Authentication

Device login, personal access tokens, env vars, and local config.

The CLI talks to https://api.dunsocial.com with a bearer token. You can sign in with a browser once on your machine, or use a personal access token for CI and agents.

Check status

dun auth status
dun auth status --json
dun auth whoami

status shows whether you are authenticated, which workspace is selected, and where config is stored. whoami returns your profile.

Device login (laptop)

dun auth login
dun auth login --no-browser

1. The CLI starts a device-code login.
2. Your browser opens app.dunsocial.com/cli/authorize (or you open the link manually).
3. You approve and pick a workspace if asked.
4. The CLI saves a session token locally.

Sign out and clear local config:

dun auth logout

Personal access tokens (CI and agents)

Create a token in the app under Settings → CLI. It is shown once. Format: dun_pat_….

Then set env vars (preferred over putting the token in a file for CI):

export DUN_TOKEN=dun_pat_…
export DUN_WORKSPACE_ID=your_workspace_id
dun auth status --json

You can also pass a token for one login:

dun auth login --token dun_pat_…

Token scopes

CI defaults usually include workspace + posts schedule/publish + media. Missing scope → exit code 3 (forbidden). PATs cannot create or revoke other tokens, manage billing, or call AI.

Where config lives

Local config file (mode 0600 when possible):

~/.config/dunsocial/config.json

Override the path with DUN_CONFIG.

Env vars (env wins over the file)

Per-command overrides: --token, --workspace, --api-url.

Next step

Pick a workspace with Workspaces, then list Accounts.