Release v1.14.0

Origin-SHA: 107e75094781b71b7e6f09aa565dc975e8e34e41

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: ryanio

.agents/rules.md

@@ -80,6 +80,7 @@ CI runs `pnpm check-api-paths` on every PR; it fails if `src/sdk.ts` or `src/com
 Each domain has both a CLI command file (`src/commands/<domain>.ts`) and an SDK class (`src/sdk.ts`):
 
 - **accounts** - Account profile lookup
+- **api** - Low-level escape hatch to call any OpenSea API v2 endpoint (CLI only — no SDK class)
 - **assets** - Asset movement transactions (transfers)
 - **auth** - SIWE login and scoped token management (`login`, `status`, `refresh`, `revoke`, `tokens`, `scopes`, `clear`) plus API key requests (`request-key`)
 - **chains** - Chain information and supported networks

CHANGELOG.md

@@ -1,5 +1,20 @@
 # @opensea/cli
 
+## 1.14.0
+
+### Minor Changes
+
+- 66396b6: Add `--private-key` support to `opensea login` for SIWE authentication, enabling server-side agents to log in without a browser.
+
+### Patch Changes
+
+- Updated dependencies [66396b6]
+- Updated dependencies [fa2a24e]
+- Updated dependencies [333104e]
+- Updated dependencies [d7a44df]
+  - @opensea/api-types@0.8.1
+  - @opensea/sdk@11.4.8
+
 ## 1.13.2
 
 ### Patch Changes

README.md

@@ -60,10 +60,13 @@ opensea whoami
 opensea api request GET /api/v2/account/0xYOUR_WALLET/favorites --params '{"limit":1}'
 ```
 
-Use `--scopes` with `opensea login` to request a narrower scope set. The `api
-request` command supports GET, POST, PUT, PATCH, and DELETE plus JSON body files,
-so newly published scoped endpoints are available without waiting for a dedicated
-command.
+Use `--scopes` with `opensea login` to request a narrower scope set. For
+server-side agents, set `OPENSEA_PRIVATE_KEY` and pass `--private-key` (or pass
+`--private-key <key>`) to authenticate with SIWE instead of OAuth. Using the
+environment variable is recommended to keep the key out of shell history. The
+`api request` command supports GET, POST, PUT, PATCH, and DELETE plus JSON body
+files, so newly published scoped endpoints are available without waiting for a
+dedicated command.
 
 ## Quick Start
 

biome.json

@@ -12,6 +12,7 @@
       "**/*.json",
       "!**/.claude",
       "!**/typechain",
+      "!lib",
       "!**/dist",
       "!**/coverage",
       "!**/.vercel",

docs/cli-reference.md

@@ -25,6 +25,22 @@ expiry. Use `opensea whoami --diagnostic` to inspect decoded JWT claims and
 scope differences. Those claims are unverified, provider-specific diagnostics
 only and never authorization data.
 
+## Login
+
+```bash
+opensea login [--scopes <scopes>] [--client-id <id>] [--device] [--no-browser]
+opensea login --private-key [--scopes <scopes>]
+opensea login --private-key <key> [--scopes <scopes>]
+```
+
+`login` obtains a scoped access token and stores it in `~/.opensea/auth.json`.
+By default it runs the OAuth 2.1 authorization-code flow in a browser. Use
+`--device` for headless environments or `--no-browser` to print the authorization
+URL. Pass `--private-key` to authenticate with SIWE instead of OAuth, which is
+useful for server-side agents. Set `OPENSEA_PRIVATE_KEY` and use `--private-key`
+without a value to keep the key out of shell history; a raw key can be passed as
+an option value when necessary.
+
 ## Collections
 
 ```bash

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensea/cli",
-  "version": "1.13.2",
+  "version": "1.14.0",
   "type": "module",
   "description": "OpenSea CLI - Query the OpenSea API from the command line or programmatically",
   "main": "dist/index.js",
@@ -23,8 +23,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@opensea/api-types": "^0.8.0",
-    "@opensea/sdk": "^11.4.7",
+    "@opensea/api-types": "^0.8.1",
+    "@opensea/sdk": "^11.4.8",
     "@opensea/wallet-adapters": "^0.3.3",
     "commander": "^14.0.3",
     "zod": "^4.3.6"

package.json

@@ -0,0 +1,41 @@
+/**
+ * Resolve the private key to use for SIWE login.
+ *
+ * `--private-key` is intentionally an optional-value option. Passing it
+ * without a value reads `OPENSEA_PRIVATE_KEY`; passing it with a value
+ * should only be used in scripted/automated contexts because command-line
+ * arguments can leak into shell history and process listings.
+ */
+export function resolvePrivateKey(optionValue: string | true | undefined): {
+  privateKey: string
+  source: "argument" | "environment"
+} {
+  if (typeof optionValue === "string") {
+    return { privateKey: optionValue, source: "argument" }
+  }
+
+  const envValue = process.env.OPENSEA_PRIVATE_KEY
+  if (envValue) {
+    return { privateKey: envValue, source: "environment" }
+  }
+
+  throw new Error(
+    "Private key required. Set OPENSEA_PRIVATE_KEY or pass --private-key <key>.",
+  )
+}
+
+/**
+ * Emit a stderr warning when a private key was passed as an inline command
+ * argument, so users are nudged toward the environment variable.
+ */
+export function warnIfInlinePrivateKey(
+  source: "argument" | "environment",
+): void {
+  if (source === "argument") {
+    console.error(
+      "Warning: passing a private key as a command-line argument is insecure " +
+        "and may be recorded in shell history or visible to other users via ps. " +
+        "Prefer setting OPENSEA_PRIVATE_KEY and passing --private-key without a value.",
+    )
+  }
+}