{
  "slug": "bk-auth-adds-oauth-login-and-logout-373a4d85488f",
  "title": "bk auth adds OAuth login and logout",
  "tools": [
    "bk"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-02-11T00:54:26.000Z",
  "announced_at": "2026-02-11T00:54:26.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When working in a Buildkite repository, authenticate with `bk auth login --org <organization-slug>` to open the browser OAuth flow and store the token in the system keychain. Use `bk auth logout [<organization-slug>]` to clear credentials for an organization; the v3.24.0 command also clears its config token.",
    "examples": [
      "bk auth login --org <organization-slug>",
      "bk auth login --org <organization-slug> --scopes \"<scope> <scope>\"",
      "bk auth logout [<organization-slug>]"
    ],
    "gotchas": [
      "Version: v3.24.0",
      "login --org <organization-slug> (required): Organization slug for OAuth login.",
      "login --scopes <scopes>: OAuth scopes to request; examples include `read_user read_organizations read_clusters write_clusters`.",
      "logout [<organization-slug>]: Organization slug; defaults to the currently selected organization. If neither is available, the command errors.",
      "Prerequisite: Install the Buildkite CLI; v3.24.0 is the version covered by the cited command source.",
      "Prerequisite: OAuth login opens a browser and stores the resulting token in the system keychain when available; it also writes the token to config for fallback/compatibility.",
      "OAuth support is initial.",
      "OAuth client ID is injected into built binaries.",
      "Tokens remain in text-based config; removing them is still to come.",
      "Docs conflict: Current auth documentation reflects newer CLI behavior: it lists login flags such as `--device` and `--token`, whereas v3.24.0 source requires `--org` and documents `--scopes`. Use the v3.24.0 source for this card."
    ]
  },
  "why_it_matters": "Authenticate the bk CLI with OAuth when working in a repository that uses Buildkite.",
  "before": "The release note says the temporary `auth` alias for `configure` was removed; it does not document the earlier command invocation.",
  "sources": [
    "https://github.com/buildkite/cli/releases/tag/v3.24.0",
    "https://github.com/buildkite/cli/pull/637",
    "https://github.com/buildkite/cli/blob/v3.24.0/cmd/auth/login.go",
    "https://github.com/buildkite/cli/blob/v3.24.0/cmd/auth/logout.go",
    "https://buildkite.com/docs/platform/cli/installation"
  ],
  "rank": 0.92025,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-0401be93a5046fa4-0:gate",
    "evidence_hash": "87d890a7b4ac96c8287f6d5ed89478141d259624475adbe13444e9418cf6b597"
  },
  "review": {
    "draft_hash": "6e0ed07b6849b6bde5d83d1180d5c3574695add60f385f9e4e438e480c6cf980",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.74 (>= 0.6 needed)."
  }
}