feat(auth): add 'auth token' command to securely output access token

[evoxmusic]

Summary

• Adds qovery auth token subcommand that outputs a valid, auto-refreshed access token for use by external tools (e.g. Qovery AI Skill) that need to make direct Qovery API calls
• Eliminates the need for external tools to read ~/.qovery/context.json directly to extract the JWT token
• Supports three output modes: raw token value (default), --authorization-header for the full header, and --json for structured output including expiration and API URL

Motivation

The Qovery AI Skill increasingly needs to interact with the Qovery API directly for operations not yet available in the CLI. Currently, it reads the JWT from ~/.qovery/context.json, which:

• Couples external tools to the CLI's internal file format
• Bypasses token validation and refresh logic (if the token is expired, the AI skill has no way to refresh it)

This command provides a clean, programmatic interface that handles token refresh automatically.

Usage

# Get the raw token value (default - pipe-friendly)
TOKEN=$(qovery auth token)

# Use directly in curl
curl -H "Authorization: Bearer $(qovery auth token)" https://api.qovery.com/organization

# Get the full Authorization header value
qovery auth token --authorization-header

# Get structured JSON output
qovery auth token --json
# {
#   "access_token": "eyJ...",
#   "token_type": "Bearer",
#   "expires_at": "2026-05-08T12:00:00Z",
#   "api_url": "https://api.qovery.com"
# }

# JSON with authorization header pre-formatted
qovery auth token --json --authorization-header
# {
#   "authorization_header": "Bearer eyJ...",
#   "expires_at": "2026-05-08T12:00:00Z",
#   "api_url": "https://api.qovery.com"
# }

Security

• Only the short-lived access token is exposed, never the refresh token
• Token is validated before output (via GetAccessToken() which calls the API)
• Errors go to stderr, stdout contains only the token — safe for $() substitution
• ~/.qovery/context.json permissions remain 0600

Files Changed

File	Change
cmd/auth_token.go	New — command implementation

No existing code was modified. The existing qovery auth command continues to work unchanged.