Developer
Get Access
Step 4 of 7

Log in with your PFF account

There’s no token to create or paste for everyday use. The first command you run opens your browser, you sign in with your PFF account, and Restish remembers you from then on.

Writing a script, running in CI, or calling the API without Restish? You want an API key instead — see Authentication for how to get one and how to send it.

Your first command

whoami is the ideal first command: it tells you who the API thinks you are, and it is safe to run as often as you like.

restish pff whoami
  1. Your browser opens a PFF sign-in page. Sign in (or confirm you already are) and approve pff-pro.
  2. The tab says “You can close this tab”. Close it.
  3. Back in the terminal, the result prints:
{
  "external_id": "user_2abc...",
  "email": "you@example.com",
  "tier": "pro",
  "entitled": true,
  "entitlement_reason": null,
  "credential": "oauth",
  "session_expires_at": "2026-09-30T12:01:30Z",
  "installations": { "max": 2 }
}
Field Meaning
tier Your PFF subscription tier
entitled true when your account can use the data commands
entitlement_reason Why not, when entitled is false: subscription_required, trial (a Pro trial — the CLI isn’t included) or unlinked_account
credential How you signed in — oauth is the browser flow
session_expires_at When your current API session ends. It is renewed for you; nothing to do
installations.max The number of devices your account can use the CLI from

That’s it. Restish keeps the sign-in tokens in ~/.config/restish/tokens.cbor (readable only by you) and refreshes them silently, so you won’t see the browser again unless you log out or your access is revoked.

PFF Pro is required

Every data command needs a PFF Pro subscription. PFF+ and free accounts can sign in, but:

  • whoami reports "entitled": false, your real tier, and "entitlement_reason": "subscription_required".
  • Every data command is refused with a 403:
Error: pff-pro requires PFF Pro. Upgrade at https://www.pff.com/subscribe

If whoami says "entitlement_reason": "unlinked_account", your PFF account isn’t linked to a subscriber record. That’s a support matter, not a billing one — email contact@pff.com and quote the request_id from the error.

On a Pro trial? The CLI isn’t part of the trial. whoami reports "entitlement_reason": "trial", and data commands answer 403 with The CLI is not included in the Pro trial. It unlocks when your trial converts to a paid plan. — no upgrade link, because you already hold Pro.

No browser? Sign in from another device

On a server or over SSH, add --rsh-no-browser:

restish pff whoami --rsh-no-browser
Open this URL in a browser on another device, then paste the resulting code:
https://clerk.pff.com/oauth/authorize?...
Code: █

Open the URL on your phone or laptop, sign in, and paste the code back into the terminal.

Scripts and CI: use an API key

For automation, an API key is simpler than a browser flow. Create one under API keys in your pff.com account — it is shown once and starts with ak_live_. Store it as PFF_API_KEY in your shell profile or your CI’s secret store (never on the command line), then give Restish a second profile that reads it:

restish api set pff 'profiles.ci.credentials.pffApiKey.auth.type: bearer'
restish api set pff 'profiles.ci.credentials.pffApiKey.auth.params.token: env:PFF_API_KEY'

Add -p ci (short for --rsh-profile ci) to any command to use the key instead of your browser sign-in:

restish pff passing --league nfl --season 2025 -p ci -o json

Your default profile keeps using the browser sign-in, so both work side by side. Restish reads PFF_API_KEY when it sends the request, so the key itself never lands in your shell history or in restish.json. Treat it like a password all the same, and revoke it any time from the same account page.

Logging out

restish pff logout             # end this credential's access to the API
restish api auth logout pff    # delete the tokens Restish cached on this machine

Run both to sign this machine out completely. On its own, restish pff logout ends the API session for the token you were using — but Restish still holds a refresh token and will quietly obtain a new one on your next command, which is why whoami can still work a moment later. Neither command signs you out of pff.com in your browser.

Lost a laptop? Revoke its API key from your account page, or email contact@pff.com to revoke the browser sign-in — either works regardless of what’s cached on the device.

Next: Querying data — how commands are shaped, and the ones you’ll use most.

← PreviousAuthentication