Authentication

Set up CLI authentication with your GoMask account

Authentication

The GoMask CLI uses API secrets for authentication. This guide explains how to set up and manage your credentials.

Get Your API Secret

1. Log in to datafactory.gomask.ai
2. Navigate to Settings → API Keys
3. Click Generate New Key
4. Copy the generated secret (you won't see it again)

Initialize the CLI

Run the init command:

gomask init

When prompted, paste your API secret:

? Enter your GoMask API secret: **********************
✓ Configuration saved to gomask.toml
✓ File permissions set to owner-only (600)

Configuration File

The gomask init command creates a gomask.toml file:

[gomask]
secret = "your-encrypted-secret"
api_url = "https://cli.gomask.ai/api/v1"

File Security

• Permissions are set to 600 (owner read/write only)
• The secret is stored securely
• Add gomask.toml to your .gitignore

echo "gomask.toml" >> .gitignore

Configuration Priority

The CLI loads configuration in this order (highest priority first):

1. Command-line flags: --secret, --api-url
2. gomask.toml file: In current directory
3. Environment variables: GOMASK_SECRET, GOMASK_API_URL
4. Built-in defaults

Using Environment Variables

For CI/CD environments, use environment variables instead of a config file:

export GOMASK_SECRET="your-api-secret"
export GOMASK_API_URL="https://cli.gomask.ai/api/v1"  # Optional
export GOMASK_DEBUG="true"  # Optional

Then run commands without initializing:

gomask connectors list

Command-Line Override

Override credentials for a single command:

gomask connectors list --secret "your-api-secret"

Reinitialize Credentials

To update your credentials:

# Overwrite existing config
gomask init --force

# Or specify a different output file
gomask init --output config/gomask.toml

Custom API URL

For self-hosted or development environments:

gomask init --api-url https://api.custom-domain.com

Verify Authentication

Check that authentication is working:

gomask version

If authenticated, you'll see:

GoMask CLI v0.0.1
API URL: https://cli.gomask.ai/api/v1
Debug: disabled

Try listing connectors to confirm API access:

gomask connectors list

Commands Requiring Authentication

Most commands require authentication:

Troubleshooting

"Authentication required" Error

# Check if gomask.toml exists
ls -la gomask.toml

# Reinitialize if needed
gomask init

"Invalid API secret" Error

1. Verify your secret at datafactory.gomask.ai/settings/api-keys
2. Generate a new key if needed
3. Reinitialize: gomask init --force

Permission Denied

# Fix file permissions
chmod 600 gomask.toml

Security Best Practices

1. Never commit gomask.toml - Add to .gitignore
2. Use environment variables in CI/CD - Avoid storing secrets in code
3. Rotate keys regularly - Generate new API keys periodically
4. Use separate keys per environment - Different keys for dev/staging/prod
5. Revoke unused keys - Delete old API keys from the dashboard

Next Steps

• Quick Start - Create your first routine
• CI/CD Integration - Use in pipelines