The unkey CLI

The unkey CLI manages Unkey resources from your terminal. Use a resource followed by an action, such as unkey projects list, unkey keys create, or unkey deployments get. Nearly every bearer-authenticated API endpoint has a matching command. Customer portal end-user endpoints use a portal session and aren’t exposed by the CLI. Sign in once, then run a resource command:

unkey login
unkey projects list

The default output is for reading in a terminal. Use --json for scripts and pipes. See Output formats. Delete and remove commands also require confirmation. Review the target in the terminal prompt, or pass --yes explicitly in scripts. See Confirm destructive commands.

The CLI is early and best effort. Commands, flags, and output can change without notice. The HTTP API is versioned and stable, so use the API for scripts that must not break.

Command shape

Commands look like unkey <resource> <action> [flags]. Subresources add a level, such as unkey environments variables list or unkey keys permissions add. unkey --help, unkey projects list --help, and unkey help projects list print usage. unkey version and unkey --version print the installed CLI version. Resource commands share authentication, output, debugging, and raw-body flags. See CLI output and shared flags for their behavior and syntax. The legacy unkey api <group> <command> paths remain available for compatibility. These pages teach the resource paths without changing their existing documentation URLs.

Command groups

Each resource command has its own page in the CLI section of its product.

Compute

, deployments, domains, , gateway policies, and the GitHub App installation are Compute resources.

Group	What it manages
`unkey projects`	Create, read, update, and delete workspace
`unkey apps`	Create, read, update, and delete apps within projects
`unkey environments`	Environments, variables, and settings
`unkey deployments`	Create and control deployments
`unkey domains`	Create, read, , and delete custom domains
`unkey gateway policies`	List, replace, and update gateway policies
`unkey github`	GitHub App installations
`unkey analytics`	`analytics gateway-requests` and `analytics runtime-logs` query gateway and runtime data

API Management

Keyspaces, keys, identities, permissions and roles, , and the customer portal are API Management resources.

Group	What it manages
`unkey apis`	Keyspaces (the API namespaces keys belong to)
`unkey keys`	Create, list, , update, and delete keys and their permissions and roles
`unkey identities`	Identities that group keys
`unkey permissions`	Permissions
`unkey roles`	Roles and their permissions
`unkey ratelimit`	Rate limit checks and overrides
`unkey portals`	Customer portals and their sessions
`unkey analytics`	`analytics verifications` and `analytics ratelimits` query key and rate limit data

analytics appears in both tables because two of its commands read Compute data and two read API Management data.

Top-level commands

Authentication, deployment, health checks, and the CLI version have their own command forms.

Command	Product	What it does
`unkey deploy <image>`	Compute	Deploys a prebuilt container image to a project and waits until the deployment is active. Needs `--project` (or `UNKEY_PROJECT`). Uses `--root-key`, then `UNKEY_ROOT_KEY`, then `unkey login`. Reference: unkey deploy.
`unkey login`	Platform	Signs you in with a device code and stores a CLI session. `--root-key=-` stores an existing root key instead. Reference: unkey login.
`unkey logout`	Platform	Revokes the active CLI session.
`unkey whoami`	Platform	Shows which credential the CLI uses and whether it works. Same as `unkey auth status`. See CLI authentication.
`unkey workspace switch`	Platform	Changes the active signed-in workspace.
`unkey auth login`	Platform	Same command and flags as unkey login.
`unkey healthcheck <url>`	Compute	Sends one HTTP GET and exits 0 on a 200 response, or 1 otherwise. Useful in CI and monitoring scripts. Reference: unkey healthcheck.
`unkey version`	Platform	Prints the installed CLI version to stdout, the same as `unkey --version`.

unkey version does not manage deployments. To inspect, list, or roll back deployments, use deployments get, deployments list, or deployments rollback.

Next steps

Install the CLI

npm package or GitHub release.

CLI authentication

Where the root key comes from and in which order.

Output and shared flags

Human output, --json, --debug, and request flags.

Get started

Workspace

Audit logs

Billing

Root keys

API

CLI

AI coding

Security

Errors

Command shape

Command groups

Compute

API Management

Top-level commands

Next steps

Install the CLI

CLI authentication

Output and shared flags