auth

`wallapop auth`

Import a browser session for the active profile

wallapop auth login [flags]

Import a browser session for the active profile.

Wallapop keeps the durable login in an HttpOnly cookie, so the CLI needs a cookie export from a browser where you are logged in:

Install a cookie export extension (Cookie-Editor works) and open es.wallapop.com.
Export the cookies, or copy the value of the cookie named __Secure-next-auth.session-token.
Run this command and paste the file path or the value when asked, or pass --cookies FILE / --cookies-stdin.

These exports work, and the format is detected (--cookies-format overrides it): Netscape cookies.txt, Cookie-Editor or EditThisCookie JSON (an array or a {"url", "cookies"} wrapper), a DevTools or Playwright cookie list, a Cookie: header or a=b; c=d pairs, or the bare session cookie value. A whole-browser export is fine: only wallapop.com cookies are read.

The CLI starts its bundled Galleton session engine automatically. The engine renews tokens and stores rotated cookies in its encrypted private vault. Nothing else from the export is kept. Google, Apple and Facebook accounts work the same way, since the cookie is what the browser holds after any login method.

In a terminal, a successful login then asks whether to keep it alive in the background, which is the same as running "wallapop auth service enable". --service answers yes and --no-service answers no without asking; with --no-input, in CI or with WALLAPOP_SESSION_TOKEN it is not asked.

wallapop auth login
wallapop auth login --cookies ~/Downloads/es.wallapop.com_cookies.txt --profile work
wallapop auth login --cookies ~/Downloads/cookies.json
cat cookies.txt | wallapop auth login --cookies-stdin
wallapop auth login --cookies cookies.txt --no-input --service

Flag	Type	Default	Description
`--cookies`	string	-	path to a cookie export (cookies.txt, Cookie-Editor JSON, Cookie header)
`--cookies-format`	string	`auto`	cookie export format: auto, netscape, json, header
`--cookies-stdin`	bool	`false`	read the cookie export from stdin
`--no-service`	bool	`false`	do not enable background renewal and do not ask
`--service`	bool	`false`	enable background renewal after the login without asking

`wallapop auth logout`

Forget the active profile's session (keeps watches and config)

wallapop auth logout [flags]

Flag	Type	Default	Description
`--yes`	bool	`false`	accepted for symmetry; logout never prompts

`wallapop auth refresh`

Renew the session through the managed engine

wallapop auth refresh

Renew the session through the managed engine.

Galleton owns credential rotation and persistence. A refresh can still fail when Wallapop revokes the session or requires a new browser login. Enable unattended renewal explicitly with "wallapop auth service enable".