Authentication

Signing in

neo auth login runs a device-authorization flow (RFC 8628). It prints a URL and a short code, opens a browser best-effort, and polls until you approve — there is no local callback server and no port to keep free, so it works the same over SSH and inside a container.

On success it stores the credential (see Configuration) and registers neo as git’s credential helper for that host, so a plain git clone / git fetch / git push over HTTPS authenticates without a second login. The helper is appended to credential.https://<host>.helper, a multi-valued key: any helper you already had for that host keeps working, and re-running login does not append a duplicate.

neo auth status reports the stored login and whether the helper is registered. neo auth git-credential is the helper itself — git invokes it, you do not.

Personal access tokens

neo token create mints a scoped, expiring PAT for CI, a script, or another machine. Tokens default to full authority when no --scope is given; --scope narrows what the token may do, and --repo / --org narrow which resources it may do it to. --expires is in days.

Attenuation is not advisory — a repo-locked token is refused on every other repo, and a token without a write scope cannot push. Prefer the narrowest grant that works, and use neo token rotate to replace a secret in place rather than creating a second token and forgetting the first.

neo token list and neo token revoke manage what exists.

Machine credentials

NEOSOURCE_TOKEN in the environment outranks the stored login entirely, which is the path CI and one-shot scripts should use; pair it with NEOSOURCE_USER when there is no stored login to borrow a handle from.

For git and jj over SSH, neo auth login lets you select or generate a machine-local key before the browser flow. Approval binds that key to the issued login credential; no separate account-wide key API call is needed. neo ssh setup repeats the browser approval flow for an already logged-in account. neo ssh list shows keys discovered on this machine, and neo ssh test probes the configured key directly.