auth

vinted auth

Log in, inspect or remove the session for a profile

vinted auth login

Import a browser session for the active profile

vinted auth login [flags]

Import a browser session for the active profile.

Vinted keeps the login in two browser cookies, access_token_web (short-lived) and refresh_token_web (HttpOnly), so the CLI needs a cookie export from a browser where you are logged in:

1. Install a cookie export extension (Cookie-Editor works) and open your Vinted site (www.vinted.com, www.vinted.fr, www.vinted.es, ...).
2. Export cookies as Netscape cookies.txt or JSON (Cookie-Editor, EditThisCookie, DevTools and Playwright lists all work) and save the file, or copy the browser's Cookie request header. A whole-browser export is fine: only the Vinted site's cookies are kept.
3. Run this command and paste the file path or the header when asked, or pass --cookies FILE / --cookies-stdin.

The cookies go into the bundled Galleton session engine's encrypted vault, never into credentials.toml. The engine renews the access token through Vinted's refresh endpoint before it expires, keeps the rotated cookies, and is the only party that ever uses the single-use refresh token. After the import, stop using that browser login (log out there and log in again if you need the website): the browser still holds the refresh token the engine spends. The site comes from the cookies' domain unless --domain is given. Google, Apple and Facebook accounts work the same way.

In a terminal, a successful login then asks whether to keep it alive in the background, which is the same as running "vinted auth service enable". --service answers yes and --no-service answers no without asking; with --no-input, in CI or with VINTED_GALLETON_* overrides it is not asked.

vinted auth login
vinted auth login --cookies ~/Downloads/www.vinted.fr_cookies.txt --profile fr
cat cookies.txt | vinted auth login --cookies-stdin --domain www.vinted.es
vinted auth login --cookies cookies.txt --no-input --service

vinted auth logout

Forget the active profile's session (keeps watches and config)

vinted auth logout [flags]

vinted auth refresh

Renew the access token now

vinted auth refresh

Ask the session engine to renew the access token now through Vinted's refresh endpoint. It renews on its own before expiry; this is for checking that the refresh token still works. It fails when Vinted has revoked the login, and then only a new "vinted auth login" helps.

vinted auth service

Manage optional unattended session renewal

The bundled Galleton session engine renews the stored session while vinted commands, watches or the MCP server run, and stops ten seconds after the last one exits. "enable" keeps it running between commands and restarts it at OS login (a systemd user unit, a LaunchAgent, or a Windows logon task), so the session renews even when nothing else runs. The unit carries the paths and VINTED_PROXY of the shell that enabled it, never a credential.

vinted auth service disable

Remove unattended renewal at OS login

vinted auth service disable

vinted auth service enable

Enable unattended renewal at OS login

vinted auth service enable

vinted auth service run

Keep session renewal running until interrupted

vinted auth service run [flags]

vinted auth service status

Inspect the session engine without starting it

vinted auth service status

vinted auth service stop

Stop an idle session engine without deleting credentials

vinted auth service stop

vinted auth status

Show the active profile's session

vinted auth status [flags]

Show the active profile's session as stored locally, without contacting anything. --check also asks the session engine for its state and reads the account from Vinted, which renews the access token first when it is due.