Authentication & Profiles
A profile connects one local name to one HiGantic agent and stores its scoped key outside the configuration file. Use profiles when you work with more than one agent or account.
Where credentials are stored
| Operating system | Default credential store |
|---|---|
| macOS | Keychain |
| Windows | Credential Manager |
| Linux | Secret Service through a validated secret-tool executable |
Profile metadata contains the agent name, agent ID, API origin, scopes, and storage type—but never the API key.
Inspect and select profiles
higantic auth profiles higantic auth use work higantic auth status --profile work
The profile list does not read stored keys. It marks the active profile and reports when a complete environment override is taking precedence.
Command runbook
Sign in again safely
Reauthentication is deliberately two-step so the old API key is revoked instead of abandoned.
Run
higantic auth logout --profile default higantic auth login --profile default
Expected
Revoked the API key and removed profile 'default' from this device. Signed in to My Agent (AGENT_ID) using profile 'default'.
If it fails
If remote revocation cannot complete, the CLI keeps the local credential. Fix connectivity and retry. Use --local-only only when you deliberately accept that the remote key will remain active.
Keep the current profile and add another
higantic auth login --profile work higantic auth use work
Human output and JSON output
Authentication commands print concise English by default. Add --json when a script needs structured output.
higantic auth status --json higantic auth profiles --json higantic auth login --json
JSON login does not prompt for optional skills
Protected-file fallback
Native secure storage is the default. Use protected-file storage only when the native provider is unavailable and you explicitly accept the fallback:
higantic auth login --storage file --allow-protected-file
Commands that later use this profile must also pass --allow-protected-file. POSIX uses a user-owned 0700 directory and atomic 0600 file; Windows encrypts values with current-user DPAPI.