Authentication

Import a browser session; the bundled engine handles renewal and private storage.

Wallapop has no password API worth using. Google, Apple, Facebook and password accounts all end up at the same place, a session cookie in your browser. The CLI imports that cookie and then automatically starts its bundled Galleton engine for renewal and encrypted storage.

Why a cookie

An email and password login was tried and rejected; see ADR 0001 in the repository. Cookie import is the single supported path because it works identically for every account type.

Any cookie export extension works. Cookie-Editor, EditThisCookie and "Get cookies.txt" are the common ones.

Cookie-Editor homepage, showing the supported browsers and the import/export feature

Log in to Wallapop in your browser

Go to es.wallapop.com and sign in.

Export cookies for the site

Export for wallapop.com and save the file. You need __Secure-next-auth.session-token; the CLI also picks up device_id if it is there.

Cookie-Editor feature list with the import and export option

The CLI reads the export with Galleton's cookie parser and detects the format:

Netscape cookies.txt
Cookie-Editor or EditThisCookie JSON, as an array or a {"url", "cookies"} wrapper
a DevTools or Playwright cookie list
a Cookie: header or name=value; name=value pairs
the bare value of __Secure-next-auth.session-token

--cookies-format netscape|json|header overrides the detection. A whole-browser export is fine: only wallapop.com cookies are read, so another site's session cookie is never picked up.

Import it

wallapop auth login --cookies ~/Downloads/cookies.txt

Or run the interactive prompt and paste the cookie value when asked:

wallapop auth login

--cookies-stdin reads until end-of-file; use it when piping an export into the command.

Login validates the session and tells you who you are, so a bad export fails at once rather than three commands later. It also saves your account's location as the default search location. Your first search already works.

Managed sessions

No separate daemon installation or setup is required. Release binaries include Galleton; the CLI starts it when authentication is needed and shares it across CLI, watch, and MCP processes. It shuts down shortly after its last active client exits.

Existing saved cookies migrate automatically on their next authenticated use. After a successful migration, credentials.toml contains a galleton_id and account metadata, not the cookie. A failed migration preserves recovery information. Managed profiles never silently fall back to old cookies.

Plain go install source builds prepare the pinned engine once using Go and the module cache; release binaries and make install already include it.

Staying logged in

wallapop auth status          # local metadata; works offline
wallapop auth status --check  # verify a usable API token
wallapop auth refresh         # explicit renewal; nonzero exit on failure

To renew between commands, explicitly enable a service at OS login:

wallapop auth service enable
wallapop auth service status
wallapop auth service disable

Nothing installs a startup service silently. After a successful wallapop auth login in a terminal, the CLI asks:

keep this login alive in the background? [Y/n]

Enter or y runs wallapop auth service enable; n leaves it off and prints how to turn it on later. --service and --no-service answer without asking (--service also works with --no-input). It is not asked with --no-input, in CI, with WALLAPOP_SESSION_TOKEN, when stdin or stderr is not a terminal, or when the service is already installed.

Without the service, wallapop auth status and wallapop doctor warn when the session cookie from the login expires within 48 hours; the warning does not fail either command. auth service run is the foreground alternative for your own supervisor. auth service stop refuses to stop an engine still in use by another client. Renewal cannot override Wallapop expiry, revocation, or a requirement to log in again; it cannot run while the computer is off.

Proxy

Send all Wallapop traffic, session renewals included, through one proxy:

wallapop config set proxy socks5h://127.0.0.1:1080
WALLAPOP_PROXY=http://user:pass@proxy.lan:3128 wallapop search "bici"

http, https, socks5 and socks5h work; WALLAPOP_PROXY wins over the config. Nothing falls back to a direct connection: an unreachable proxy fails with exit 6, an invalid one with exit 2. config.toml is world-readable, so a proxy with credentials goes in WALLAPOP_PROXY only. wallapop doctor shows the proxy in use, without credentials.

The session engine renews through the same proxy. One already running with another proxy setting is refused, never shared: stop watch and MCP processes, run wallapop auth service stop, and run the command again. auth service enable and watch service install carry WALLAPOP_PROXY into their units and refuse one with credentials; on Windows, set the proxy in config instead.

Blocks

When Wallapop's CloudFront refuses a request with its 403 page, or answers 429, the command exits 5 and the CLI pauses session renewals for 15 minutes, so they do not keep knocking from the same address. The pause survives restarts and shows up as paused_until in wallapop auth service status. Commands keep using a valid access token meanwhile; once it needs renewing they exit 5 until the pause ends. A CloudFront page during renewal itself keeps the session: the engine backs off and retries instead of asking for a new login.

Managed status reports source: "galleton" and the session ID. Cookie expiry is omitted because the daemon does not expose it. The lifecycle and recovery guide documents storage, source builds, failure recovery, and advanced external-daemon settings.

Profiles

Each account gets its own session, location and watches.

wallapop auth login --cookies alt.txt --profile alt
wallapop profile list
wallapop profile use alt      # change the default
wallapop search "bici" --profile alt

In CI

Pass the cookie by environment variable and no credentials file is needed:

export WALLAPOP_SESSION_TOKEN="..."
wallapop search "bici" --format jsonl

Where things live

config.toml

credentials.toml

The CLI writes credentials.toml at mode 0600. It holds managed-session references, not provider cookies. The private galleton directory contains the vault and its local API token and encryption key; do not share that directory.

Log out

wallapop auth logout --profile alt   # keeps config and watches
wallapop profile remove alt          # removes everything for that account

For managed profiles, these commands forget the daemon session first. A daemon outage fails the command without discarding the local reference, so removal can be retried.

On this page