@retell-ai/retell-cli 0.7.0 → 0.9.0

package/README.md

@@ -40,7 +40,9 @@ retell auth whoami
 retell auth logout
 ```
 
-`retell auth login` reports any current credential by source and masks its value. Press Enter to keep an existing keychain/config credential, or enter a new key to replace it. If `RETELL_API_KEY` is set, it remains authoritative; run `unset RETELL_API_KEY` in the current shell before logging in with a different active key.
+`retell auth login` reports any current credential by source, and its org and API key name if it's still valid. Press Enter to keep an existing keychain/config credential, or enter a new key to replace it. A new key is validated against the Retell API before it's stored — invalid keys are rejected and nothing is written to disk. If `RETELL_API_KEY` is set, it remains authoritative; run `unset RETELL_API_KEY` in the current shell before logging in with a different active key.
+
+`retell auth whoami` shows the org, API key name, and credential source, without printing the raw key value.
 
 `retell auth logout` clears keychain/config credentials and verifies that they are gone. It cannot unset `RETELL_API_KEY` in the parent shell, so it prints a warning when the environment variable keeps authentication active.
 
@@ -65,4 +67,4 @@ For password, token, or API-key request fields, prefer `--body -` or stdin so th
 
 Use `--dry-run` to inspect a redacted request without sending it.
 
-`--base-url` is intended for trusted development servers and proxies. The CLI sends the configured Retell bearer credential to the overridden URL, matching the Retell SDK behavior. API requests time out after 60 seconds, except multipart/file-upload requests, which time out after 300 seconds.
+`--base-url` is intended for trusted development servers and proxies. The CLI sends the configured Retell bearer credential to the overridden URL, matching the Retell SDK behavior. API requests time out after 60 seconds, except multipart/file-upload requests, which time out after 300 seconds. 

package/dist/src/generated/operations.js

@@ -3,7 +3,7 @@ export const catalogMetadata = {
     "title": "Retell SDK",
     "apiVersion": "3.0.0",
     "server": "https://api.retellai.com",
-    "sourceSha256": "cc08c5273d301322a16e22fd70291fef4e653ecb3cccd81ce2bdb307e1c31968",
+    "sourceSha256": "bf6aa757ac4071a5740c53352c070217f94e2fd1d4631e529c53dabc3461b237",
     "operationCount": 81
 };
 export const schemaDefinitions = {
@@ -9437,7 +9437,7 @@ export const operations = [
         "deprecated": false,
         "authenticated": true,
         "parameters": [],
-        "responseContractHash": "d4d6024d778dacf042a8c11156c6ac38f1b5ecdb6c6a681e586193919e8a6b30"
+        "responseContractHash": "83a410882e0a73c1d43433f23611e69ad2d9b5ceb5ab1b370c5799d7f2c0c14a"
     },
     {
         "operationId": "getBatchTest",

package/dist/src/index.js

@@ -8,7 +8,10 @@ import { sendRequest } from "./runtime/http.js";
 import { renderOutput, resolveOutputFormat } from "./runtime/output.js";
 import { dryRunOutput, prepareRequest } from "./runtime/request.js";
 import { cliVersion } from "./runtime/version.js";
-const operations = generatedOperations;
+// getApiKeyInfo backs `auth login`/`auth whoami` internally; hidden from direct
+// use so it isn't a general-purpose way to dump org_id/api_key_name.
+const HIDDEN_OPERATION_IDS = new Set(["getApiKeyInfo"]);
+const operations = generatedOperations.filter((operation) => !HIDDEN_OPERATION_IDS.has(operation.operationId));
 async function main() {
     const [first, ...rest] = process.argv.slice(2);
     if (!first || first === "--help" || first === "-h" || first === "help" && !rest[0]) {
@@ -24,6 +27,9 @@ async function main() {
         return;
     }
     const commandName = first === "help" ? rest.shift() : first;
+    if (commandName === "get-api-key-info") {
+        throw new Error("get-api-key-info isn't a standalone command. Use 'retell auth login' or 'retell auth whoami' instead.");
+    }
     const operation = operations.find((candidate) => candidate.command === commandName);
     if (!operation)
         throw new Error(`Unknown command: ${commandName}. Run 'retell --help' to list commands.`);

package/dist/src/runtime/auth.js

@@ -1,16 +1,48 @@
-import { clearApiKey, maskApiKey, resolveApiKey, storeApiKey } from "./credentials.js";
+import { clearApiKey, resolveApiKey, storeApiKey } from "./credentials.js";
+import { catalogMetadata } from "../generated/operations.js";
+import { fetchApiKeyIdentity } from "./identity.js";
+const defaultBaseUrl = catalogMetadata.server;
 function authHelp() {
     return `Manage Retell API authentication.\n\n` +
         `Usage:\n` +
-        `  retell auth login [--with-token]\n` +
-        `  retell auth whoami\n` +
+        `  retell auth login [--with-token] [--base-url <URL>]\n` +
+        `  retell auth whoami [--base-url <URL>]\n` +
         `  retell auth logout\n\n` +
         `Commands:\n` +
-        `  login    Prompt for and securely store a Retell API key\n` +
-        `  whoami   Show whether authentication is configured and its source\n` +
+        `  login    Validate and securely store a Retell API key\n` +
+        `  whoami   Show authentication status and the org/key it belongs to\n` +
         `  logout   Delete the stored Retell API key\n\n` +
         `RETELL_API_KEY overrides any stored credential.\n`;
 }
+/**
+ * Prints org/key identity first (or a soft warning if the live check fails),
+ * then a blank line, then the given status line and credential source.
+ * Shared by login's "Already authenticated" message and `whoami`.
+ */
+async function printCredentialStatus(credential, baseUrl, statusLine) {
+    if (credential.value) {
+        try {
+            const identity = await fetchApiKeyIdentity(credential.value, baseUrl);
+            process.stdout.write(`Org: ${identity.orgName}\n`);
+            if (identity.apiKeyName)
+                process.stdout.write(`API key name: ${identity.apiKeyName}\n`);
+        }
+        catch (error) {
+            process.stdout.write(`Could not verify this key with the Retell API: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+    }
+    process.stdout.write(`${statusLine}\nSource: ${credential.source}\n`);
+}
+/** Extracts `--base-url <URL>` from an auth subcommand's options, returning the remaining options. */
+function takeBaseUrl(options) {
+    const index = options.indexOf("--base-url");
+    if (index === -1)
+        return { rest: options };
+    const value = options[index + 1];
+    if (value === undefined)
+        throw new Error("--base-url requires a value");
+    return { baseUrl: value, rest: [...options.slice(0, index), ...options.slice(index + 2)] };
+}
 async function readAllStdin() {
     const chunks = [];
     for await (const chunk of process.stdin)
@@ -61,42 +93,46 @@ export async function handleAuth(tokens) {
         return;
     }
     if (command === "login") {
-        if (options.some((option) => option !== "--with-token" && option !== "--help" && option !== "-h")) {
-            throw new Error(`Unknown auth login option: ${options.find((option) => !["--with-token", "--help", "-h"].includes(option))}`);
+        const { baseUrl, rest: loginOptions } = takeBaseUrl(options);
+        if (loginOptions.some((option) => option !== "--with-token" && option !== "--help" && option !== "-h")) {
+            throw new Error(`Unknown auth login option: ${loginOptions.find((option) => !["--with-token", "--help", "-h"].includes(option))}`);
         }
-        if (options.includes("--help") || options.includes("-h")) {
+        if (loginOptions.includes("--help") || loginOptions.includes("-h")) {
             process.stdout.write(`Store a Retell API key.\n\nUsage:\n  retell auth login\n  printf '%s' "$RETELL_API_KEY" | retell auth login --with-token\n`);
             return;
         }
         const current = await resolveApiKey();
         if (current.source !== "unset") {
-            process.stdout.write(`Already authenticated.\nSource: ${current.source}\nAPI key: ${maskApiKey(current.value)}\n`);
+            await printCredentialStatus(current, baseUrl ?? defaultBaseUrl, "Already authenticated.");
         }
         if (current.source === "env") {
             const guidance = "RETELL_API_KEY overrides stored credentials. Run 'unset RETELL_API_KEY' in this shell before logging in with a different key.";
-            if (options.includes("--with-token"))
+            if (loginOptions.includes("--with-token"))
                 throw new Error(guidance);
             process.stdout.write(`${guidance}\n`);
             return;
         }
-        const token = options.includes("--with-token")
+        const token = loginOptions.includes("--with-token")
             ? await readAllStdin()
             : await promptHidden(current.source === "unset" ? "Retell API key: " : "New Retell API key (press Enter to keep current): ");
         if (!token.trim() && current.source !== "unset") {
             process.stdout.write("Existing Retell API key kept unchanged.\n");
             return;
         }
+        const identity = await fetchApiKeyIdentity(token.trim(), baseUrl ?? defaultBaseUrl);
         const source = await storeApiKey(token);
         process.stdout.write(source === "keyring"
             ? "Retell API key stored in the OS keychain.\n"
             : "OS keychain unavailable; Retell API key stored in ~/.config/retell/credentials.json with mode 0600.\n");
+        process.stdout.write(`Logged in to ${identity.orgName}${identity.apiKeyName ? ` as key "${identity.apiKeyName}"` : ""}.\n`);
         return;
     }
     if (command === "whoami") {
+        const { baseUrl, rest: whoamiOptions } = takeBaseUrl(options);
+        if (whoamiOptions.length)
+            throw new Error(`Unknown auth whoami option: ${whoamiOptions[0]}`);
         const credential = await resolveApiKey();
-        process.stdout.write(`Authentication: ${credential.source === "unset" ? "not configured" : "configured"}\n`);
-        process.stdout.write(`Source: ${credential.source}\n`);
-        process.stdout.write(`API key: ${maskApiKey(credential.value)}\n`);
+        await printCredentialStatus(credential, baseUrl ?? defaultBaseUrl, `Authentication: ${credential.source === "unset" ? "not configured" : "configured"}`);
         return;
     }
     if (command === "logout") {

package/dist/src/runtime/identity.js

@@ -0,0 +1,38 @@
+import { operations } from "../generated/operations.js";
+import { sendRequest } from "./http.js";
+import { prepareRequest } from "./request.js";
+const getApiKeyInfoOperation = operations.find((operation) => operation.operationId === "getApiKeyInfo");
+function emptyArgs() {
+    return {
+        pathValues: new Map(),
+        queryValues: new Map(),
+        headerValues: new Map(),
+        cookieValues: new Map(),
+        bodyValues: new Map(),
+        multipartValues: new Map(),
+        dryRun: false,
+    };
+}
+/** Calls GET /get-api-key-info to confirm an API key is valid and fetch its org/key identity. */
+export async function fetchApiKeyIdentity(apiKey, baseUrl, fetchImplementation = fetch) {
+    if (!getApiKeyInfoOperation)
+        throw new Error("getApiKeyInfo operation is missing from the generated catalog.");
+    const request = await prepareRequest(getApiKeyInfoOperation, emptyArgs(), apiKey, baseUrl);
+    const response = await sendRequest(getApiKeyInfoOperation, request.url, request.init, fetchImplementation);
+    const text = await response.text();
+    const value = text ? (() => { try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    } })() : null;
+    if (!response.ok) {
+        if (response.status === 401)
+            throw new Error("This API key was rejected by the Retell API.");
+        throw new Error(`Retell API request failed (${response.status}): ${typeof value === "string" ? value : JSON.stringify(value)}`);
+    }
+    return {
+        orgName: value.org_name,
+        apiKeyName: value.api_key_name ?? null,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retell-ai/retell-cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Generated command line interface for the Retell API",
   "license": "Apache-2.0",
   "repository": {