murmur auth

Opens your browser for Claude authentication, completes the OAuth flow, and prints the resulting tokens to stdout. The upload subcommand stores the tokens as tenant secrets instead. murmur auth does not sign you in to murmur. To sign in, run murmur login. To bootstrap a repo and developer profile, run murmur setup.

Manage Claude and Codex subscriptions with murmur setup subscription. It supports optional labels and interactive provider selection.

Synopsis

murmur auth
murmur auth upload [flags]

Subcommands

Subcommand	Description
(none)	Run the OAuth flow and print tokens to stdout as `export` statements.
`upload`	Run the OAuth flow and store both tokens as tenant secrets in the catalog.

Arguments

`murmur auth upload`

Name	Type	Required	Description
`--name-prefix`	string	no	Prefix for the stored secret names. Default: `CLAUDE_`. Produces secrets named `<prefix>OAUTH_TOKEN` and `<prefix>OAUTH_REFRESH_TOKEN`.

How the flow works

murmur auth starts a local HTTP server on a random loopback port.
Your browser opens the Claude authorization page.
After you approve, Claude redirects to the local server with an authorization code.
The CLI exchanges the code for an access token and refresh token.

The flow times out after 5 minutes if you do not complete authorization.

Examples

Print tokens to stdout

murmur auth

Opening browser for Claude authentication...
If it doesn't open, visit:
https://claude.ai/oauth/authorize?response_type=code&client_id=...

export CLAUDE_CODE_OAUTH_TOKEN=eyJ...
export CLAUDE_CODE_OAUTH_REFRESH_TOKEN=dGhp...
# Expires in: 31536000 seconds | Scopes: user:profile user:inference user:file_upload

The browser prompt lines are also written to stdout, so do not eval the whole output. To set the tokens in your current shell, keep only the export lines:

eval "$(murmur auth | grep '^export ')"

The grep filter also hides the fallback authorization URL. Run murmur auth without the pipe if your browser does not open.

Upload tokens as tenant secrets

murmur auth upload

Authenticated (expires in 31536000 seconds, scopes: user:profile user:inference user:file_upload)
Set secret "CLAUDE_OAUTH_TOKEN"
Set secret "CLAUDE_OAUTH_REFRESH_TOKEN"

Secrets stored. Select them in your service profile's Claude credentials section.

Upload with a custom prefix

murmur auth upload --name-prefix MY_

Authenticated (expires in 31536000 seconds, scopes: user:profile user:inference user:file_upload)
Set secret "MY_OAUTH_TOKEN"
Set secret "MY_OAUTH_REFRESH_TOKEN"

Secrets stored. Select them in your service profile's Claude credentials section.

Errors

Code	Meaning	What to do
`oauth state mismatch`	The state parameter in the callback did not match.	Re-run `murmur auth`. This can happen if multiple auth flows run concurrently.
`timed out waiting for authentication`	The 5-minute timeout elapsed before you completed the browser flow.	Re-run `murmur auth` and complete the browser authorization promptly.
`oauth error: <error>`	You denied the authorization, or Claude returned an error to the callback.	Re-run `murmur auth` and approve the request.
`token exchange failed (<status>): <body>`	Claude rejected the authorization code exchange.	Re-run `murmur auth`.
`oauth flow returned empty tokens (access=<bool>, refresh=<bool>)`	Claude returned an incomplete token response (upload subcommand).	Re-run `murmur auth`. If the problem persists, check your Claude account status.
`unknown 'murmur auth' subcommand "<name>" — the labeled credential set is managed by 'murmur setup subscription'`	The subcommand is not `upload`.	Use `murmur auth` or `murmur auth upload`. Manage subscriptions with `murmur setup subscription`.
`UNAUTHENTICATED`	Identity token is missing or expired (upload subcommand).	Run `murmur login`, or check your `murmur.local.yaml` configuration.

Profiles and secrets: how credentials are stored and delivered to agents
murmur setup: full developer profile configuration (includes Claude credentials)
Catalog: secret: the secret resource that upload writes to

Getting Started

Core Concepts

Guides

Synopsis

Subcommands

Arguments

`murmur auth upload`

How the flow works

Examples

Print tokens to stdout

Upload tokens as tenant secrets

Upload with a custom prefix

Errors

​Synopsis

​Subcommands

​Arguments

​murmur auth upload

​How the flow works

​Examples

​Print tokens to stdout

​Upload tokens as tenant secrets

​Upload with a custom prefix

​Errors

​Related

Synopsis

Subcommands

Arguments

`murmur auth upload`

How the flow works

Examples

Print tokens to stdout

Upload tokens as tenant secrets

Upload with a custom prefix

Errors

Related