Get startedCLIAPIMCPWebDesktopAgentsSupportBillingChangelog
CLI · Setup

Authentication

Two paths: OAuth browser flow (recommended for humans) or API key (for headless environments, CI, servers, agents). Both write to ~/.dock/config.json with strict file permissions.

OAuth browser flow

Default. Opens your browser, signs you into Dock with a magic link or your existing session, posts the token back to the CLI.

dock login

First-time signups also accept an invite reference:

dock login --ref abc123
# or full URL
dock login --ref https://trydock.ai/invite/abc123

Combined sign-in + first workspace creation:

dock init my-launch-plan --ref abc123

Headless / API key

For environments without a browser (CI, remote servers, agent processes):

# Create a key in the dashboard at /settings?tab=api, then:
export DOCK_API_KEY="dk_..."

# Every CLI command picks it up automatically
dock workspaces list

The CLI honours the env var as of v0.9.1 (2026-05-16) and prefers it over the saved OAuth token when both are present, so you can override locally for one-off agent runs. The full agent-bootstrap reference (including a pure-REST fallback for boxes without Node) lives at /docs/agent-prompt.

Where credentials live

OAuth tokens save to ~/.dock/config.json:

{
  "default": "vector-build",
  "accounts": {
    "vector-build": {
      "user": "you@vector.build",
      "org": "vector-build",
      "token": "<refresh-token>",
      "expiresAt": "2026-05-30T..."
    }
  }
}

File mode is 0600 (owner read/write only). Tokens auto-refresh; you don't need to re-login until you explicitly dock logout.

Multiple accounts

Sign in to multiple orgs and switch with dock account use:

dock login                       # signs into account A
dock login --account work        # signs into account B
dock account list                # shows both
dock account use work            # switches default
dock workspaces list             # now operates on the work account

Sign out

dock logout                # current account
dock logout --all          # every account
dock sessions logout-all   # also revokes server-side sessions

Confirm who you are

dock whoami
# you@vector.build (vector-build) · role: owner

Frequently asked questions

How do I sign into Dock from the CLI?
`dock login` opens a browser for magic-link sign-in, then writes a session token to `~/.dock/config.json`. Or `dock login --token dk_…` to skip the browser if you already have an API key.
How do I use a Dock dk_ key with the CLI?
Two options. Set `DOCK_API_KEY=dk_...` env var (CLI reads it automatically). Or run `dock login --token dk_...` to write it to `~/.dock/config.json`. Env var wins over config file when both are set.
How do I sign out of the Dock CLI?
`dock logout` clears `~/.dock/config.json`. Doesn't revoke the underlying token (it's still usable elsewhere); to revoke entirely, use `dock key revoke <id>` or Settings → API keys → Revoke.
Where does the Dock CLI store my credentials?
`~/.dock/config.json` (mode 0600, owner-readable only). Contains the API token, default org, and CLI preferences. Safe to commit to dotfiles only if you encrypt; otherwise keep gitignored.
How do I switch between Dock orgs in the CLI?
`dock org switch <slug>` updates the default org for subsequent commands. Or pass `--org <slug>` per-command to override without changing the default. Useful for users who belong to multiple orgs.
How do I check who I'm signed in as on the Dock CLI?
`dock whoami` prints your email + active org + role (owner / admin / member). Useful for confirming auth before a write op or for debugging multi-account setups.
Can I use the Dock CLI in CI without a browser?
Yes. Set `DOCK_API_KEY` as a CI secret; the CLI uses it automatically. No `dock login` needed, no browser flow. Same approach for any headless environment (cron, Lambda, container).
How do I rotate the token the Dock CLI uses?
Mint a new key in Settings → API keys (or via `dock key new`). Update `DOCK_API_KEY` (env or `~/.dock/config.json`). Then revoke the old: `dock key revoke <old-id>`. Or use `dock key rotate <id>` for atomic mint+revoke.
How do I scope the Dock CLI to a single workspace?
Mint a workspace-scoped `dk_` key (Settings → API keys → pick the workspace). Use that as `DOCK_API_KEY`. Every CLI command then operates against just that workspace; calls outside its scope return 403.
Why does the Dock CLI ask me to login again after rotating my key?
Because the old token in `~/.dock/config.json` is now revoked; the CLI's first call returns 401 and prompts re-auth. Update the config with the new token (`dock login --token dk_...`) to skip re-auth.
Updated