Troupe Cloud

Signing in

A person uses Troupe Cloud through an account. This page covers creating one, signing in on the web, signing the troupe command line in with troupe login, and how long each kind of sign-in lasts.

Create an account

Open https://troupe.ali.ve/cloud/sign-up and give a name, an email address and a password of 8 to 128 characters. Troupe mails a verification link that works for one hour. The account can sign in once its address is verified; the sign-in page sends a new link when the first one expired.

An account alone sees nothing. Create an organization, or accept an invitation to one: see Organizations.

For a forgotten password, the sign-in page mails a reset link, which works once. Setting a new password signs every session of the account out and revokes every app it had let in, so troupe login, Troupe Studio and MCP clients must be approved again.

On the web

Sign in at https://troupe.ali.ve/cloud/sign-in with your email and password. The session is a cookie that page scripts cannot read. It lasts 7 days and is renewed while you use it.

The Account page, behind your name in the header, shows:

Confirming changes that grant access

Some changes hand out access or touch signing. They are accepted only from a person who signed in or confirmed their password in the last 15 minutes, never from an API key or an access token:

• creating an API key;
• inviting a member, changing a member's role, removing a member;
• registering or changing a trusted issuer, adding a sign-in connection;
• adding, rotating, deleting a signing credential, or changing who may sign with it;
• changing the organization's placement.

The web app asks for your password when one of these is refused and then repeats the change. A session may give five wrong passwords in 15 minutes, and an account 20 across its sessions; a right password spends nothing. Over the API the refusal is FORBIDDEN with the reason reauth-required, or trust-required for a key or a token; confirm with account.reauthenticate.

From the command line

troupe login signs the CLI in through a page in your browser, so the terminal never sees your password.

bunx troupe login --cloud https://api.troupe.ali.ve

To sign in to Troupe Cloud at https://api.troupe.ali.ve, open this page in a browser:

    https://api.troupe.ali.ve/oauth/device?user_code=HJKL-MNPQ

and check that it shows the code HJKL-MNPQ. Approve only a sign-in you started here.
Waiting for the approval (the code is good for 10 minutes; Ctrl+C stops)...

1. Open the page and sign in if it asks.
2. Check that the page shows the code your terminal printed. The page also says which address asked.
3. Choose an organization, or one project of it, and approve. A sign-in for one project reaches that project only.
4. The terminal continues by itself:

Signed in to Troupe Cloud at https://api.troupe.ali.ve: Acme (org_…), project Shop (prj_…).
The sign-in is kept in the login keychain and lasts at most 7 days; troupe logout ends it.

The sign-in is kept in the macOS login keychain. On a computer without a keychain it is kept in ~/.config/troupe/cloud-login.json, readable by you alone, and the CLI warns each time it writes it. It is never kept in an environment variable. After the first sign-in, troupe login without --cloud signs in to the same cloud again and revokes the sign-in it replaces.

What the sign-in may do is what your role allows, less changing the organization: it never creates keys, changes members or changes signing credentials.

Today the CLI uses the sign-in for troupe whoami only. troupe test runs against a runtime on your own machine or in your CI (see running in CI), and a script that calls the cloud uses an API key.

Check the sign-in

troupe whoami asks the cloud whether the sign-in still works and prints what it is bound to. The scopes line is shortened here.

bunx troupe whoami

Troupe Cloud  https://api.troupe.ali.ve
user          usr_…
org           Acme (org_…)
project       Shop (prj_…)
scopes        org:read projects:read builds:read builds:write … runs:read runs:report
platforms     ios-simulator, android-emulator
kept in       the login keychain

platforms lists what the sign-in could start a device on now. --json prints the same as JSON. The command exits 0 when the sign-in works, 1 when there is none or the cloud refuses it, and 3 when the cloud cannot be reached.

Sign out

bunx troupe logout

Signed out of Troupe Cloud at https://api.troupe.ali.ve: the sign-in is revoked.

troupe logout revokes the sign-in at the cloud and forgets it on this computer. When the cloud cannot be reached it forgets it here and tells you to revoke it under Account, Connected apps.

Connected apps

A connected app is a program you approved to act for you: the CLI, Troupe Studio, or an MCP client. Each approval names one organization, and optionally one project, and holds no more than your role allows now. If you leave the organization, the app's access ends with yours.

Revoking an app under Account stops it at once; a token it already holds ends within 10 minutes. The same is account.grants and account.revokeGrant over the API.

How long a sign-in lasts

When a sign-in ends, sign in again; nothing else is lost.

Signing in through your identity provider

An organization can let its people sign in with its own OpenID Provider. See sign-in connections.

Next

• Organizations and projects
• API keys
• The troupe CLI