authentication
Google identity is optional. Local-only services start without gcloud.
devctl auth status
devctl auth login
devctl auth refresh
devctl auth logoutlogin runs gcloud auth application-default login. devctl prefers Application Default Credentials and does not invent a proprietary login protocol.
--json works on status and refresh. Refresh output includes identity and expires_at, never the token.
The TUI Identity screen and devctl auth status always show the source:
flowchart TB
cfg{"google.project_id in config?"}
cfg -->|yes| useCfg["Use configuration"]
cfg -->|no| env{"GOOGLE_CLOUD_PROJECT<br/>or GCLOUD_PROJECT?"}
env -->|yes| useEnv["Use environment"]
env -->|no| gcloud{"gcloud config set?"}
gcloud -->|yes| useGcloud["Use gcloud config"]
gcloud -->|no| adc["ADC project"]
User identity and service identity are separate. A service or proxy route must declare which one to use. A user ADC token is never substituted for a service-account route.
devctl auth refresh uses auth.refresh_threshold_seconds (default 300). Tokens live in the OS keychain when available, otherwise ~/.devctl/credentials with mode 0600. Metadata files never include the raw access token. Google minting is capped at 10 refreshes per identity and audience per minute; a still-unexpired cached token is reused when the cap is hit. Doctor warns when the rate for one pair is high.
The TUI identity tab (a) and the web console Identity page (#/identity, header ADC chip) show user, project, source, ADC, gcloud (TUI), configured SAs, impersonation availability, and whether IAP routes exist. Login stays devctl auth login / TUI /auth login. The credentials tab lists store backend and entry names only.
IAP routes with a service-account identity impersonate that account and then mint an IAP ID token. See Impersonation and IAP.