Headless CLI and agentic account auth

README.md

@@ -14,78 +14,49 @@ npm install -g @bitrefill/cli
 
 ## Quick start (`init`)
 
-The fastest way to set up the CLI:
-
-```bash
-bitrefill init
-```
-
-This walks you through a one-time setup:
-
-1. Prompts for your API key (masked input) -- get one at [bitrefill.com/account/developers](https://www.bitrefill.com/account/developers)
-2. Validates the key against the Bitrefill MCP server
-3. Stores the key in `~/.config/bitrefill-cli/credentials.json` (permissions `0600`)
-4. If [OpenClaw](https://github.com/openclaw/openclaw) is detected, registers Bitrefill as an MCP server and generates a `SKILL.md` for agents
-
 Non-interactive and agent-driven usage:
 
 ```bash
-# Pass the key directly (scripts, CI, OpenClaw agents)
-bitrefill init --api-key YOUR_API_KEY --non-interactive
-
-# Or via environment variable
-export BITREFILL_API_KEY=YOUR_API_KEY
-bitrefill init --non-interactive
+# Initialize in non-interactive mode
+bitrefill init
 
 # Force OpenClaw integration even if not auto-detected
 bitrefill init --openclaw
 ```
 
-After `init`, the stored key is picked up automatically -- no need to pass `--api-key` on every invocation.
+```bash
+bitrefill login --email you@example.com
+bitrefill verify --code 123456
+```
 
 ### OpenClaw + Telegram
 
 If you use [OpenClaw](https://github.com/openclaw/openclaw) as your AI agent gateway (e.g. via Telegram), `bitrefill init` does extra work:
 
-- Writes `BITREFILL_API_KEY` to `~/.openclaw/.env` (read by the gateway at activation)
-- Adds an MCP server entry to `~/.openclaw/openclaw.json` using `${BITREFILL_API_KEY}` -- the config file never contains the actual key
+- Adds an MCP server entry to `~/.openclaw/openclaw.json`
 - Generates `~/.openclaw/skills/bitrefill/SKILL.md` so the agent knows about all available tools
 
 After init, tell your Telegram bot: *"Search for Netflix gift cards on Bitrefill"*.
 
 ## Authentication
 
-### API Key (recommended)
-
-Generate an API key at [bitrefill.com/account/developers](https://www.bitrefill.com/account/developers). After running `bitrefill init`, the key is stored locally and used automatically.
+### Sign in
 
-You can also pass it explicitly:
+Two steps. Use the emailed verification `--code`; add `--otp` if your account also requires a second factor (for example TOTP).
 
 ```bash
-# Flag
-bitrefill --api-key YOUR_API_KEY search-products --query "Netflix"
-
-# Environment variable
-export BITREFILL_API_KEY=YOUR_API_KEY
-bitrefill search-products --query "Netflix"
+bitrefill login --email you@example.com
+bitrefill verify --code 123456
 ```
 
-Key resolution priority: `--api-key` flag > `BITREFILL_API_KEY` env var > stored credentials file.
-
-### OAuth
-
-On first run without an API key, the CLI opens your browser for OAuth authorization. Credentials are stored in `~/.config/bitrefill-cli/`.
-
 ### Non-interactive / CI
 
-In environments without a TTY (e.g. CI, Docker, scripts), or when `CI=true`, the CLI cannot complete browser-based OAuth. Use `bitrefill init` first, or pass `--api-key` / `BITREFILL_API_KEY`.
-
-Node does not load `.env` files automatically. After editing `.env`, either export variables in your shell (`set -a && source .env && set +a` in bash/zsh) or pass `--api-key` on the command line.
+In environments without a TTY (e.g. CI, Docker, scripts), ensure credentials are provided by your runtime and then run `bitrefill init`.
 
 ## Usage
 
 ```bash
-bitrefill [--api-key <key>] [--json] [--no-interactive] <command> [options]
+bitrefill [--json] [--no-interactive] <command> [options]
 ```
 
 ### Human-readable output (default)
@@ -110,11 +81,10 @@ bitrefill --json search-products --query "Amazon" --per_page 1 | jq '.products[0
 Generates Markdown from the MCP `tools/list` response: tool names, descriptions, parameter tables, JSON Schema, example `bitrefill …` invocations, and example MCP `tools/call` payloads. Intended for **CLAUDE.md**, **Cursor** rules, or **`.github/copilot-instructions.md`**.
 
 - **stdout** by default, or **`-o` / `--output <file>`** to write a file.
-- Uses the same auth as other commands (`--api-key`, `BITREFILL_API_KEY`, or OAuth).
-- The generated **Connection** line shows a redacted MCP URL (`…/mcp/<API_KEY>`), not your real key.
+- Uses the same auth as other commands.
+- The generated **Connection** line shows a redacted MCP URL, not sensitive credentials.
 
 ```bash
-export BITREFILL_API_KEY=YOUR_API_KEY
 bitrefill llm-context -o BITREFILL-MCP.md
 # or: bitrefill llm-context > BITREFILL-MCP.md
 ```
@@ -140,7 +110,7 @@ bitrefill list-orders
 # List available commands
 bitrefill --help
 
-# Clear stored credentials
+# Clear local login session
 bitrefill logout
 
 # Export tool docs for coding agents (see "LLM context" above)

package.json

@@ -22,12 +22,12 @@
   ],
   "packageManager": "pnpm@10.27.0",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@toon-format/toon": "^2.1.0",
     "commander": "^14.0.3"
   },
   "devDependencies": {
-    "@types/node": "^25.3.0",
+    "@types/node": "^25.7.0",
     "prettier": "^3.8.1",
     "tsx": "^4.21.0",
     "typescript": "^5.8.3",

pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+overrides:
+  mcp-oauth-server: link:../../dev/mcpoauth

src/config.ts

@@ -0,0 +1,5 @@
+export const DEFAULT_BASE_MCP_URL = 'https://api.bitrefill.com/mcp';
+
+export const BASE_MCP_URL = process.env.BASE_URL || DEFAULT_BASE_MCP_URL;
+
+export const IS_DEFAULT_BASE_MCP_URL = BASE_MCP_URL === DEFAULT_BASE_MCP_URL;