@hank-warren/pi-multi-login

Register a second (third, fourth…) OAuth login for any provider Pi already knows how to sign in to. Each additional login is an ordinary provider with its own id — openai-codex-work, anthropic-personal — so it gets its own credential slot in auth.json while reusing the base provider's OAuth flow, transport and model catalog.

Use it to keep a subscription account separate from a work account, or to give a background reviewer (such as @hank-warren/pi-auto-permissions) a dedicated login that never competes with your interactive session for rate limits.

Install

pi install npm:@hank-warren/pi-multi-login

Try it without installing:

pi -e npm:@hank-warren/pi-multi-login

Usage

Run /multi-login in an interactive session:

• Add a login… — pick a base provider, type a suffix. The alias is written to the config file and registered immediately; then run /login, pick the alias, and complete OAuth there.
• An existing alias — remove it, which deletes both the credential and the provider.

All authentication goes through Pi's own /login — signing in for the first time and re-authenticating later (token expired, wrong account) both work there, because aliases are ordinary providers. /multi-login deliberately never drives an OAuth flow itself: /login implements every prompt type a provider's flow can emit (including the option choice OpenAI Codex asks for), so there is exactly one login path to keep correct. Aliases also appear in /model and pi --list-models with no extra work.

Once an alias has a credential you can select it like any other model:

pi --model openai-codex-work/gpt-5.6-sol -p "say hi"

Configuration

Aliases live in:

~/.pi/agent/pi-multi-login.json

When PI_CODING_AGENT_DIR points elsewhere, the configuration follows that agent directory. Set PI_MULTI_LOGIN_CONFIG to use an explicit file path.

{
  "aliases": [
    { "base": "openai-codex", "suffix": "auto-permissions" },
    { "base": "anthropic", "suffix": "work", "name": "Anthropic (work)" }
  ]
}

Field	Required	Meaning
base	yes	Provider id whose OAuth flow, transport and model catalog the alias reuses. It must expose an OAuth login, and it must not itself be an alias.
suffix	yes	Lowercase slug (^[a-z0-9]+(-[a-z0-9]+)*$) appended to base. The provider id is always `${base}-${suffix}`.
name	no	Display name. Defaults to `${baseProviderName} (${suffix})`.

/multi-login rewrites this file, but editing it by hand is supported — the format is the point. Unknown fields are ignored; a malformed file registers no aliases and reports the problem once at session start.

The providers that can act as a base are the ones Pi offers an OAuth login for: anthropic, github-copilot, kimi-coding, openai-codex, openrouter, radius, xai. /multi-login lists whatever the running Pi version actually offers.

How it works

Aliases register during the extension load phase rather than at session_start. pi --list-models, pi --model provider/id and pi auth all run before any session exists, so a session-only registration is invisible to them. Load-phase registrations are queued and flushed before every extension's session_start, so other extensions see the aliases regardless of load order.

At session_start each alias is re-cloned from the composed base provider, so an alias inherits any transport reshaping a config overlay applies to its base (this is what keeps an anthropic alias working under @gotgenes/pi-anthropic-auth).

Model lists are snapshots taken at clone time; the base provider remains the sole owner of catalog refresh.

Adoption of existing credentials

The first time the extension runs without a config file, it scans auth.json for credentials whose id is not itself a provider id but does extend one — openai-codex-auto-permissions extends openai-codex — and adopts them as aliases. The base is the longest matching OAuth provider id, which is what keeps openai-codex-auto-permissions attached to openai-codex rather than to openai.

This makes the package a drop-in replacement for the dedicated login that @hank-warren/pi-auto-permissions used to register itself. The scan runs once: writing the config file (even as {"aliases": []}) is what prevents it from running again, so an alias you delete stays deleted.

Cost

A host with no aliases and an existing config file does no work at startup beyond reading one small JSON file — no model runtime, no network.

License

MIT