2. Authorize & pull

bun pull is how the project learns about your organisation. On its first run it also authorizes this directory and mints an API key.

Run the first pull


bun pull

The first time, this:

Opens a browser tab to authorize this directory against your Zodiac workspace. (No Zodiac account yet? The browser walks you through sign-up first.)
Mints a Zodiac API key and writes it to .env in the project root.
Fetches your workspace’s users and accounts and generates typed codegen under .zodiac/.

.env holds your ZODIAC_API_KEY and is already in .gitignore. Don’t commit it, and don’t paste the key into any file that gets checked in.

What the pull gives you

After a successful pull, the codegen knows your workspace’s shape. That means your editor can autocomplete:

Workspace names and chain ids
Account labels (existing Safes in your workspace)
Role labels and user handles

So when you write eth.safe["GG Treasury"] or eth.user["alice"] in the next steps, those strings are type-checked against your real org — a typo is a compile error, not a silent mistake.

The two pull commands

Command	What it does
`bun pull`	Refresh everything — org data and contract ABIs.
`bun pull-org`	Just org data (users, accounts).
`bun pull-contracts`	Just contract ABIs and the `allow` kit — run after editing `zodiac.config.ts`.

You’ll use bun pull again in the next step, after you add the contracts you want to permission → Add your contracts.