Authentication

Authentication

Selldone CLI signs in with your Selldone account through an OAuth2 authorization-code flow in your browser, supports two-factor authentication (2FA) and stores the resulting access token on your computer. This page describes the flow, the requests involved and how to sign out.

When the CLI signs you in

• When you choose Login in the interactive menu.
• When you deploy and no token is saved.
• When a saved token fails the 2FA status check. The CLI clears it and starts the browser login again.

The flow

Step	Request	Input	Output used by the CLI
1. Browser login	GET https://selldone.com/developers/login?state=<state>	state: a random, URL-safe 64-character value generated by the CLI	Redirect to http://localhost:3777/callback?code=<authorization_code>
2. Token exchange	POST https://selldone.com/oauth/token	JSON: { "grant_type": "authorization_code", "client_id": 6663, "redirect_uri": "http://localhost:3777/callback", "code": "<authorization_code>", "code_verifier": "<state>" }	{ "access_token": "..." } (other fields are ignored)
3. 2FA status	GET https://api.selldone.com/security/2fa/check	Authorization: Bearer <access_token>	JSON containing has_2fa and, when authentication is complete, user
4. 2FA verification (when required)	POST https://api.selldone.com/auth/2fa	Bearer token plus JSON: { "code": "<6-digit-code>" }	{ "success": true, "user": { ... } } on success

What you see in the terminal:

▶  Starting OAuth2 Authentication...
▶  Listening for OAuth callback on http://localhost:3777
▶  Checking 2FA status...
✅  2FA is enabled.
Enter the 6-digit 2FA code: 123456
✅  2FA verification successful.
✅  Authentication successful.

After the redirect, the browser tab shows Authentication successful, you can close this window.

Details

• The CLI starts a small local web server on port 3777 and opens your default browser. The port is fixed; keep it free while signing in.
• If the 2FA status response already contains user, login completes immediately. Otherwise the CLI asks for a six-digit numeric code. Codes that are not exactly six digits are rejected.
• The access token is saved only after the 2FA step succeeds.
• The signed-in user's premium flag decides whether deployments are allowed; see Deployment Workflow.

Where the token is stored

File	Mode
~/.selldone-dev/.persist	Normal mode
~/.selldone-dev/.persist-debug	Debug mode

The ~/.selldone-dev folder is created with owner-only permissions (0700) and the token file is written with 0600. Treat the file like a password: do not commit it or share it.

Sign out

selldone
# ? Please select an action:  Logout

Logout empties the token file. The next deployment starts the browser login again.

Next steps

• Deployment Workflow
• Layout Deployment API
• Access tokens in the developer panel