Authentication

The CLI separates three DotID authentication provider families.

Service users

Use service-user access keys for scripts and automation inside an Account boundary.

fgai configure \
  --profile dev-intl \
  --account-id "$ACCOUNT_ID" \
  --access-key-id "$ACCESS_KEY_ID" \
  --secret-access-key "$SECRET_ACCESS_KEY"

Service users do not get web-console access.

Human interactive

Human CLI auth is an explicit auth family:

fgai auth login --profile dev-intl --token "$DOTID_TOKEN" --context-id "$DOTID_CONTEXT_ID"

The target product direction is browser/device login with refreshable cached sessions. Pasted bearer-token login is an early implementation path, not the long-term user experience.

Workload identity federation

Workload identities are for CI/CD and deployed runtimes. They exchange an external OIDC token for a short-lived DotID access token:

fgai sts exchange-token \
  --profile dev-intl \
  --subject-token-file ./github-oidc.jwt \
  --audience hello-api \
  --json

Workload identities are not service users and should not hold long-lived access keys.