shift-cli token

Create, inspect, and revoke delegated local test grants for coding agents.

Usage

shift-cli token <subcommand> [arguments] [flags]

Commands

Create a delegated grant

shift-cli token create \
  --label local-e2e \
  --ttl 30m \
  --session <session-id> \
  --capability api \
  --capability browser \
  --capability stage.google.proxy \
  --json

Key flags:

• --label <label> human-readable grant label
• --ttl <duration> TTL such as 15m, 1h, or 1d
• --session <id> bind the grant to a Stage session
• --app <sid> bind the grant to a published Stage app
• --capability <name> repeatable capability declaration
• --provider-mode <mode> optional metadata for test runs

The raw sat_... token is only shown once. Export it as SHIFT_AGENT_TOKEN for local SDK or Playwright runs.

List grants

shift-cli token list --json

Returns the active delegated grants for the current authenticated user, including target session/app, expiry, and capabilities.

Revoke a grant

shift-cli token revoke <grant-id> --json

You can revoke by grantId or by label.

Typical Flow

shift-cli token create --label local-e2e --ttl 30m --session <session-id> --json
export SHIFT_AGENT_TOKEN=sat_...
bun test
shift-cli token list --json
shift-cli token revoke <grant-id> --json

Notes

• Delegated grants are narrower than the human CLI session.
• Browser bootstrapping is handled by shift-cli test bootstrap, not by passing the raw token in a URL.
• When SHIFT_AGENT_TOKEN is set, both shift-cli and @the-shift/sdk prefer it over SHIFT_API_KEY.