Skip to main content
When .revyl/config.yaml declares session.before_script and/or session.auth_bypass, revyl device start (and revyl dev) apply them automatically. You do not pass tokens on the command line. For the app-side deep-link contract and mint-script shape, see Auth Bypass Deep Links. This page covers what the CLI does on device start.

​
Attach Order On revyl device start

Every start goes through the same pipeline:
  1. Resolve project config from the current working directory by walking up to the nearest directory that owns .revyl/, then loading .revyl/config.yaml.
  2. Run session.before_script (if configured). The script must finish before the device boots. KEY=VALUE lines on stdout become session-scoped launch environment for this start only. A non-zero exit aborts start — Revyl will not boot an unprepared app.
  3. Apply session.auth_bypass.launch_vars. The CLI adds the configured org launch-variable keys to the explicit and inherited keys selected for this start. Keys that the before script already printed as inline values are not also looked up in org state.
  4. Boot the device with that launch environment fixed for the session. For iOS, selected --launch-arg-set values are flattened in flag order and inline --launch-arg tokens are appended. These explicit tokens are placed before legacy -KEY value pairs. Android rejects explicit arguments.
  5. Fire session.auth_bypass.deep_link (if configured and you did not pass --app-link). Placeholder substitution must use either only before-script values or only org launch variables — never a mix.

​
Config Reminder

Both settings live under the session section:
One produces values; the other consumes them. Full script contract: Mint The Token Per Session.

​
Working Directory Matters

Config is found by walking up from your cwd to a parent that owns .revyl/. In a monorepo where the Revyl project lives in a subdirectory (for example ios/.revyl/config.yaml), run device commands from that project directory (or below it):
If you start from the monorepo root and there is no root-level .revyl/, the CLI will not load the nested config — session.before_script and session.auth_bypass are skipped silently.

​
Overrides And Precedence

Launch environment is fixed at boot. revyl dev auth refresh re-fires the deep link with the same boot values; it does not remint. If the token expired, stop and start again so the before script runs fresh.

​
What Does Not Run session.before_script

The PR preview link in a GitHub comment has no checkout, so it cannot run your mint script. That path still uses organization launch variables only. Keep org vars fresh if reviewers rely on the preview link being signed in; proof agents and local revyl device start use the before script instead.

​
Verify

revyl dev status reports the runtime before_session key names and state only — never token values.