# benchweave ui-login


Mint a single-use browser login URL (read-only UI session).


``` bash
benchweave ui-login [OPTIONS]
```


The URL carries a one-use code that expires in 60 seconds: open it in a browser on the bench host within that window. The bearer token itself never reaches the browser -- the gateway exchanges the code for a server-side session that is AT MOST as wide as this token (subset scopes, no later expiry).


<span class="gd-details-chevron" aria-hidden="true"></span>Full --help output


    Usage: benchweave ui-login [OPTIONS]

      Mint a single-use browser login URL (read-only UI session).

      The URL carries a one-use code that expires in 60 seconds: open it in a
      browser on the bench host within that window. The bearer token itself never
      reaches the browser -- the gateway exchanges the code for a server-side
      session that is AT MOST as wide as this token (subset scopes, no later
      expiry).

    Options:
      --gateway-url TEXT  Gateway base URL, e.g. http://127.0.0.1:8125  [required]
      --token TEXT        Bearer token (observe tier or higher).  [required]
      --scope TEXT        Narrow the browser session to this scope (repeatable;
                          every scope must be one the token holds -- widening is
                          refused).
      --ttl-mins INTEGER  Session lifetime in minutes (default: the gateway's
                          configured ceiling).
      --json              Emit the stable machine JSON contract instead of text.
      --help              Show this message and exit.


# Options


`--gateway-url: TEXT`  
**Required.** Gateway base URL, e.g. http://127.0.0.1:8125 Environment variable: `BENCHWEAVE_GATEWAY`.

`--token: TEXT`  
**Required.** Bearer token (observe tier or higher). Environment variable: `BENCHWEAVE_TOKEN`.

`--scope: TEXT`  
Narrow the browser session to this scope (repeatable; every scope must be one the token holds -- widening is refused).

`--ttl-mins: INTEGER`  
Session lifetime in minutes (default: the gateway's configured ceiling).

`--json`  
Emit the stable machine JSON contract instead of text.