Skip to content
Fito

Log in from the terminal

You work cases in your terminal, and the commands that record anything need to know who you are. /fito-login connects your pi session to the Fito account you already have.

This page assumes you have an account. If you do not, make one first — Create an account and sign in.

Before you begin

Section titled “Before you begin”
  • A pi session with the Fito package installed. It loads in any folder.
  • A browser on the same machine. The login hands tokens back over localhost, so a session on a remote box with no browser cannot complete it.
  • A Fito server you can reach. By default the TUI uses the hosted Fito, at https://fito.codes.

Log in

Section titled “Log in”

  1. In your pi session, run:

    /fito-login

  2. Your browser opens on the Fito login page. If it does not open by itself, the terminal prints the URL to visit:

    Opening your browser to log in to Fito…
    If it does not open, visit:
      https://fito.codes/auth/login?return_to=tui&port=54321&handoff_secret=…

  3. Sign in in the browser, with either email and password or Continue with GitHub. Both work; they reach the same account.

  4. The browser confirms and tells you to go back:

    You’re logged in Return to your terminal — the Fito CLI now has your credentials. You can close this tab.

  5. The terminal prints the success line:

    ✓ Logged in. Credentials saved to ~/.fito/credentials (mode 0600).

Confirm it worked: run any command that needs an account, such as /fito-submit, and it no longer asks you to log in.

How the handoff works

Section titled “How the handoff works”

/fito-login starts a small web server on your own machine, on a port picked at random, and tells the login page where to find it. When you finish signing in, the page posts the tokens straight to that local server.

Three things keep that narrow:

  • The server accepts one request, from one origin — the web origin the TUI was configured with.
  • The URL carries a single-use secret, freshly generated for this login. The browser echoes it back, and a request without the matching secret is rejected before its body is even read.
  • Nothing travels outside your machine. The tokens go from your browser to localhost and no further.

Where your credentials live

Section titled “Where your credentials live”

Tokens are written to ~/.fito/credentials, with file mode 0600 and directory mode 0700 — readable by you and nobody else on the machine.

Your password is never written there. The file holds token metadata only, so a leaked copy expires on its own rather than handing over your account forever.

Refresh and log out

Section titled “Refresh and log out”

Your access token is short-lived. Most of the time you never notice, because commands refresh it for you.

To refresh by hand:

/fito-auth-refresh

It exchanges the stored refresh token for a fresh pair and rewrites the credentials file. If you are not logged in, it says so and exits non-zero — run /fito-login instead.

To log out:

/fito-logout

It revokes the refresh token on the server and deletes ~/.fito/credentials. It is safe to run when you are already logged out; it simply succeeds.

Point the TUI at a different server

Section titled “Point the TUI at a different server”

One environment variable, FITO_URL, moves both halves. When it is unset, the TUI uses the hosted Fito, at https://fito.codes. Set it to the address of another Fito, and the TUI opens the login page at that address and calls the backend at the same address plus /api.

A local install of Fito serves both halves from http://localhost:8000. To use one, set:

Terminal window
export FITO_URL=http://localhost:8000

What’s next

Section titled “What’s next”