
Composer Controls
Authentication And Guest Sessions
Registry agents use your Aion account. Runaio login or /login inside chat to sign in to the selected
environment. An expired or rejected account asks you to log in again; it does not switch to a guest identity.
Registry catalog discovery currently requires an account.
Configured direct agent sources, including http://localhost:8000, use a separate guest bearer unless you
provide explicit endpoint credentials. The client obtains that guest session from the selected Aion control
plane, then sends requests directly to the agent. Signing in to the registry does not send your account
bearer to a local server. Discovery, message requests and stream reconnects use the same source credential.
Guest tokens last 30 days and renew during active use in their final seven days, preserving the session ID.
There is no absolute lifetime limit. Temporary renewal failures retain a still-valid token and use bounded
retry backoff; rate-limit responses honor Retry-After. No idle renewal timer keeps an unused client alive.
The OS keychain stores guest credentials separately from account refresh tokens, scoped by control-plane
URL, environment, source key and destination origin. npm and Python launches use separate keychain service
names. Tokens are not stored in chat2.json or conversation files. Losing a keychain entry may create a
fresh session next time; the client cannot recover the previous session’s access.
When a held guest credential expires or is rejected, chat requires an explicit choice:
retry for a temporary outage. Use new only when you want to replace that source’s guest identity.
A new guest session cannot access the previous guest’s conversations. This does not delete those conversations.
/clear starts a new conversation without replacing the guest identity.
For an explicit endpoint in headless mode, opt in to replacement with:
--url has its own source key, separate from the default localhost source. Keep using the same
source and launcher to reuse its guest identity. --token and --header apply only to the explicit source;
credentials never follow a discovered cross-origin URL or redirect.
The selected control plane must serve
/auth/anonymous-sessions. Client bearer delivery does not prove
that an agent verifies it: SDK server verification and ownership enforcement are a separate rollout step.
A guest bearer does not grant account-only GraphQL, file-upload or private Aion Chat access.Python SDK CLI
Use the Python SDK CLI when you are working inside a Python SDK project. Install it from the Python SDK installation guide.aion chat launches the terminal UI bundled with the Python package, so Node.js 22+ must be on
PATH. If you do not want the Python SDK at all, install the standalone npm package described
below instead.
Start interactive chat:
aion chat connects to http://localhost:8000. That default is useful when you are
running a local Aion proxy or agent server with the Python SDK.
Options
aion chat run also supports headless one-shot messages:
Examples
Connect to the default local endpoint:Standalone npm Package
Use the standalone npm package when you want the terminal chat client without installing the Python SDK. Install the standalone chat tool globally:aio connects to http://localhost:8000. The package also installs an aion-chat
alias:
Options
aio run and aion-chat run also support headless one-shot messages: