Sign in

Before this: your plan includes the API and an owner or admin has switched it on (three things first).

There is no API key to copy. You sign in once with your normal Sparky account and the tool gets a short token (it lasts 5 minutes) that acts as you. This is the standard "device sign-in" command-line tools use: the tool shows a short code and you confirm it in your browser.

1. Save the script below as sparky-login.mjs (Node 18 or newer).
2. Run node sparky-login.mjs. It prints an address and a code.
3. Open the address, sign in with your Sparky account and confirm the code.
4. The script prints your token. Use it as authorization: Bearer … (your first calls).

// sparky-login.mjs: sign in as yourself and print a token that lasts 5 minutes. Needs Node 18 or newer.
import { randomBytes, createHash } from 'node:crypto';

const ISSUER = 'https://accounts.sparkyli.com/realms/sparky';
const post = (path, body) =>
  fetch(`${ISSUER}/protocol/openid-connect/${path}`, { method: 'POST', body: new URLSearchParams(body) })
    .then(async (r) => ({ ok: r.ok, ...(await r.json()) }));

const verifier = randomBytes(48).toString('base64url');
const challenge = createHash('sha256').update(verifier).digest('base64url');

const d = await post('auth/device', {
  client_id: 'sparky-cli', scope: 'openid profile email',
  code_challenge: challenge, code_challenge_method: 'S256',
});
if (!d.ok) throw new Error(d.error_description ?? d.error);
console.error(`Open ${d.verification_uri_complete} and confirm the code ${d.user_code}`);

for (;;) {
  await new Promise((r) => setTimeout(r, (d.interval ?? 5) * 1000));
  const t = await post('token', {
    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
    device_code: d.device_code, client_id: 'sparky-cli', code_verifier: verifier,
  });
  if (t.ok) { console.log(t.access_token); break; }
  if (t.error !== 'authorization_pending' && t.error !== 'slow_down') throw new Error(t.error_description ?? t.error);
}

Any language works. The sign-in is standard OAuth 2.0 (device authorization with PKCE) at accounts.sparkyli.com, client id sparky-cli; the configuration is at its discovery address. Never share a token: it is you. When it expires, sign in again.