Every Shipmoor installation must be authorized to an account before it runs a product command. Analysis still runs locally; authorization establishes identity, entitlements, and Free command allowances.
Device authorization
Run a protected product command, such as:
shipmoor scan --changedAn unauthorized interactive installation starts the device flow, opens accounts.shipmoor.dev, and resumes the original command after approval. You can also start the existing login flow directly with shipmoor login. Help, version, login, logout, and doctor remain available without prior authorization.
New personal accounts receive exactly 30 days of full Pro access without a card. Existing unpaid accounts do not receive a retroactive trial unless Shipmoor grants one separately.
Credentials and leases
The device flow returns a short-lived access token, a rotating device-bound refresh credential, and a signed offline entitlement lease. Refresh credentials are stored in macOS Keychain, Windows Credential Manager, or Linux Secret Service, with a restrictive local-file fallback and warning. The signed lease may be stored in a restrictive local file.
Free leases cover seven days plus a 72-hour grace period for unlimited Scan, Harness, and Skills. Pro trial and subscription leases cover fourteen days plus a 72-hour grace period for Pro capabilities. The lease refresh interval does not shorten the 30-day trial.
Free metered commands must reach the allowance service before each admitted Claim Check, Review, Test Evidence, or Blast Radius run. A valid offline lease does not bypass that online allowance check.
Check account and usage state
shipmoor auth status
shipmoor usageshipmoor auth status reports the authorized account, device, and effective plan. shipmoor usage reports all four Free counters and their UTC renewal time. Allowance status is written to human-facing output and never contaminates JSON, SARIF, or other machine-readable stdout.
Non-interactive CI
Current self-managed CI supports Scan only. Create a scan-scoped machine token from an authorized environment:
shipmoor auth token create --name github-my-repo --scope scanStore it in the CI secret named SHIPMOOR_TOKEN and expose it to the process only through the environment. Shipmoor never copies this token to disk or logs it. Claim Check, Review, Test Evidence, and Blast Radius are not currently supported by self-managed CI tokens.
Sign out and revoke
shipmoor logout removes this installation’s local session. Devices and machine tokens are independently revocable in the account console. Logout, downgrade, and revocation do not delete project configuration, Harness or Skills setup, reports, or local evidence.