CLI
Sign in from a terminal with smore auth login and the device flow
The smore CLI signs in with a device code: the terminal prints a short code, you approve it in the browser, and the CLI stores its credential in your operating system's keychain. Nothing is printed to stdout and there is no plaintext file.
Public downloads of the CLI are not open yet. Most developers use an API key for scripts or MCP with OAuth for agents. The device flow below is a public API, so you can also build it into your own tool.
Sign in
smore auth login --client-label my-laptop
The CLI prints a user code and the address https://app.makesmores.com/auth/device. Open it, sign in, pick the workspace, enter the code, check the client name and permissions, and approve. Back in the terminal, smore auth status shows whether a credential is stored.
smore auth login asks for the agent scopes and viral:score by default. Flags add more:
| Flag | Adds |
|---|---|
--reddit-posts | reddit:posts:read, reddit:posts:write (drafts for every writer model) |
--reddit-signals | reddit:signals:read, reddit:signals:write (signals, content briefs, top posts, mentions) |
--x-signals | x:signals:read, x:signals:write |
--x-post | x:post:send, outreach:read, outreach:cancel |
--outreach | outreach:read, outreach:send, outreach:cancel |
--linkedin-outreach | linkedin:outreach:read, linkedin:outreach:send, linkedin:outreach:cancel |
--reddit-outreach | reddit:outreach:read, reddit:outreach:send, reddit:outreach:cancel |
--research | research:read, research:write, research:approve |
--prospecting | prospecting:read, prospecting:write, prospecting:start |
--prospecting-policy | prospecting:policy:write (needs --prospecting) |
--cancel | runs:cancel |
An existing sign-in never gains scopes on its own. Run smore auth login again with the new flags.
Connect an agent through the CLI
smore configure claude
smore configure cursor
Each command installs a local MCP server named smore that runs the CLI as a bridge to /api/v1/mcp. The client's configuration holds the path to the CLI and the server address, never a credential.
Environment
| Variable | Meaning |
|---|---|
SMORE_URL | Server origin, default https://app.makesmores.com |
SMORE_TOKEN | A token that overrides the keychain, for automation. Supply it from a secret manager. It does not refresh on its own |
SMORE_TIMEOUT | Request timeout, default 30 seconds, at most 5 minutes |
Success goes to stdout as JSON; errors go to stderr as JSON. Exit codes are 0 for success, 1 for a local failure, 2 for usage or configuration, and 3 for authentication.
The device flow over HTTP
Build the same sign-in into your own tool with three public routes.
1. Ask for a code
Name the client and list the scopes it needs.
curl -s https://app.makesmores.com/api/v1/integrations/device/code \
-H "Content-Type: application/json" \
-d '{"client_label": "my-tool", "scopes": ["reddit:signals:read", "viral:score"]}'
The answer holds device_code (keep it secret), user_code (show it to the person), verification_uri (https://app.makesmores.com/auth/device), expires_at and interval (5 seconds). The code expires after 10 minutes.
2. Ask the person to approve
They open verification_uri, sign in, pick a workspace, enter user_code and approve.
3. Poll for the credential
Poll every interval seconds:
curl -s https://app.makesmores.com/api/v1/integrations/device/token \
-H "Content-Type: application/json" \
-d '{"device_code": "'"$DEVICE_CODE"'"}'
Until the person approves, the answer is 400 authorization_pending. After that it returns access_token, refresh_token, token_type (Bearer), expires_at and grant. Access tokens last 15 minutes.
4. Refresh
Refresh before expires_at:
curl -s https://app.makesmores.com/api/v1/integrations/token/refresh \
-H "Content-Type: application/json" \
-d '{"refresh_token": "'"$REFRESH_TOKEN"'"}'
Each refresh returns a new pair and retires the old one, so a refresh token works once. If a refresh answer is lost, sign in again. The grant itself lasts 90 days.