Authentication and configuration

Examples use goodvision. After a project installation, use npx --no-install goodvision. See quick start for installation and first configuration.

Choose the identity required by each operation. User identity accesses authorized user context; application service identity only calls operations that permit it.

Authentication commands

Goal	Command
Create configuration	goodvision config init --help
Inspect credential configuration	goodvision auth status
Check credential acquisition	goodvision auth check
Inspect application and environment	goodvision context

Get the current API address, application ID and authorized user Token from your application. Keep the Token in a private credential file owned by your user; never commit it. Configuration stores the file reference:

goodvision config init --file ./goodvision.json \
  --api-base "$GOODVISION_API_BASE" \
  --docs-origin "$GOODVISION_DEVELOPER_DOCS_ORIGIN" \
  --application "$GOODVISION_APPLICATION_ID" \
  --environment sandbox --token-file ./current-token
goodvision context --config ./goodvision.json
goodvision auth status --config ./goodvision.json
goodvision auth check --config ./goodvision.json

auth status shows credential configuration offline, without reading credentials or evaluating expiry. auth check proves only that credentials can be read or obtained. For application service access, replace the Token file option with --issuer "$GOODVISION_IDENTITY_ISSUER" --client-id "$GOODVISION_SERVICE_CLIENT_ID" --secret-file ./client-secret --scope openplatform.api.invoke, requesting only contract-defined Scopes. Service identity cannot substitute for user consent.

One file may define multiple profiles; select one explicitly with --profile. Application environments are sandbox or production. Relative credential paths resolve from the configuration directory. Expired identity, wrong application, revoked access and dependency failures never cause automatic context changes or browser Cookie reuse. Interactive terminal OAuth login is outside the first release's authentication contract.

Authorization and recovery

Read user authorization for the existing web consent flow. auth status does not validate a Token; auth check does not enumerate effective permissions. Inspect operation Scopes with schema and follow each API rejection. Terminal auth login/logout and per-domain interactive consent are not implemented.

Removing a Profile only removes local configuration. It does not sign out or revoke a grant. Revoke grants through the existing authorization flow, then restore the same authorized context and explicitly resume the original task.