Skip to main content

VentilatePro documentation

Authentication

Choose the smallest token preset for a person or agent, validate it from the CLI, and understand how credentials, scopes, project permissions, and revocation work.

VentilatePro CLI v0.7.0

Default login

ventilatepro auth login

Windows fallback

ventilatepro auth login --token-prompt-visible Get-Clipboard | ventilatepro auth login --token-stdin

Agent check

ventilatepro mcp doctor

Token lifecycle

  1. 1. Create the token in the web UI

    Open VentilatePro Account Settings and create a CLI token. The raw token is shown once, so copy it immediately.

  2. 2. Log in from your machine ventilatepro auth login ventilatepro auth login --token-prompt-visible Get-Clipboard | ventilatepro auth login --token-stdin
  3. 3. Verify the token

    The CLI validates credentials through the authenticated identity endpoint before saving them.

    ventilatepro auth whoami

Token presets

Create a separate token for each workstation or agent host, and choose the smallest preset that supports the intended workflow.

Preset Best for Access model
notes-onlyField and coordination notesProject discovery plus note read/create/update.
assistant-read-calcRead-oriented toolsEntities, systems, calculations, and design-day reads/runs.
editorHuman terminal editingRead/calc plus entity, import, schedule, control, and note writes.
agent-editorLocal MCP agentsGuarded full-workflow access including QC, notifications, exports, and team lookup.

Auth commands

Status

ventilatepro auth status ventilatepro auth status --json

Identity

ventilatepro auth whoami

Logout

ventilatepro auth logout

Local storage

  • Base URL and non-secret settings are stored in the OS config directory.
  • Tokens are stored in the OS keyring when a supported backend is available.
  • If keyring is unavailable, the token falls back to plaintext in config.json. Protect that directory with OS permissions and exclude it from shared folders, backups available to others, and source control.
  • `auth logout` deletes only local credentials; it does not revoke the server token.

Windows terminals

  • The default login prompt hides input, so pasted characters do not appear on screen.
  • Prefer the hidden prompt or --token-stdin. The fallback --token-prompt-visible displays the secret on screen; do not use it in a recorded or shared terminal. Avoid --token in interactive shells because command history and process inspection can expose it.
  • For copy-paste workflows, pipe the token from stdin with --token-stdin.
  • PowerShell example: Get-Clipboard | ventilatepro auth login --token-stdin

Security model

  • CLI tokens authenticate as bearer tokens in the `Authorization` header.
  • Raw tokens are only shown at creation time in the web UI.
  • Do not place raw tokens in source control, MCP JSON, agent prompts, screenshots, or logs.
  • Tokens never bypass project membership, web-app permissions, validation, or MCP confirmation guardrails.
  • Revocation is managed server-side in VentilatePro Account Settings.
  • Use a new token if an old one is lost or copied to the wrong machine.
Open account settings