Accounts and sessions

Signing in

patcharc login runs the device flow described in Sharing and ArcLinks. The approval page at patcharc.dev/device offers GitHub and Google; a verified email is required by both. The first sign-in creates a user and a personal account with an owner membership.

Where credentials live

// ~/.patcharc/credentials.json  (mode 0600; directory ~/.patcharc is 0700)
{
  "api_url": "https://api.patcharc.dev",
  "refresh_token": "…",
  "access_token": "…",
  "account_id": "acc_…",
  "user_id": "usr_…",
  "expires_at": "2026-11-20T10:14:03Z"
}

The file is deliberately outside the repository so that sharing a repo can never leak it. The CLI authenticates API calls with the refresh token and rotates it on every use; the previous token is revoked server-side.

API base URL precedence: PATCHARC_CLI_API_URL environment variable, then api_url in the credentials file, then https://api.patcharc.dev.

Token lifetimes

Logging out

$ patcharc logout

logout deletes ~/.patcharc/credentials.json. In 0.2.0 the device id is not returned by the token endpoint, so logout cannot call the server-side device revoke; the refresh token simply stops being used and expires. To revoke a device explicitly, call DELETE /v1/auth/devices/<device_id> with a valid token.

Your account

$ TOKEN=$(jq -r .refresh_token ~/.patcharc/credentials.json)
$ curl -s https://api.patcharc.dev/v1/me -H "Authorization: Bearer $TOKEN"
$ curl -s https://api.patcharc.dev/v1/accounts -H "Authorization: Bearer $TOKEN"

patcharc account prints a "not enabled" message in 0.2.0. There is no invitation, membership, or role management yet; every account has exactly one member, its owner. The X-PatchArc-Account header selects an account when a user belongs to more than one, which cannot happen through the product today.

Deleting your data

• Locally: delete .patcharc/ in the repository and ~/.patcharc/.
• In the cloud: DELETE /v1/capsules/<id> removes a capsule, its derived review, and its shares. Account deletion is an operator action in 0.2.0; email hello@patcharc.dev.

Rate limits

Authentication endpoints accept 30 requests per minute per identity; the rest of the API accepts 300. A 429 carries a retry-after header.