Authenticate the OfflineCreator CLI with a scoped API key

Output contact sheet: no generated media was used as authentication evidence

This research did not run an authenticated generation, so there is no real image or video output, model selection, or provider disclosure to display. Leaving the contact sheet explicitly empty avoids presenting a fabricated sample as proof that a key worked. Authentication can be checked with a non-generating command; creative output belongs on the later generation task page.

The absence of a specimen is deliberate, not a product-outcome claim. No API key, account response, prompt, private media, or generation result was collected during research.

Curated outputs

None collectedNo authenticated or paid generation was performed.

Model and provider

Not applicableNo model was selected and no provider was contacted for this page.

Choose the authentication path before storing a credential

For the plain CLI and local stdio package, OfflineCreator requires a personal key in the `OFFLINECREATOR_API_KEY` process environment. The preferred remote MCP path is different: configure `https://mcp.offlinecreatorstudio.com/mcp` and let a compatible client complete browser OAuth without placing a personal API key in remote configuration.

This page owns the CLI key path. The current public installation guide directs users to create and revoke personal keys in signed-in Studio Settings. The public client sends the configured key as a Bearer credential on Studio API requests, while the public server separately labels package operations with `models`, `read`, and `generate` scopes.

In the immutable title and promise, “scoped API key” is a workflow target, not a verified name for a product control. Here it means keeping a personal key in the bounded local process and choosing low-impact checks before mutations. The public sources do not establish that users can select scopes when issuing a key, that a personal key carries the server's operation labels, or that the hosted API enforces those labels against the Bearer credential.

Plain CLI

`OFFLINECREATOR_API_KEY`Required in the child process environment.

Remote MCP

Browser OAuthPreferred when the client supports the documented remote flow.

Documented command-to-scope map

The public CLI parser sends `models` to `listModels`, `balance` and its `credits` alias to `getCredits`, and `generate` to generation creation. The public client maps those methods to model, credit, and generation API routes, while the public MCP server maps the equivalent operations to `models`, `read`, and `generate` respectively.

This is a public command, route, and tool-registration map, not evidence that the current Settings interface lets a user choose those scopes for a personal key. A successful catalog call shows only that the request completed; it does not establish how the key was configured or whether other account and generation operations are authorized.

`models` command

Maps to `models`The public server assigns the equivalent model-list operation to this scope.

`balance` / `credits`

Maps to `read`The public server assigns the equivalent credit-read operation to this scope.

`generate`

Maps to `generate`The public server assigns the equivalent generation operation to this scope.

Command rack for a bounded authentication check

Start with the lowest-impact command that checks the behavior you need. `npx @offlinecreator/mcp models` needs no prompt and does not create a generation. `npx @offlinecreator/mcp balance` reads the account balance. Reserve `npx @offlinecreator/mcp generate --model <id> --prompt "<text>"` for a separately approved generation test because it creates work rather than merely checking authentication.

The CLI reads the credential from process configuration before calling Studio API routes. The package security controls say tools do not return the key. Keep the production destination on its default trusted OfflineCreator origin; do not diagnose a key problem by redirecting the credential to an unverified host.

Low-impact check

`models`Confirms accepted authentication for catalog access only.

Account read

`balance`Checks whether the account-balance request completes.

Mutation boundary

`generate`Do not use merely to prove that a key is present.

Failure trace from symptom to bounded fix

If the process reports `OFFLINECREATOR_API_KEY is required`, the child process did not receive a non-empty value. Export the variable in the same shell that launches `npx`, or correct the secret injection boundary, without printing the value. If it reports an invalid-looking key, the current configuration accepts only `oc_live_` or `oc_test_` prefixes; replace the configured value from the intended secret store rather than pasting it into diagnostics.

For GitHub Actions, store the value as a repository or environment secret and map it through the `secrets` context to a step environment variable. GitHub warns that command-line arguments may be visible to other users or captured by process auditing, so do not append the key to the `npx` command. Current public sources do not document an exact missing-scope CLI error, so this trace does not diagnose one.

Required-variable error

Environment delivery failedFix export or runner secret injection without echoing the secret.

Invalid-format error

Configured value fails the prefix checkReplace it from the intended secret store.

Continue from authentication to the owned next task

Use the parent CLI directory for command routing, the installation page for Node and package setup, and the model-list page for the first non-generating check. These links remain assigned to this page even while the unpublished manifest intentionally suppresses route rendering. Authentication owns personal-key creation, environment delivery, documented command-to-scope mapping, supported failure diagnosis, and revocation; generation instructions stay with their narrower task pages.

Canonical boundary for CLI authentication

The immutable identity uses “scoped API key” as a bounded workflow target: create a personal key through the documented Settings flow, deliver it through `OFFLINECREATOR_API_KEY`, keep it out of commands and source control, start with a low-impact check, and use the public command-to-scope map only to understand package operation labels. It is not a claim that personal keys expose selectable scopes or carry those labels.

The parent CLI directory owns broad command discovery, while install, model, balance, and generation pages own their task-specific procedures. This route remains an unreviewed researched draft with degraded community coverage and no authenticated acceptance result. It should consolidate into `/cli/offlinecreator-cli` if current first-party evidence no longer supports a distinct personal-key and environment-variable workflow.