Cereal CLI
Sign in, develop tools, and create environment-bound API keys.
npx @trycereal/cli login
npx @trycereal/cli dev
npx @trycereal/cli keys create --name ci --scopes read,control
npx @trycereal/cli logoutCommands that access your organization need a credential, resolved in one order: an explicit
--api-key, then $CEREAL_API_KEY, then the personal token cereal login stored.
The variable beats the file so CI is never accidentally running as a person; the
file beats nothing so a laptop with no variables set works. With none of the
three the CLI refuses to start, naming where a credential comes from.
A key is the environment your laptop's agent and connection are written into,
which is why an environment of your own is the intended target and why there is
no --environment flag anywhere. Every command talks to
https://app.trycereal.ai.
cereal login
npx @trycereal/cli login [--name <machine>] [--no-browser] [--force]Signs this machine in as you: prints a code, opens the control plane's /device
page for you to approve the request, and saves a personal token
in ~/.config/cereal/credentials.json at mode 0600. --force signs in again on a machine that already is.
cereal logout deletes the file first and revokes the token second, because a
token the server cannot be reached to revoke is still one this machine should
stop holding.
cereal dev
Serves your app to a hosted Cereal over an outbound socket. Full walkthrough: local development.
| Flag | Default | |
|---|---|---|
-c, --config <path> | cereal.config.ts, then cereal/agent.ts | the module exporting your defineAgent result |
-n, --name <name> | your git user name | namespace: suffixes the agent slug and the connection |
--api-key <key> | $CEREAL_API_KEY, then the stored token | |
--open | print the control-plane URL for your agent | |
--no-watch | do not re-sync when the definition changes | |
-q, --quiet | do not stream session events |
cereal keys create
npx @trycereal/cli keys create --name ci --scopes read,control [--identity-scopes system:*] [--expires-days 90]Mints a key in the environment the calling credential is in, at the scopes you
name. The default is read,data, a runtime key, since a key that can rewrite an agent
definition should be asked for. The plaintext is printed once, alone on its line so it
can be piped, and never again.
Declarative SDK agents need read,data,control for automatic initialization.
Use narrower keys for direct API operations against existing resources.
Create, list and revoke keys in Settings → API keys. Each key belongs to the selected environment. Switch environments before creating a key for another deployment.