Skip to main content

Project Aria Login — Overview

projectaria_login is a standalone authentication library for Project Aria tools. It was extracted from the aria_mps_cli package to allow other Aria tools — such as Aria Studio, MPS CLI, and custom scripts — to authenticate users without depending on the full MPS CLI.

The library provides both password-based login for distributed accounts (tfbnw.net / *.wptst.com) and MMA (Managed Meta Account) device-flow login for Meta Work accounts, with secure token storage via the system keyring and an encrypted-file fallback when no keyring is available.

The PyPI package is published as projectaria-login.

Key Features​

  • Two login methods, auto-detected: password for tfbnw.net / *.wptst.com distributed accounts, MMA device flow for Work accounts.
  • Secure storage: tokens saved to OS keyring under service name projectaria_tools, shared with MPS CLI and Aria Studio.
  • Encrypted-file fallback: when the keyring is unavailable, the token is persisted to an encrypted local file (~/.projectaria/auth_token.enc, AES-256-GCM with a PBKDF2-derived key) using either the PROJECTARIA_TOKEN_KEY environment variable or an interactive passphrase.
  • Async Python API: built on aiohttp, fully typed with # pyre-strict.
  • CLI included: projectaria_login login, projectaria_login verify, and projectaria_login logout for shell scripts and manual use.

When to Use It​

Use caseRecommended surface
Log in once from terminal before running MPS CLI or Aria StudioCLI: projectaria_login login --username ...
Automate authentication in Python scripts, notebooks, or servicesPython API: the ProjectAriaLogin facade
Share credentials across tools on same machineKeyring storage — automatic, no extra code
Build a custom Aria tool needing Project Aria authDepend on projectaria-login PyPI package, not on aria_mps_cli

Token Lifecycle​

  1. Login: run the CLI or call ProjectAriaLogin.login(username). The right login method is auto-detected and your session is stored securely.
  2. Resume: on later runs, ProjectAriaLogin.resume() restores your saved session so you don't have to log in again. Expired sessions are cleared automatically.
  3. Share: Aria Studio, MPS CLI, and projectaria_login share the same stored credentials, so logging in once enables all tools.
  4. Logout: ProjectAriaLogin.logout() signs you out and clears your saved session.

Python API and Application Identity​

Import the public facade and types from the top-level projectaria_login package. Construct ProjectAriaLogin with your application's registered AuthenticationConfig; provide the async callbacks needed for MMA instructions, password entry, and encrypted-file passphrases. Use the facade as an async context manager so its HTTP session is closed after use.

After a successful login(), resume(), or adopt_token(), read identity from these properties:

PropertyMeaning
current_userDisplay name: the Managed Meta Account name, falling back to the account alias. Use for display only.
current_accountStable account alias. Use this instead of current_user to key persisted state.
current_user_idAccount ID.
current_app_idID of the application the current token is scoped to.

These properties are None when no identity has been resolved. The shared credential store does not make every token belong to the currently running application: a resumed token retains the application identity of the tool that issued it. current_app_id reports that token's scope, not the configuration of the tool reading it.

When embedding the login commands in another CLI, mount them with register_commands() from projectaria_login.cli and pass your application's configuration to run_command():

from projectaria_login.cli import run_command

# auth_config is your application's registered AuthenticationConfig.
success = run_command("login", username="user@company.com", config=auth_config)

Pass the same configuration when dispatching verify and logout. Omitting config uses Project Aria Login's own application identity. run_command() returns a boolean for the caller to map to an exit code; it is a synchronous CLI helper, not an async API.

Upgrading from 0.2.0

If your application used current_user as an account key, switch to current_account: in 1.0.0, current_user may be an MMA display name rather than the alias. Embedding CLIs should supply their own AuthenticationConfig rather than relying on the default application identity. The keyring entry and encrypted-file format are unchanged; a valid stored token can still be resumed.

Next Steps​