Skip to main content

Authentication

JJHub supports two login methods and API token authentication for programmatic access.

GitHub OAuth (Default)

The default and most common way to authenticate:
jjhub auth login
This opens your browser to authorize the JJHub GitHub OAuth app. Your GitHub profile (username, email, avatar) is automatically imported.

Sign in with Key

Sign in with Key authentication is available via the JJHub web interface. It signs a message with your wallet - a secure passwordless login method. Sign in with Key is not available via the CLI. Use GitHub OAuth or an API token for CLI access.

Credential Storage

After login, your credentials are stored in your OS keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service). For CI environments or systems without a keychain, use the --insecure-storage flag to store the token in a plain-text config file:
jjhub auth login --insecure-storage
You can also specify a hostname if you’re connecting to a non-default JJHub instance:
jjhub auth login --hostname jjhub.example.com

Check Authentication Status

jjhub auth status
jjhub auth token
Useful for piping into other tools or debugging.

Log Out

jjhub auth logout

API Tokens

For CI/CD pipelines and programmatic access, use personal access tokens. Tokens are created via the JJHub API or web interface (not via the CLI). Tokens are prefixed with jjhub_ and stored as SHA-256 hashes on the server - the full token is shown only at creation time.

Token Scopes

ScopeDescription
repoFull repository access (read + write)
repo:readRead repository contents
repo:writePush to repositories
userFull user access (read + write)
user:readRead user profile
user:writeUpdate user profile
adminFull administrative access
Write scopes imply read access (e.g., repo:write includes repo:read).

Environment Variables

export JJHUB_TOKEN=jjhub_your_token_here
The CLI reads JJHUB_TOKEN automatically. No config file needed for CI. Alternatively, pipe a token directly:
echo "jjhub_your_token_here" | jjhub auth login --with-token