InFlow CLI
The InFlow CLI is a command-line Agent, not a Service implementation. Its installation guide covers supported platforms. The AEP command reference gives every flag and structured output field.
Inspect before you authenticate
aep inspect is stateless and works without an InFlow login. Give it a Service host to read the advertised AEP document, or an exact resource URL to check what that resource requires. Inspect does not enroll an Agent, request a credential, or contact an approval flow. For a did:web reference, resource authentication is not checked because no specific resource was supplied.
inflow aep inspect service.example inflow aep inspect https://service.example/private --method GET
The result separates Service capabilities from the authentication requirement of the selected resource. Use it to choose the next action; an advertised Grant Type does not by itself mean every resource accepts that credential. For a protocol-agnostic first look at a URL, inflow inspect can show ODP, AEP, MPP, and x402 signals together without starting authentication or payment.
Prepare InFlow authentication for Service access
Enroll, Status, Grant, and Revoke use an authenticated InFlow session. Unlock the local vault in a human-controlled terminal, then sign in. The InFlow session authorizes the CLI to request Platform signing; the resulting AEP client assertion separately authenticates the Agent to the Service. Signing in to InFlow does not itself enroll the Agent with that Service.
inflow vault unlock inflow auth login
For the sandbox environment, use inflow auth login --sandbox instead of the production login command. The CLI retains the authenticated environment for later commands. A vault unlock factor belongs in the terminal prompt, never in an agent prompt, command argument, or tool input. When an agent-mode command reports a locked vault, unlock it yourself and retry the command.
Enroll, then read the actual Service status
aep enroll provisions or reuses a Service-scoped Agent identity and sends Enroll after any necessary InFlow approval. An approval wait is not the same as the Service's enrollment state: the Service may still report pending verification, unmet requirements, or Owner action. aep status asks the Service for that lifecycle state and lists non-secret summaries of locally stored session credentials.
inflow aep enroll service.example --interval 5 inflow aep status service.example --format json
With --format json, Status separates the Service response from local.grants. If this CLI installation has no enrolled identity for that Service, it reports "enrolled":false with no local grants; it does not prove no Agent identity exists elsewhere. See Enroll an Agent and Check status for the underlying protocol decisions.
Fetch a resource and manage credentials
aep fetch starts with the resource request and uses AEP authentication when the resource requires it. It can fetch an anonymous resource without enrollment; authenticated access needs a compatible Agent identity or credential and may require Platform approval. The command preserves the requested method, headers, and replayable body within its redirect and response limits. It never makes a payment. If legitimate payment requirements remain after AEP access, structured output identifies MPP or x402 follow-up commands.
inflow aep fetch https://service.example/private --format json inflow aep grant service.example --grant-type api-key --scope read:resource inflow aep revoke service.example --credential-id <credential-id>
aep grant requests a fresh credential only when the Service advertises Grant and a compatible type. It stores the secret in the local vault and reports metadata rather than the secret. aep revoke can target one credential ID, one grant type, or all Service credentials when no selector is supplied. Choose the narrowest scope that matches your intention; removing a local record alone does not revoke the Service-issued credential.
Handle approvals and failures without exposing secrets
The terminal interface can wait while a human completes an InFlow approval. Agent mode and explicit --format output provide structured results and errors instead of an interactive view. A timed-out or denied approval is not an active enrollment or issued credential; inspect the returned error before retrying. Grant and Status output do not reveal stored credential values.
When required Claims cannot be supplied from the InFlow account, Enroll returns AEP_REQUIREMENTS_UNMET with a specific reason. Missing or invalid account information points to updating the account and retrying. An unsupported required Claim means InFlow cannot supply information the Service requires. Changing account information cannot resolve that limitation; the Service must request claims supported by this integration. Personal Claim Values are not included in the error output. For locked-vault recovery and exact error fields, use the CLI command reference.
