Authenticate

The CLI accepts any integrator.io bearer token: an admin-created service token, or a personal access token (PAT) you create yourself. A PAT inherits your own user permissions. Create either in Resources → API tokens.

The CLI reads the token from, in priority order:

1. --token <value> CLI flag (one-off override)
2. CELIGO_API_TOKEN environment variable
3. The active profile in ~/.celigo/config.json
4. Error, no token available

The base URL follows the same priority via --base-url, CELIGO_BASE_URL, or the profile's base_url. Default: https://api.integrator.io.

One account

export CELIGO_API_TOKEN="<paste>"
celigo workspace-users list --format table

Works on macOS, Linux, and Windows. In PowerShell: $env:CELIGO_API_TOKEN = "...".

With a config file

If you'd rather not re-export the env var every shell session:

⚠️ This stores your API token in plaintext on disk. ~/.celigo/config.json holds the raw token; keep its 0600 permissions and never commit it to version control.

celigo config set api_token "<paste>"
celigo config show

This writes ~/.celigo/config.json with mode 0600 on Unix (owner read/write only; Windows uses NTFS ACLs scoped to the current user).

Multiple accounts: profiles

One binary, many accounts — typical setup is one profile per region or per environment.

celigo profile add us --api-token "$US_TOKEN" --api-base-url https://api.integrator.io
celigo profile add eu --api-token "$EU_TOKEN" --api-base-url https://api.eu.integrator.io
celigo profile add au --api-token "$AU_TOKEN" --api-base-url https://api.au.integrator.io
celigo profile add ca --api-token "$CA_TOKEN" --api-base-url https://api.ca.integrator.io

celigo profile list
celigo profile use us               # set default
celigo --profile eu flows list      # one-off override

Full details in Profiles & regions.

Verify authentication

Resolve the active profile's token to the user it authenticates as with profile whoami (calls GET /v1/tokenInfo):

celigo profile whoami

Any authenticated read also works as a smoke test:

celigo workspace-users list --format json

A successful response confirms the token is valid. A 401 Unauthorized means the token is missing, expired, revoked, or pointed at the wrong region. A token authenticates only against its own region's base URL.

To see your stored config without making an API call:

celigo config show          # active profile
celigo profile show us      # a specific profile

Tokens are redacted in all output — first 4 and last 4 characters visible, the rest masked.

Security

• Tokens are redacted in all CLI output.
• ~/.celigo/config.json is written with 0600 permissions. Don't chmod it wider.
• --verbose redacts the Authorization header in its HTTP traces.
• Never commit ~/.celigo/config.json or any script with --token <value> hard-coded.
• For CI, pass a short-lived token via the CI secret store and set CELIGO_API_TOKEN at job time.

Rotating

# Update the active profile's token in place
celigo config set api_token "<new>"
celigo profile whoami            # verify

# Then revoke the old token in the UI under Resources → API tokens.

For profile-based setups, there is no profile edit — either config set against the active profile, or profile delete + profile add to re-enter credentials cleanly.