stella auth - Command Guide

Audience: operators and automation owners who authenticate the Stella Ops CLI against Authority and manage the tokens that every other command relies on.

The stella auth command group handles Authority-backed authentication and token operations: acquiring and caching access tokens, inspecting the active session, minting and delegating service-account tokens, and exporting or verifying revocation bundles. Most other stella commands assume a valid cached token from auth login.

Commands

Acquire and cache an access token using the configured Authority credentials.

stella auth login
stella auth login --force
STELLAOPS_AUTHORITY_CLIENT_ID=stellaops-cli-automation \
STELLAOPS_AUTHORITY_CLIENT_SECRET=stellaops-local-cli-automation-secret \
stella auth login --json

Notes:

--force ignores cached tokens and forces re-authentication.
Credential sources are configuration-driven (profile/env). This command does not accept raw tokens on the command line.
When no Authority client ID is configured, the CLI defaults to the seeded human client stellaops-cli.
In a fresh interactive local/dev shell, auth login prompts for username/password and uses the current password-grant bootstrap path on that human client.
For non-interactive automation, configure a confidential client such as the seeded local/dev stellaops-cli-automation.

auth status / whoami / logout

stella auth status
stella auth whoami
stella auth logout

Behavior:

status reports whether a cached token exists and whether it is still valid.
whoami prints cached token claims (subject, scopes, expiry) for diagnostics.
logout removes cached tokens for the active credentials.

auth revoke export / verify

Export or verify Authority revocation bundles.

stella auth revoke export --output ./revocation-export
stella auth revoke verify --bundle ./revocation-bundle.json --signature ./revocation-bundle.json.jws --key ./authority.pub.pem

auth token mint

Mint a service account token (requires appropriate Authority permissions).

stella auth token mint --service-account concelier-jobs \
  --scope concelier.jobs.trigger --scope advisory:ingest --scope advisory:read \
  --tenant tenant-default \
  --reason "scheduled ingestion" \
  --raw

Flags:

--service-account / -s (required): service account identifier.
--scope (repeatable): scopes to include in the minted token.
--expires-in (optional): expiry in seconds.
--tenant (optional): tenant context.
--reason (optional): audit reason.
--raw: output only the token value (automation-friendly).

auth token delegate

Delegate your current token to another principal.

stella auth token delegate --to user@example.org \
  --scope advisory:read \
  --tenant tenant-default \
  --reason "support session" \
  --raw

Flags:

--to (required): principal identifier to delegate to.
--scope (repeatable): delegated scopes (must be a subset of the current token).
--expires-in (optional): expiry in seconds (defaults to remaining token lifetime).
--tenant (optional): tenant context.
--reason (required): audit reason.
--raw: output only the token value (automation-friendly).

Offline notes

auth login and token mint/delegate require connectivity to Authority.
auth revoke verify, status, whoami, and logout can operate using local cached state.

CLI command reference — complete catalog of stella commands
stella db — operational commands that require an authenticated session