Commands for authentication, authorization policy, and access to external resources. For the concepts, see Auth and GitHub repo access.

​
auth

Sign in and manage who can reach your boxes 
zomg auth <command>
SubcommandDescription
signinBrowser sign-in; stores the token on the current runtime target in ~/.config/zomg/config.toml (global, used from any directory)
logoutSign out; clear the stored token from the current runtime target
tokenPrint the current runtime target’s stored auth token
settingsShow or update global auth settings
# Sign in with Google and store a profile auth token
zomg auth signin

# Print the stored bearer token for agents/scripts
zomg auth token

# Show auth settings
zomg auth settings

# Protect the system API under the instance domain
zomg auth settings --protect-system

# Allow an additional Google Workspace domain
zomg auth settings --allowed-domain example.com

​
signin

Browser sign-in; stores the token on the current runtime target in ~/.config/zomg/config.toml (global, used from any directory) Aliased as login. 
zomg auth signin [options]
Argument / optionDescription
--port <PORT>Local callback port; 0 picks any free port. Defaults to 0.
--no-openPrint URL instead of opening a browser
--print-tokenPrint the minted token after sign-in

​
logout

Sign out; clear the stored token from the current runtime target Aliased as signout. 
zomg auth logout [options]
Argument / optionDescription
--allClear the stored token from every runtime target, not just the current one

​
token

Print the current runtime target’s stored auth token 
zomg auth token [options]
Argument / optionDescription
--jsonPrint JSON with token and email

​
settings

Show or update global auth settings 
zomg auth settings [options]
Argument / optionDescription
--jsonPrint the JSON response.
--protect-systemRequire sign-in on the system API domain (published apps, dashboard included, follow their own publish visibility)
--no-protect-systemLeave the system API domain open
--allow-all-google-accountsAllow any Google account
--workspace-onlyRestrict sign-in to configured domains/emails
--allowed-domain <ALLOWED_DOMAINS>Replace allowed domains; repeatable
--clear-allowed-domainsClear the allowed domain list
--allowed-email <ALLOWED_EMAILS>Replace allowed emails; repeatable
--clear-allowed-emailsClear the allowed email list

​
github

Manage GitHub repo grants and the per-box proxy 
zomg github <command>
SubcommandDescription
grantManage reusable GitHub repo/permission grants
attachAttach a grant to a box
detachDetach a grant from a box
box-grantsList grants attached to a box
proxy-tokenRotate and print a box’s Zomg GitHub proxy token
configShow server GitHub App configuration status
# Create or update a grant
zomg github grant create work-api --repo owner/api --permission contents=read

# Attach a grant to a box
zomg github attach my-box work-api

# Clone normally inside the box after attach
zomg exec my-box -- git clone https://github.com/owner/api.git /work/api

# Print the box's Zomg proxy token for debugging
zomg github proxy-token my-box

​
grant

Manage reusable GitHub repo/permission grants 
zomg github grant <command>
SubcommandDescription
listList GitHub grants
createCreate or update a GitHub grant
deleteDelete a GitHub grant

​
list

List GitHub grants 
zomg github grant list [options]
Argument / optionDescription
--jsonPrint the JSON response.

​
create

Create or update a GitHub grant 
zomg github grant create <NAME> [options]
Argument / optionDescription
<NAME>Name.
--repo <REPOSITORIES>Allowed repository in owner/name form. Repeat for multiple repositories (repeatable)
--permission <PERMISSIONS>Permission in name=read/write form. Repeat for multiple permissions (repeatable)
--jsonPrint the JSON response.

​
delete

Delete a GitHub grant 
zomg github grant delete <NAME>
Argument / optionDescription
<NAME>Name.

​
attach

Attach a grant to a box 
zomg github attach <BOX_NAME> <GRANT> [options]
Argument / optionDescription
<BOX_NAME>Box ref.
<GRANT>Grant name.
-p, --project <PROJECT>Target project.

​
detach

Detach a grant from a box 
zomg github detach <BOX_NAME> <GRANT> [options]
Argument / optionDescription
<BOX_NAME>Box ref.
<GRANT>Grant name.
-p, --project <PROJECT>Target project.

​
box-grants

List grants attached to a box 
zomg github box-grants <BOX_NAME> [options]
Argument / optionDescription
<BOX_NAME>Box ref.
-p, --project <PROJECT>Target project.
--jsonPrint the JSON response.

​
proxy-token

Rotate and print a box’s Zomg GitHub proxy token 
zomg github proxy-token <BOX_NAME> [options]
Argument / optionDescription
<BOX_NAME>Box ref.
-p, --project <PROJECT>Target project.
--jsonPrint the JSON response.

​
config

Show server GitHub App configuration status 
zomg github config

​
user

Manage deployment users 
zomg user <command>
SubcommandDescription
listList deployment users
createCreate a deployment user
updateUpdate a deployment user
deleteDelete a deployment user
zomg user create alice
zomg user list
zomg user delete alice

​
list

List deployment users 
zomg user list [options]
Argument / optionDescription
-j, --jsonPrint full JSON response

​
create

Create a deployment user 
zomg user create <NAME> [options]
Argument / optionDescription
<NAME>User name
--email <EMAIL>Email that resolves to this user at login (pre-create for a teammate)
--shell <SHELL>Login shell inside boxes
-j, --jsonPrint full JSON response

​
update

Update a deployment user 
zomg user update <NAME> [options]
Argument / optionDescription
<NAME>User name
--email <EMAIL>Email that resolves to this user at login (how operators fix collisions)
--shell <SHELL>Login shell inside boxes
-j, --jsonPrint full JSON response

​
delete

Delete a deployment user 
zomg user delete <NAME> [options]
Argument / optionDescription
<NAME>User name
--purge-homeAlso delete /home/<user> from the shared home volume (default: keep)