Conceptslatest · 0.1.2
Signing in
How horizech login works, and where your session lives.
Sign-in uses OAuth2 with PKCE, the same way the Horizech Workspace desktop app signs in. Your browser signs in to your Horizech Account at horizech.com, then returns control to the CLI on 127.0.0.1. The CLI never sees your password.
Where the session is stored
| System | Store |
|---|---|
| macOS | Keychain, service horizech |
| Windows | Credential Manager, service horizech |
| Linux | The secret service (libsecret) |
| None available | ~/.config/horizech/credentials.json (%APPDATA%\horizech on Windows), readable only by you |
Staying signed in
- Access tokens last about an hour. The CLI refreshes them a couple of minutes before they expire, so a command never fails halfway through with an expired session.
- If the identity provider can't be reached, the session is kept. If it refuses the refresh, the session is removed and you are asked to sign in again.
- The CLI never prints a token.
The OAuth2 client
This version signs in as the public client 077b0577-9fe3-4a7e-9163-c5fb458dc900, with scopes openid profile email roles is_root offline_access. A client id is not a secret; it ships in every copy of the CLI.