Authentication

Authenticate with an API key — the simplest and most reliable flow for servers, CI, and cron jobs. Mint an lh_… key in the portal and pass it when you construct the client.

All snippets use these imports:

Go SDK

import (
    sdkclient "github.com/lighthouse-web3/baas-go-sdk/client"
    sdktypes  "github.com/lighthouse-web3/baas-go-sdk/types"
)

JS SDK

import { BackupClient } from "@lighthouse-web3/baas-js-sdk";

CLI

npm install -g @lighthouse-web3/baas-js-sdk
baas --help

The CLI supports three login methods and stores the selected credential in its active profile:

# Browser (default): opens the device-code approval flow in your browser.
baas auth login

# Email and password: prompts for the password, or read it from an environment variable.
baas auth login --email you@example.com
baas auth login --email you@example.com --password-env BAAS_PASSWORD

# API key: create an `lh_…` key in the Lighthouse portal, then paste it when prompted.
baas auth login --api-key

# Confirm the active identity and workspace.
baas auth whoami

Use an API key for automation

For servers, CI, and cron jobs, mint an API key in the portal and use the API key flow below. It is the most reliable path.

API key (recommended for automation)

This is the simplest and most common flow for backup jobs. When you pass an API key, the client is already authenticated — you do not call Authenticate().

Go SDK

import (
    "log"
    "os"

    sdkclient "github.com/lighthouse-web3/baas-go-sdk/client"
)

func newClient() *sdkclient.BackupClient {
    c, err := sdkclient.NewBackupClient(sdkclient.BackupClientOptions{
        APIURL:      "https://baas-api.lighthouse.storage", // API host
        APIKey:      os.Getenv("LH_API_KEY"),               // lh_… from the portal
        WorkspaceID: os.Getenv("LH_WORKSPACE_ID"),          // workspace UUID
    })
    if err != nil {
        log.Fatalf("client init: %v", err)
    }
    return c
}

JS SDK

import { BackupClient } from "@lighthouse-web3/baas-js-sdk";

function newClient() {
  return new BackupClient({
    apiKey: process.env.LH_API_KEY,          // lh_… from the portal
    workspaceId: process.env.LH_WORKSPACE_ID, // workspace UUID
  });
}

CLI

Use a portal-created key interactively once, or set the environment variables directly for cron and CI:

# Interactive: stores the key in the active CLI profile.
baas auth login --api-key
baas workspace use <workspaceId>

# Non-interactive: credentials apply only to this process and its children.
export BAAS_API_KEY="lh_xxxxxxxxxxxxxxxxxxxxxxxx"
export BAAS_WORKSPACE_ID="550e8400-e29b-41d4-a716-446655440000"
baas auth whoami

Switching workspaces: call client.setWorkspaceId(id) (Go: c.SetWorkspaceID(id)) to change the default, or pass workspaceId inside the backup / restore options to override for a single call.

See API Keys for how to create, scope, and rotate keys.