Sign in and manage access tokens

The CLI talks to your JW3 account with a personal access token. You can obtain one through a browser sign-in (jw3 auth login) or paste one created in the app.

Browser sign-in (recommended) #

jw3 auth login --browser

A browser window opens on jw3.ai. Sign in, review the requested scopes, and approve. The CLI receives the token over a local callback, verifies it against the server before storing it, and writes it to ~/.config/jw3/credentials.json with 0600 permissions.

By default the token carries:

• mcp:read — read balances, positions, orders, diary and risk posture
• trade:propose — file trade setups into the Diary for you to approve

Add execution explicitly when you need it:

jw3 auth login --browser --scope "mcp:read trade:propose trade:execute"

trade:execute lets the CLI place and close live orders. It is only issued while your account is enabled for autonomous execution — if the kill switch is on or autonomy is set to Propose only, the token is not minted and the CLI says so.

Paste a token #

Create a token in the app under Settings → Harness Access, then either pipe it in:

echo "$JW3_PAT" | jw3 auth login

or let the CLI prompt for it (input is hidden):

jw3 auth login

The token is verified with a handshake before it is saved. An invalid or expired token is rejected and nothing is stored.

Check and remove #

jw3 auth status     # ok — jw3-agent … when the stored token is accepted
jw3 auth logout     # removes the stored token from this machine

status never prints the token itself.

Use a token without storing it #

For CI jobs or one-off commands, pass the token through the environment:

JW3_MCP_PAT="$JW3_PAT" jw3 risk

--pat <token> also works as a one-shot flag, but prefer the environment variable: a flag value ends up in your shell history and in the process list.

Where the token lives #

Treat that directory like an SSH key: keep it out of dotfile sync, Time Machine and repo backups, or at minimum exclude credentials.json. On a new machine, run jw3 auth login again rather than copying the file.

Revoking access #

• One machine: jw3 auth logout.
• Everywhere: Settings → Harness Access lists tokens by prefix, scope and last

use. Revoke the row; the CLI starts receiving unauthorized immediately.

Rotate tokens on a schedule, and immediately if one is ever pasted into a chat, an issue or a screenshot.