> ## Documentation Index
> Fetch the complete documentation index at: https://docs.murmur.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# murmur auth

> Run the Claude OAuth flow from the murmur CLI and print or persist the resulting access and refresh tokens so agent VMs can use them.

Opens your browser for Claude authentication, completes the OAuth flow, and prints the resulting tokens to stdout. The `upload` subcommand stores the tokens as tenant [secrets](/concepts/secrets) instead.

<Note>
  The labeled Claude OAuth credential rotation set (multiple subscriptions, round-robined across spawns) is managed by [`murmur setup auth`](/cli/setup#murmur-setup-auth), not this command.
</Note>

## Synopsis

```bash theme={null}
murmur auth
murmur auth upload [flags]
```

## Subcommands

| Subcommand | Description                                                                                                          |
| ---------- | -------------------------------------------------------------------------------------------------------------------- |
| *(none)*   | Run the OAuth flow and print tokens to stdout as `export` statements.                                                |
| `upload`   | Run the OAuth flow and store both tokens as tenant [secrets](/concepts/secrets) in the [catalog](/catalog/overview). |

## Arguments

### `murmur auth upload`

| Name            | Type   | Required | Description                                                                                                                             |
| --------------- | ------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| `--name-prefix` | string | no       | Prefix for the stored secret names. Default: `CLAUDE_`. Produces secrets named `<prefix>OAUTH_TOKEN` and `<prefix>OAUTH_REFRESH_TOKEN`. |

## How the flow works

1. [`murmur auth`](/cli/auth) starts a local HTTP server on a random port.
2. Your browser opens the Claude authorization page.
3. After you approve, Claude redirects to the local server with an authorization code.
4. The CLI exchanges the code for an access token and refresh token.

The flow times out after 5 minutes if you do not complete authorization.

## Examples

### Print tokens to stdout

```bash theme={null}
murmur auth
```

```
Opening browser for Claude authentication...
If it doesn't open, visit:
https://claude.ai/oauth/authorize?response_type=code&client_id=...

export CLAUDE_CODE_OAUTH_TOKEN=eyJ...
export CLAUDE_CODE_OAUTH_REFRESH_TOKEN=dGhp...
# Expires in: 31536000 seconds | Scopes: user:profile user:inference user:file_upload
```

Pipe into `eval` to set the tokens in your current shell:

```bash theme={null}
eval "$(murmur auth)"
```

### Upload tokens as tenant secrets

```bash theme={null}
murmur auth upload
```

```
Authenticated (expires in 31536000 seconds, scopes: user:profile user:inference user:file_upload)
Set secret "CLAUDE_OAUTH_TOKEN"
Set secret "CLAUDE_OAUTH_REFRESH_TOKEN"

Secrets stored. Select them in your service profile's Codex Credentials section.
```

### Upload with a custom prefix

```bash theme={null}
murmur auth upload --name-prefix MY_
```

```
Authenticated (expires in 31536000 seconds, scopes: user:profile user:inference user:file_upload)
Set secret "MY_OAUTH_TOKEN"
Set secret "MY_OAUTH_REFRESH_TOKEN"

Secrets stored. Select them in your service profile's Codex Credentials section.
```

## Errors

| Code                                   | Meaning                                                             | What to do                                                                                    |
| -------------------------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
| `oauth state mismatch`                 | The state parameter in the callback did not match.                  | Re-run [`murmur auth`](/cli/auth). This can happen if multiple auth flows run concurrently.   |
| `timed out waiting for authentication` | The 5-minute timeout elapsed before you completed the browser flow. | Re-run [`murmur auth`](/cli/auth) and complete the browser authorization promptly.            |
| `oauth flow returned empty tokens`     | Claude returned an incomplete token response.                       | Re-run [`murmur auth`](/cli/auth). If the problem persists, check your Claude account status. |
| `UNAUTHENTICATED`                      | Identity token is missing or expired (upload subcommand).           | Run [`murmur setup`](/cli/setup) to configure your [profile](/concepts/secrets).              |

## Related

* [Profiles and secrets](/concepts/secrets) — how credentials are stored and delivered to agents
* [`murmur setup`](/cli/setup) — full developer profile configuration (includes Claude credentials)
* [Catalog: secret](/catalog/secret) — the secret resource that `upload` writes to