Authentication
Two paths: OAuth browser flow (recommended for humans) or API key (for headless environments — CI, servers, agents). Both write to ~/.dock/config.json with strict file permissions.
OAuth browser flow
Default. Opens your browser, signs you into Dock with a magic link or your existing session, posts the token back to the CLI.
dock loginFirst-time signups also accept an invite reference:
dock login --ref abc123
# or full URL
dock login --ref https://trydock.ai/invite/abc123Combined sign-in + first workspace creation:
dock init my-launch-plan --ref abc123Headless / API key
For environments without a browser (CI, remote servers, agent processes):
# Create a key in the dashboard at /settings?tab=api, then:
export DOCK_API_KEY="dk_..."
# Every CLI command picks it up automatically
dock workspaces listThe CLI prefers the env var over the saved OAuth token when both are present, so you can override locally for one-off agent runs.
Where credentials live
OAuth tokens save to ~/.dock/config.json:
{
"default": "vector-build",
"accounts": {
"vector-build": {
"user": "you@vector.build",
"org": "vector-build",
"token": "<refresh-token>",
"expiresAt": "2026-05-30T..."
}
}
}File mode is 0600 (owner read/write only). Tokens auto-refresh; you don't need to re-login until you explicitly dock logout.
Multiple accounts
Sign in to multiple orgs and switch with dock account use:
dock login # signs into account A
dock login --account work # signs into account B
dock account list # shows both
dock account use work # switches default
dock workspaces list # now operates on the work accountSign out
dock logout # current account
dock logout --all # every account
dock sessions logout-all # also revokes server-side sessionsConfirm who you are
dock whoami
# you@vector.build (vector-build) · role: ownerRelated
- Install — get the CLI on your machine first.
- First steps — what to do once you're signed in.
- API authentication — full auth model (API keys, OAuth, signed agents).