# Headless authentication

Agent runtimes should authenticate with a token instead of the browser flow:

- `archivst auth login --token <JWT> --expiry <ISO8601> --service None` — store an access token directly (alias `login-token`).
- `archivst auth listen --port <port> --timeout 180` — start the localhost listener on a remote host and complete a browser login elsewhere; the token lands when the redirect arrives.
- `archivst auth logout` — delete the saved JWT when the session ends.

Example:

```console
archivst auth login --token eyJ0eXAi... --expiry 2026-12-31T00:00:00Z
```

[Back to Agentic Usage](/agentic)