Client authentication

Goauld uses separate credentials for the management API, administrative API, agent SSH service, and optional binary downloads. Configure only the credentials required for the operator’s role.

Prerequisites

Obtain the access token from the server administrator. Administrative commands also require an admin token. If the target agent uses a static password, obtain that password through an approved secret-sharing channel.

Quick configuration

Store normal operator credentials in $HOME/.config/tealc.yaml:

access-token: ACCESS_TOKEN_REPLACE_ME
admin-token: ADMIN_TOKEN_REPLACE_ME

Omit admin-token when the operator does not perform administrative actions. See Variables for CLI, environment, configuration-file, and compile-time precedence.

Server management authentication

The access token authenticates normal /manage/ API requests. Supply it with:

• --access-token ACCESS_TOKEN_REPLACE_ME
• TEALC_ACCESS_TOKEN=ACCESS_TOKEN_REPLACE_ME
• access-token: ACCESS_TOKEN_REPLACE_ME in tealc.yaml

Agent authentication

Commands that open an SSH connection—including SSH, transfers, clipboard, kill, and reset—require the agent’s static password when one is configured. Use -P/--password, enable prompting with --prompt, or use a stored per-agent password. See Password management.

Administrative authentication

The admin token authenticates /admin/ requests and destructive management operations such as deleting an agent record. Supply it with --admin-token, TEALC_ADMIN_TOKEN, or admin-token in tealc.yaml. See Access control.

Binary download authentication

Agent downloads can use a separate HTTP Basic Auth credential. See Agent downloading.

Security notes

• Do not place tokens or passwords directly in shared shell history.
• Restrict permissions on tealc.yaml when it contains credentials.
• Prefer password prompting over a global plaintext agent password.
• Grant the admin token only to operators who need administrative access.