auth commands

For setup steps across every tool, see Set up Connection Profiles.

auth

Manage named connection profiles. Profiles store your credentials in the OS keychain when available. If the keychain is unavailable, --insecure-storage opts into an insecure local file fallback at ~/.atomize/.

Azure DevOps is currently the only Connection Profile type: for generate, validate, fields list, queries list, and template metadata. AI-assisted template generation (template create --ai) does not use a Connection Profile; it authenticates through a separate Copilot Session (see Auth Guide - AI Drafting: Copilot Session).

auth add

Add a new Azure DevOps connection profile.

atomize auth add [name] [options]

Option	Description
--org-url <url>	Organization URL (e.g. https://dev.azure.com/myorg)
--project <name>	Project name
--team <name>	Team name
--default	Set this profile as the default
--pat-stdin	Read the PAT from stdin instead of ATOMIZE_PAT (preferred in CI)
--insecure-storage	Allow storing the token in an insecure local file fallback when the OS keychain is unavailable

atomize auth add work-ado
# Prompts for org URL, project, team, and PAT

Non-interactive (CI/CD):

echo "$AZURE_DEVOPS_PAT" | atomize auth add work-ado \
  --org-url https://dev.azure.com/myorg \
  --project MyProject \
  --team MyTeam \
  --default \
  --pat-stdin

Profile names may contain letters, numbers, hyphens, and underscores.

---

auth list

List all saved connection profiles.

atomize auth list [options]
atomize auth ls   # alias

Option	Description
--json	Print results as JSON to stdout; progress messages go to stderr

Output:

  work-ado (Azure DevOps · default)
    URL:      https://dev.azure.com/myorg
    Project:  MyProject
    Team:     MyTeam
    Token:    [keychain]
    Created:  1/3/2026, 10:00:00 AM

---

auth use

Set a profile as the default Azure DevOps profile.

atomize auth use [name]

atomize auth use work-ado   # sets default profile
atomize auth use            # pick interactively

---

auth remove

Remove a saved connection profile.

atomize auth remove [name] [options]
atomize auth rm [name]   # alias

Option	Description
--confirm	Remove without asking for confirmation
--new-default <name>	Profile to make the default when the removed profile was the default

---

auth test

Test connectivity for a profile by executing a WIQL query against your project to verify credentials and project access.

atomize auth test [name]

atomize auth test work-ado   # test a specific profile
atomize auth test            # pick interactively

---

auth rotate

Replace the stored PAT for a profile (e.g. after a token expires).

atomize auth rotate [name] [options]

Option	Description
--pat-stdin	Read the new PAT from stdin instead of prompting interactively
--insecure-storage	Allow insecure local file fallback when the OS keychain is unavailable

echo "$NEW_PAT" | atomize auth rotate work-ado --pat-stdin