The commands
All three take
--api URL. The default is VFREY_API_URL.
Until accounts are live
No server address is built in yet. Sologin and whoami stop at once, without any network call:
logout prints Not signed in (vfrey accounts are not live yet). and exits 0. npx vfrey doctor shows not signed in (free features work without it), and that is not a failure.
When you can sign in
Once an address is set,login uses a device flow. You open the link, confirm the code, and the command saves a token. The token is stored in the macOS Keychain, or elsewhere in credentials.json in the vfrey home folder, readable only by you. VFREY_CREDENTIALS_STORE=file skips the Keychain. vfrey sends the token only over https, or to your own machine.
What whoami shows
unlimited. See Plans and credits.
To sign in without login, for example in CI, set VFREY_TOKEN. It overrides a saved token.