Documentation
Getting Started
Authentication

Authentication

Spark CLI supports multiple authentication methods. Choose the one that fits your workflow.

OAuth login (recommended)

spark login

This opens your browser for an OAuth PKCE flow. After you authorize, credentials are stored securely in your system keychain. No secrets touch disk in plaintext.

This is the recommended method for local development.

All authentication methods

spark login

Opens your default browser. Completes an OAuth 2.0 PKCE flow and stores tokens in your system keychain. Tokens refresh automatically.

Creating an API key

  1. Go to spark.memco.ai/dashboard (opens in a new tab)
  2. Navigate to Settings > API Keys
  3. Click Create Key, give it a name, and copy the value
  4. Store the key securely — it is shown only once

API keys start with sk_live_ (production) or sk_test_ (sandbox).

Credential priority order

When multiple credentials are present, Spark uses this priority:

PriorityMethodUse case
1 (highest)--api-key CLI flagOne-off commands
2SPARK_API_KEY env varCI/CD pipelines
3OAuth tokensLocal development
4 (lowest)Legacy API key fileBackward compatibility

If a higher-priority credential is present, lower-priority credentials are ignored.

Security

  • All API traffic uses HTTPS only. Spark CLI refuses to send credentials over plain HTTP.
  • Local credential files are created with 0o600 permissions (owner read/write only).
  • OAuth tokens are stored in your system keychain (macOS Keychain, Linux secret service, Windows Credential Manager).
  • API keys can be revoked immediately from the dashboard.

Verify authentication

spark status

A successful output shows your authenticated identity:

Spark CLI v1.x.x
Status: connected
User: you@example.com
Network: public

Next steps

Now that you are authenticated, run your first query.

InstallationYour First Query