archgate login

Log in to the Archgate platform. Logging in is what grants access to the editor plugins.

archgate login

Starts an OAuth 2.0 Device Authorization Grant (RFC 8628) against the Archgate platform. The CLI opens your browser at a URL that already carries the one-time code, and copies that code to your clipboard in case the page asks for it. Both the URL and the code are printed as well, so you can finish on another machine or paste them yourself.

Neither step is required. In CI, over SSH, or on a native Linux host with no display server (WSL reaches the Windows desktop) the CLI skips both and just prints them. Once authorized, the CLI hands the resulting tokens to git via git credential approve, so where they end up depends on the credential helper you have configured. A helper backed by your OS credential manager (macOS Keychain, Windows Credential Manager, Linux libsecret) keeps them encrypted; git’s built-in store helper writes them to ~/.git-credentials in plain text. Check yours with git config --global credential.helper.

Access tokens are short-lived. The CLI keeps a refresh token alongside them and renews the access token automatically, so signing in once is normally enough. If the refresh token itself expires or is revoked, the CLI reports that the session has expired, and archgate login re-establishes it. A token issued before this flow existed keeps working only until you sign in to the platform; from then on the platform session alone decides.

Signing in also registers archgate credential as a git credential helper for plugins.archgate.dev, which is what lets git clone of a plugin repository authenticate without prompting. See archgate credential.

Credentials are required to install editor plugins via archgate init --install-plugin. The CLI itself (check, init, etc.) works without login.

Plugin beta

Editor plugins are currently in beta. Run archgate login to sign in.

Subcommands

Subcommand	Description
archgate login	Authenticate (skips if already logged in)
archgate login status	Show current authentication status
archgate login logout	Remove stored credentials
archgate login refresh	Sign in again, replacing stored tokens

Examples

Log in for the first time:

archgate login

By signing in, you agree to the Archgate Terms of Service:
https://archgate.dev/terms-of-service

Opened https://auth.archgate.dev/device?user_code=HZML-HXLB in your browser.
If it asks for a code, enter: HZML-HXLB (copied to your clipboard)

Waiting for authorization...
info: Authenticated as yourname. Plugin access is now available.
Run `archgate init` to set up a project with the archgate plugin.

If the project already has .archgate/adrs/, the final line reads:

Run `archgate check` to validate your project against its ADRs.

Troubleshooting

TLS/corporate proxy errors

If archgate login fails with a TLS certificate error (common behind corporate proxies), point your runtime at your organization’s CA bundle using the NODE_EXTRA_CA_CERTS environment variable.

On macOS/Linux:

export NODE_EXTRA_CA_CERTS=/path/to/your-corporate-ca.pem
archgate login

On Windows (PowerShell):

$env:NODE_EXTRA_CA_CERTS = "C:\path\to\your-corporate-ca.pem"
archgate login

On Windows (cmd):

set NODE_EXTRA_CA_CERTS=C:\path\to\your-corporate-ca.pem
archgate login

On Windows (Git Bash):

export NODE_EXTRA_CA_CERTS=/c/path/to/your-corporate-ca.pem
archgate login

Ask your IT team for the correct certificate path if you are unsure.

Check login status:

archgate login status

Logged in as yourname.

Log out:

archgate login logout

Re-authenticate:

archgate login refresh