ctxindex account
Authorize, list, and remove provider Accounts.
An Account is one stable authenticated provider identity. Its private authorization may back multiple Sources.
Usage
ctxindex account add <provider> [--app <label>] [--label <label>]
ctxindex account list [--json]
ctxindex account remove <label>Commands and flags
| Command or flag | Purpose |
|---|---|
add <provider> | Start OAuth authorization for one provider Account. When exactly one active App matches the host's managed-App policy, its label is selected if --app is omitted. This may open a browser. |
--app <label> | Select exactly one available Extension or local OAuth App for that Provider, bypassing managed-default selection. |
--label <label> | Set the globally unique Account label. The verified provider identity is the default. |
list | List Accounts with authorization health and bound Sources. |
remove <label> | Remove the Account and its private authorization. Bound Sources remain configured and become needs_auth. |
Use ctxindex oauth-app list to discover exact labels. Specify --app when reproducible App choice matters or when the Provider has no active managed default. ctxindex never guesses from local Apps or unreviewed Extension Apps.
For bring-your-own-app fallback, import the Provider's declared environment mapping once, then select that exact local label:
ctxindex oauth-app add <provider> <label> --from-env
ctxindex account add <provider> --app <label>Reauthorizing the same provider identity updates its stable Account and private authorization snapshot in place. Labels remain verbatim; collisions fail without prompting or automatic suffixes. Managed and explicitly selected Apps request the same Provider base scopes plus the active same-Provider Adapter scope union.
JSON output
Only account list accepts --json. Its deterministic inventory includes Account identity, label, Provider, authorization expiry, and bound Sources while excluding private Grant ids/scopes and secret values.
Stable exit codes
Exit codes are API: 0 success; 2 invalid usage or a label collision; 10 needs_auth; 20 rate limited; 30 network/provider; 40 permission denied; 50 other sync failure; 130 cancelled by SIGINT.