth login again. Do not silently retry with a different token.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: glassity
• Source: glassity/agent-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.