apivault login now records and prints the date your device token expires, matching the 90-day lifetime the server applies to newly approved CLI connections.

apivault whoami shows that date and highlights it in yellow with a renewal reminder once fewer than 14 days remain. apivault --json whoami adds a tokenExpiresAt field.

#Clearer errors

Rejected requests: an expired token reports the date it lapsed, and a missing or revoked one says so.
Rate limits: wrong vault keys are throttled by the server, so keys get --reveal, keys add, env export, and run now tell you how long to wait, such as "try again in 7m".
No arguments: running apivault alone distinguishes an expired token from being signed out.

#Fixes

--project and apivault projects use now accept a project slug as well as an ID.
The CLI's local key masking now matches the web app's, so a locally masked value and a server preview can't render differently.

Learn more in the login command reference.