Login & Setup

Authenticate with a club server. By default, club login opens your browser and runs an OAuth 2.0 Authorization Code flow with PKCE, requesting scopes read,write. On success the CLI receives a scoped personal access token, stores it in ~/.config/club/credentials.json, and registers it with dart pub token add.

club login <host> [--email <email>] [--no-browser] [--key <club_pat_...>]

<host> is a bare host like myclub.birju.dev. A full URL (https://myclub.birju.dev) is accepted too — both forms map to the same credential. Local dev servers (localhost, 127.0.0.1, 0.0.0.0) default to http://; everything else defaults to https://.

Options

Option	Description
`<host>`	The club server host (required). Accepts a full URL too.
`--key`	Skip interactive login and store the provided personal access token directly.
`--email`	Pre-fill the email (used by the `--no-browser` fallback; also a hint for the browser consent screen).
`--no-browser`	Disable the browser flow and prompt for email + password in the terminal.

There is no --password flag. If you need to paste an existing token, use --key club_pat_....

What It Does (browser flow)

Starts a short-lived local callback listener.
Opens the browser at the server’s /oauth/authorize endpoint (scope read,write, PKCE).
The server authenticates you (if you are not already signed in) and asks you to approve the token.
After approval, the server redirects to the local listener with an authorization code, which the CLI exchanges for a personal access token.
Stores the token in ~/.config/club/credentials.json, sets this server as the default, and runs dart pub token add automatically.

Example

$ club login myclub.birju.dev
Opening browser for authentication...

  https://myclub.birju.dev/oauth/authorize?response_type=code&...

Waiting for authorization (press Ctrl+C to cancel)...
Exchanging authorization code for token...

Logged in as jane@example.com
Token stored for myclub.birju.dev
Token registered with dart pub.

Non-browser fallback

club login myclub.birju.dev --no-browser --email jane@example.com

This prompts for your password in the terminal and exchanges it for a personal access token via the server’s login API.

Using an existing token

club login myclub.birju.dev --key club_pat_abc123...

Use this when you already generated a personal access token through the web UI (for example, for CI).

CI usage

club login is almost never needed in CI. The recommended pattern is to set CLUB_TOKEN as a CI secret and pass --server <host> to the command you actually want to run (club publish, club prepare, club publish --auto). The resolver detects CLUB_TOKEN and uses it directly when the URL isn’t in stored credentials, so no login step is required.

No login (recommended)
Pre-seed credentials

# No `club login` step at all.
- name: Publish
  run: club publish --server myclub.birju.dev
  env:
    CLUB_TOKEN: ${{ secrets.CLUB_TOKEN }}

CLUB_TOKEN shadows stored credentials globally, so every club command in the runner picks it up automatically.

Run club login --key once at the top of the job if you want a persistent credentials file (e.g. several jobs share the runner and you want them to re-use the auth):

- name: Pre-seed club credentials
  run: club login --key "$CLUB_TOKEN" myclub.birju.dev
  env:
    CLUB_TOKEN: ${{ secrets.CLUB_TOKEN }}

- name: Publish
  run: club publish --server myclub.birju.dev

After the login step, the credentials file is on disk for the rest of the job. dart pub is also configured automatically so dart pub get works.

The browser flow (club login with no --key) does not work in CI — there is no browser, no human to consent. Use the --key form or rely on CLUB_TOKEN.

club setup

Configure dart pub to work with your club server. This is the key integration command that bridges club credentials with dart pub.

club setup [--server <host>] [--env-var <VAR_NAME>]

Options

Option	Description
`--server`	Server host (default: current default server). Accepts a full URL too.
`--env-var`	Use an environment variable for the token instead of storing it directly

What It Does

Retrieves the stored token for the server from ~/.config/club/credentials.json
Runs dart pub token add <server-url> to register the token in dart pub’s credential store
Prints instructions for adding packages to pubspec.yaml

Example

$ club setup
Configuring dart pub for myclub.birju.dev...
Token registered with dart pub.

To use packages from club, add to your pubspec.yaml:

  dependencies:
    my_package:
      hosted: https://myclub.birju.dev
      version: ^1.0.0

Or set PUB_HOSTED_URL to use club as the default:

  export PUB_HOSTED_URL=https://myclub.birju.dev

The hosted: and PUB_HOSTED_URL values stay in URL form — they are consumed by dart pub, which expects URLs.

CI usage

club setup is only needed in CI when the build step itself runs dart pub get against a club-hosted dep — the setup registers the token with dart pub so dependency resolution authenticates. If the job only runs club publish / club prepare / club publish --auto, you can skip setup entirely (those commands authenticate via CLUB_TOKEN directly).

When you do need it, use --env-var so the token is read from the environment at resolution time instead of being written to disk:

- name: Configure dart pub
  run: club setup --env-var CLUB_TOKEN --server myclub.birju.dev
  env:
    CLUB_TOKEN: ${{ secrets.CLUB_TOKEN }}

- name: Get deps and test
  run: |
    dart pub get
    dart test
  env:
    CLUB_TOKEN: ${{ secrets.CLUB_TOKEN }}

club logout

Remove stored credentials for a server.

club logout [--server <host>] [--all]

Options

Option	Description
`--server`	Server host to logout from (default: current default server). Accepts a full URL too.
`--all`	Remove credentials for all servers

Example

$ club logout
Logged out from myclub.birju.dev

$ club logout --all
Logged out from all servers.

club config

Show or update CLI configuration. There are exactly two subcommands:

club config                      # Show current config (same as `config show`)
club config show                 # Show current config
club config set-server <host>    # Set default server

Example

$ club config
Default server: myclub.birju.dev

Configured servers:
  myclub.birju.dev (default) — jane@example.com
  staging.myclub.birju.dev — jane@example.com

Switching Default Server

If you work with multiple club servers (for example, production and staging), use set-server to switch:

club config set-server staging.myclub.birju.dev

All subsequent commands will target the new default server. Use club publish --server <host> to override it on a per-invocation basis.

Credential Storage

File Location

Platform	Path
Linux / macOS	`~/.config/club/credentials.json`
Windows	`%APPDATA%\club\credentials.json`

File Format

Credential entries are keyed by the canonical server URL — the form dart pub token add consumes — even when you logged in by typing only the host. The CLI normalises both shapes to the same key, so club login myclub.birju.dev and club login https://myclub.birju.dev map to the same entry.

{
"defaultServer": "https://myclub.birju.dev",
"servers": {
  "https://myclub.birju.dev": {
    "token": "club_pat_a1b2c3d4e5f6...",
    "email": "jane@example.com",
    "createdAt": "2026-04-09T10:00:00.000Z"
  },
  "https://staging.myclub.birju.dev": {
    "token": "club_pat_x9y8z7w6...",
    "email": "jane@example.com",
    "createdAt": "2026-04-09T11:00:00.000Z"
  }
}
}

Security

File permissions are set to chmod 600 on Unix (owner read/write only)
Tokens are stored in plaintext (same approach as ~/.pub-cache/credentials.json)
For CI/CD, always use --env-var with club setup to avoid storing tokens on disk