Oko
Oko/Docs

Command reference

oko login

Request an email code, verify a code read in your own inbox, or run one explicitly selected autonomous sign-in method. No refused method is replaced by another.

Invocation#

Command
oko login [--email ADDRESS] (--request-code | --code CODE | --method mailbox|database-owner) [--mailbox-organization ID] [--json]

Inputs and options#

  • --email names the Wisent account. When omitted, the existing session must name it; a missing or unreadable session reports its actual cause.
  • --request-code sends an OTP without reading the mailbox or replacing the current session. --code verifies the code you supply. These operations do not require a Skrzynka mailbox or database-owner credentials.
  • --method mailbox requires --mailbox-organization, the explicit organization holding the mailbox in Skrzynka. Every mailbox read uses that scope. --method database-owner explicitly uses the configured owner's grant. Exactly one operation is required; neither autonomous method accepts --code, and mailbox organization is refused for other methods.

Output and state effect#

  • A request returns email and requestedAt; this confirms the provider accepted the request, not that delivery or sign-in succeeded. Verification returns email, userId, expiresAt and session after saving under the shared refresh lock.
  • The database is resolved through the existing Stado integration. The selected autonomous method uses its existing Skarbiec-backed credentials; request/verification does not borrow the owner's authority after a refusal.
  • OKO_SESSION_PATH selects an independent session profile; its database.json resolution cache lives beside the session file. The default profile remains ~/.oko/auth-session.json. A failed cache read or removal reports its path and cause.
  • In Oko Desktop, Model access → Wisent session for oko has the same method picker, mailbox organization field, Request code and Sign in actions. Request-only keeps the current session unchanged. The selected operation's actual failure stays visible.

Refusals and safe exits#

  • No operation, conflicting operations, an unknown method, a value flag without its value, missing code, missing mailbox organization or missing address is a usage refusal before sign-in. A provider rejection, unreadable mailbox, missing grant or failed session save retains its operation and concrete cause.
  • A mailbox refusal ends that attempt. Choose another method explicitly in a new invocation; Oko never silently tries database-owner authorization.

CLI reference#