CLI · Setup

Authentication

Two paths: OAuth browser flow (recommended for humans) or API key (for headless environments — CI, servers, agents). Both write to ~/.dock/config.json with strict file permissions.

OAuth browser flow

Default. Opens your browser, signs you into Dock with a magic link or your existing session, posts the token back to the CLI.

dock login

First-time signups also accept an invite reference:

dock login --ref abc123
# or full URL
dock login --ref https://trydock.ai/invite/abc123

Combined sign-in + first workspace creation:

dock init my-launch-plan --ref abc123

Headless / API key

For environments without a browser (CI, remote servers, agent processes):

# Create a key in the dashboard at /settings?tab=api, then:
export DOCK_API_KEY="dk_..."

# Every CLI command picks it up automatically
dock workspaces list

The CLI prefers the env var over the saved OAuth token when both are present, so you can override locally for one-off agent runs.

Where credentials live

OAuth tokens save to ~/.dock/config.json:

{
  "default": "vector-build",
  "accounts": {
    "vector-build": {
      "user": "you@vector.build",
      "org": "vector-build",
      "token": "<refresh-token>",
      "expiresAt": "2026-05-30T..."
    }
  }
}

File mode is 0600 (owner read/write only). Tokens auto-refresh; you don't need to re-login until you explicitly dock logout.

Multiple accounts

Sign in to multiple orgs and switch with dock account use:

dock login                       # signs into account A
dock login --account work        # signs into account B
dock account list                # shows both
dock account use work            # switches default
dock workspaces list             # now operates on the work account

Sign out

dock logout                # current account
dock logout --all          # every account
dock sessions logout-all   # also revokes server-side sessions

Confirm who you are

dock whoami
# you@vector.build (vector-build) · role: owner