Mogplex auth

The Mogplex CLI authenticates in-app. There is no mogplex login status subcommand; the cockpit's login screen is the only flow. Use this skill to advise the user — you cannot inspect or change credentials from outside the cockpit.

Resolution order

The cockpit picks credentials in a fixed order:

1. Provider env var in the current shell. If set, it wins — no matter what is stored on disk.

1. Stored credentials in ~/.mogplex/auth.json (mode 0600).
2. No credentials → the cockpit's in-app login screen appears.

Env vars beat stored creds. Always.

Establish auth

Preferred: account-backed browser login

Tell the user to launch the cockpit and pick Sign in with Mogplex on the login screen, or type /login from the composer in an open cockpit.

mogplex
# pick "Sign in with Mogplex" on the login screen

A browser flow opens; the cockpit listens on a local callback and stores the token in ~/.mogplex/auth.json. The user does the click-through; you do not drive the browser.

Account-backed login unlocks synced model catalog, remote MCP server definitions, and hosted model access.

Alternative: store a provider key in-app

In the login screen (or via /login in the composer), the user can pick Use a provider API key and paste a key. Stored in ~/.mogplex/auth.json with mode 0600.

Supported providers: Anthropic, OpenAI, Google, Groq, Mistral, DeepSeek, xAI, Cohere, Vercel AI Gateway.

Alternative: provider env var

For CI or ephemeral shells:

export OPENAI_API_KEY=sk-...
mogplex

Do not write keys into shell rc files on the user's behalf. Suggest it; let them do it.

Sanity-check env vars (advisory)

You can sanity-check which env vars are set without printing values:

env | grep -E '^(MOGPLEX|ANTHROPIC|OPENAI|GOOGLE_GENERATIVE_AI|GROQ|MISTRAL|DEEPSEEK|XAI|COHERE|VERCEL)_' | sed 's/=.*/=<redacted>/'

Never echo a raw key.

Troubleshooting

Sign out

/logout    # type in the composer

Or, before attaching to a run:

mogplex --attach run_abc123 --logout

Three things to remember:

• Env vars still win on the next session.
• Restart for certainty. The current process may still hold the old adapter.
• Logout clears hosted state. Synced model catalog and remote MCP definitions vanish locally.

Always confirm with the user before suggesting /logout.

Hard rules

• Never read or modify ~/.mogplex/auth.json directly.
• Never echo a raw key, even from env. Redact.
• Never write a key into a shell config file without explicit user consent.
• Never advise the user to put a key into a JSON config for another agent host when the in-app login would give them an account-backed token instead.

See also

• [using-mogplex-cli](../using-mogplex-cli/SKILL.md)
• Authentication guide
• Configuration and Flags