Authentication

Evaris has two authentication paths. They are used at different stages of the publishing workflow, and mixing them up is the most common reason a first publish fails.

The handoff

A brand-new user cannot publish with just the CLI. The flow is:

1. Sign in via the web UI (email OTP). This establishes a browser session.
2. Bootstrap your workspace. The first authenticated call to POST /v1/setup/bootstrap provisions your tenant and default project. The web UI does this for you on first login.
3. Mint a project API token in the UI. This calls POST /v1/setup/projects/{project_id}/api-tokens. The token's full value is returned exactly once: copy it immediately.
4. Use that token + the project id from the SDK/CLI to publish runs. The runs endpoints (/v1/runs) accept the project API token as a Bearer token.

The bootstrap and token-minting endpoints require a browser session and also enforce a trusted-origin allow-list, so they cannot be driven from a script with just an API token. The runs endpoints require a project API token and do not accept session cookies.

Environment variables

The CLI reads two environment variables:

export EVARIS_API_URL=https://api.your-evaris-deploy.example
export EVARIS_API_TOKEN=<project-api-token>

EVARIS_API_URL defaults to http://localhost:8787 (the local dev worker). EVARIS_API_TOKEN has no default: you must provide it.

The SDK equivalent sets fields on the generated OpenAPI config object before calling services:

import { OpenAPI } from "evaris";

OpenAPI.BASE = "https://api.your-evaris-deploy.example";
OpenAPI.TOKEN = "<project-api-token>";

publishInspectLogs sets both from its options, so you do not normally need to touch OpenAPI directly when using that helper.

Token lifecycle

• A token is hashed at rest; only the prefix is stored.
• The full token is returned once, in the token field of the createProjectApiToken response. If you lose it, mint a new one.
• Tokens are scoped to one project. To publish to a different project, use that project's token.
• Rotation/revocation is handled in the web UI (not yet exposed via the SDK).

Trusted origins (self-hosting note)

If you self-host, the BETTER_AUTH_TRUSTED_ORIGINS worker secret controls which frontend origins may drive the session-gated setup routes. The EVARIS_API_URL for publishers should point at the worker's public origin.

Next

With a token and project id in hand, run the Quickstart.