Command-line tool

The orriven CLI is the developer-tools drawer of the console, in a terminal. It logs in as you — never with an API key — so it can do what an Owner or Admin can do in the drawer: generate and revoke keys, register webhook endpoints, read request logs and metrics. It is a single binary for macOS, Linux and Windows.

The CLI manages the developer surface of a Business Unit. It does not create events, tickets or registrations — that is the Developer API, called with the keys the CLI issues.

Install

Homebrew (macOS / Linux)
apt (Debian / Ubuntu)
Windows (scoop)
Script / binaries

brew install orriven/tap/orriven

curl -fsSL https://orriven.github.io/apt/orriven.gpg | sudo tee /usr/share/keyrings/orriven.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/orriven.gpg] https://orriven.github.io/apt stable main" | sudo tee /etc/apt/sources.list.d/orriven.list
sudo apt-get update && sudo apt-get install orriven

scoop bucket add orriven https://github.com/orriven/scoop-bucket
scoop install orriven

Or download the .zip for your architecture from GitHub Releases and put orriven.exe on your PATH.

curl -fsSL https://raw.githubusercontent.com/orriven/cli/main/install.sh | sh

Or download an archive, .deb, .rpm or .apk from GitHub Releases. Every release ships a checksums.txt.

Check it with orriven --version.

Log in

orriven login

The terminal shows a one-time code and opens the console. Compare the code on the page with the one in your terminal, then choose Approve. The terminal is signed in as your account, with your roles. No password is typed in the terminal, so an account that signs in through enterprise SSO logs in the same way.

The session lasts as long as a console session and appears on your account page, where it can be revoked.
orriven logout revokes the session and removes the credential from this machine.
orriven whoami shows the account and the Business Unit the current directory resolves to.

Only approve a code that matches the one in your terminal. Approving a code someone sent you signs their terminal in as you.

Point a project at a Business Unit

cd your-project
orriven init

init logs you in if needed, asks for the organization and the Business Unit, and writes orriven.toml in the current directory. Every command run in that directory — or any directory below it — acts on that Business Unit.

organization = "…"
workspace = "…"

The file holds scope only. It never contains a credential, so it is safe to commit. Credentials stay in your user directory. To point elsewhere, run orriven init --force, or override per command with --workspace <id> (and --org <id>). Every prompt has a non-interactive equivalent. orriven orgs list and orriven workspaces list --org <org> print the candidates, and passing both answers asks nothing:

orriven init --org acme --workspace "Field Marketing"     # id, slug or name

With --non-interactive — implied when CI is set or there is no terminal — the CLI never prompts and reports a usage error where an answer is missing.

API keys

Command	What it does
`orriven keys list`	Active keys. `--all` includes revoked ones.
`orriven keys create <name>`	A secret key. The secret is printed once; store it immediately. `--expires-in 30d` sets a lifetime.
`orriven keys create-publishable <name> --origin https://…`	A publishable key bound to the given origins (repeat `--origin`).
`orriven keys set-origins <key> --origin https://…`	Replace a publishable key’s allowed origins.
`orriven keys revoke <key>`	Revoke immediately. Asks for confirmation; `--yes` skips it.

Keys accept the row id from list or the public key id (ok_… / opk_…). The rules on the API keys page apply unchanged: the secret appears once, one key serves one Business Unit, every action is audited.

Webhooks

Command	What it does
`orriven webhooks events`	The event types an endpoint can subscribe to.
`orriven webhooks create <url> --event registration.confirmed`	Register an endpoint and print its signing secret. `--all-events` subscribes to everything.
`orriven webhooks list`, `orriven webhooks get <id>`	Endpoints, and one endpoint with its secret.
`orriven webhooks update <id> --url … --event … --enable / --disable`	Change an endpoint.
`orriven webhooks ping <id>`	Send a test event through the real signed pipe.
`orriven webhooks deliveries <id>`	The delivery log, newest first. `--status failed` filters.
`orriven webhooks resend <delivery-id>`	Send one delivery again.

Endpoints must be https (plain http is allowed for localhost). Disabling stops deliveries; nothing is deleted.

Request logs and metrics

orriven logs                      # newest requests made with this Business Unit's keys
orriven logs --status 5xx --path /v1/orders
orriven logs --follow             # keep watching
orriven logs --since 1h           # only the last hour
orriven logs get <id>             # one request with its captured bodies
orriven logs get --latest --status 5xx   # the newest failure, in full — no id lookup
orriven metrics --days 7          # requests, error rate, latency; 1, 7 or 30 days

Scripting

--json on any command prints the API’s response unchanged, so the API reference describes the fields.
ORRIVEN_TOKEN, ORRIVEN_ORGANIZATION, ORRIVEN_WORKSPACE and ORRIVEN_API_URL replace the login and the project file in CI. Keep ORRIVEN_TOKEN in a secret store, not in a shell profile.
Outside a terminal, or with --non-interactive, commands never prompt: revoke needs --yes, init needs --org and --workspace.
Command groups accept singular aliases: org, workspace (ws), key, webhook, log.
Exit codes: 1 error, 2 usage, 3 sign-in needed, 4 no Business Unit in scope.

Get started

Reference

Endpoints

Storefront endpoints

Install

Log in

Point a project at a Business Unit

API keys

Webhooks

Request logs and metrics

Scripting

​Install

​Log in

​Point a project at a Business Unit

​API keys

​Webhooks

​Request logs and metrics

​Scripting

​Related

Install

Log in

Point a project at a Business Unit

API keys

Webhooks

Request logs and metrics

Scripting

Related