bk auth token --json inspects the token used for an API request

Introduced 2026-10-29 · score 0.95

HOW TO USE IT

When an external API client needs the selected token and its expiry, run `bk auth token --json` to inspect it and emit JSON. The inspection can renew stored OAuth credentials after a 401 and retry.

WHY THIS HELPS

Inspect the selected credential for an external API client, including a renewed stored OAuth credential when needed.

BEFORE THIS CHANGE

Run `bk auth token` to read the selected stored credential or `BUILDKITE_API_TOKEN` without an API request; an expired stored OAuth token is returned without renewal.

REQUIREMENTS AND LIMITATIONS

• Version: v3.67.0
• Non-interactive: Writes JSON to stdout. Without a token, returns an error advising `bk auth login`; credential-store operations can outlast the timeout.
• --json: Inspect token through API transport; emit token, expiry, and organization as JSON.
• --timeout: Sets inspection and renewal request deadline; default 30s, must be positive with `--json`.
• A successful inspection returns the token even when little lifetime remains.
• The result uses null when no expiry timestamp is available and does not classify the credential from that absence.
• Credential-store operations can outlast the timeout deadline.

FIRST-PARTY EVIDENCE

• https://github.com/buildkite/cli/releases/tag/v3.67.0
• https://github.com/buildkite/cli/pull/1065
• https://github.com/buildkite/cli/blob/v3.67.0/cmd/auth/token.go

Check the installed version and the source before using it. Entry JSON

Report a problem with this card