Accounts Overview

Opta Accounts is the identity and cloud-sync layer for Opta apps. It provides Supabase-backed authentication, CLI browser login handoff, cloud API key sync, and account capability checks used by the CLI runtime.

What Is Opta Accounts

The Accounts portal runs at https://accounts.optalocal.com. The CLI uses it for browser OAuth sign-in and stores the resulting session locally. Once signed in, the CLI can sync API keys and evaluate account capabilities for gated actions.

• Auth - email/password, phone/password, and browser OAuth.
• CLI callback relay - secure redirect to local 127.0.0.1:<port> callback.
• Cloud key sync - opta account keys list|push|delete.
• Capability checks - account and device-aware policy decisions.

Architecture

Opta CLI
  │
  │ account login --oauth
  ▼
accounts.optalocal.com
  │
  │ /cli/callback?port=<local-port>&state=<csrf>
  ▼
127.0.0.1:<local-port>/callback
  │
  │ access_token + refresh_token
  ▼
~/.config/opta/account.json
  │
  ├─ account keys list|push|delete  -> Accounts API (/api/keys)
  └─ capability evaluate            -> Accounts API (/api/capabilities/evaluate)

CLI Surface

Primary account commands:

{
  "ok": true,
  "authenticated": true,
  "project": "cytjsmezydytbmjrolyz",
  "user": { "id": "user_123", "email": "matthew@optamize.biz", "phone": null, "name": "Matthew" },
  "session": { "tokenType": "bearer", "expiresAt": "2026-03-04T10:24:12.000Z" },
  "updatedAt": "2026-03-04T09:41:03.000Z"
}

Data Stored Locally

The CLI persists account session state to ~/.config/opta/account.json with file mode 0600. Directory mode is 0700.

{
  "project": "cytjsmezydytbmjrolyz",
  "session": {
    "access_token": "...",
    "refresh_token": "...",
    "token_type": "bearer",
    "expires_in": 3600,
    "expires_at": 1772619852
  },
  "user": {
    "id": "user_123",
    "email": "matthew@optamize.biz"
  },
  "updatedAt": "2026-03-04T09:41:03.000Z",
  "deviceId": "dev_abc123"
}

Quick Start

Next Pages

• Auth - login modes, callback flow, token handling.
• Sync - key sync, device registration, capabilities.
• Troubleshooting - failure patterns and recovery commands.