noodle auth

Manage service identities and diagnose downstream auth readiness.

Usage

noodle auth doctor|google|service-principals

Subcommands

• doctor [<server.ts>] — Check remote MCP OAuth readiness and optionally probe a deployed customer credential exchange.
  • --live — Probe real delegated exchanges without a business tool.
  • --org <slug> — Organization slug.
  • --app <slug> — Application slug.
  • --env <env> — Environment slug.
  • --version <version> — Pinned deployed MCP version to probe.
  • --service <url> — Control-plane service URL.
  • --json — Emit JSON output.
• google prepare — Prepare Google Workload Identity Federation.
  • --project-number <number> — Google Cloud project number. (required; 6-32 characters)
  • --pool <id> — Workload Identity Pool identifier. (required; 4-32 characters)
  • --provider <id> — Workload Identity Provider identifier. (required; 4-32 characters)
  • --service-account <email> — Google service account email.
  • --org <slug> — Organization slug.
  • --app <slug> — Application slug.
  • --env <env> — Environment slug.
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• google status — Show Google Workload Identity Federation status.
  • --org <slug> — Organization slug.
  • --app <slug> — Application slug.
  • --env <env> — Environment slug.
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• google doctor — Diagnose Google Workload Identity Federation.
  • --org <slug> — Organization slug.
  • --app <slug> — Application slug.
  • --env <env> — Environment slug.
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• google revoke — Revoke Google Workload Identity Federation.
  • --org <slug> — Organization slug.
  • --app <slug> — Application slug.
  • --env <env> — Environment slug.
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals create <name> — Create an organization-owned OAuth service principal.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals list — List service principals owned by an organization.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals show <principal-id> — Show one service principal with its grants and redacted credentials.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals grant <principal-id> — Grant a service principal access to one deployed app environment.
  • --app <slug> — Target application slug. (required)
  • --env <env> — Target environment slug. (required)
  • --scope <scope> — OAuth scope ceiling; repeat for multiple scopes. (repeatable)
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals revoke-grant <principal-id> <grant-id> — Revoke one app-environment grant.
  • --yes — Confirm revocation without an interactive prompt.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals add-jwk <principal-id> — Add an RS256 or ES256 public JWK credential from a file.
  • --label <label> — Human-readable credential label. (required; 1-80 characters)
  • --file <path> — Path to one public JWK JSON object. (required)
  • --expires-at <timestamp> — Optional credential expiry as an ISO 8601 timestamp.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals create-secret <principal-id> — Create a client secret that is returned once.
  • --label <label> — Human-readable credential label. (required; 1-80 characters)
  • --expires-at <timestamp> — Optional credential expiry as an ISO 8601 timestamp.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals revoke-credential <principal-id> <credential-id> — Revoke one public-key or client-secret credential.
  • --yes — Confirm revocation without an interactive prompt.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.
• service-principals revoke <principal-id> — Revoke a service principal and all of its access.
  • --yes — Confirm revocation without an interactive prompt.
  • --org <slug> — Organization that owns the service principal. (required)
  • --service <url> — Control-plane service URL.
  • --auth-token <token> — Control-plane authentication token.
  • --json — Emit JSON output.

Run noodle auth --help for the latest options and details.