> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orriven.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Command-line tool

> Install the orriven CLI, log in with your console account, and manage API keys, webhooks, request logs and metrics from the terminal.

The **orriven CLI** is the developer-tools drawer of the console, in a terminal. It logs in as **you** — never with an API key — so it can do what an Owner or Admin can do in the drawer: generate and revoke keys, register webhook endpoints, read request logs and metrics. It is a single binary for macOS, Linux and Windows.

<Info>
  The CLI manages the **developer surface** of a Business Unit. It does not create events, tickets or registrations — that is the [Developer API](/en/developers/overview), called with the keys the CLI issues.
</Info>

## Install

<Tabs>
  <Tab title="Homebrew (macOS / Linux)">
    ```bash theme={null}
    brew install orriven/tap/orriven
    ```
  </Tab>

  <Tab title="apt (Debian / Ubuntu)">
    ```bash theme={null}
    curl -fsSL https://orriven.github.io/apt/orriven.gpg | sudo tee /usr/share/keyrings/orriven.gpg >/dev/null
    echo "deb [signed-by=/usr/share/keyrings/orriven.gpg] https://orriven.github.io/apt stable main" | sudo tee /etc/apt/sources.list.d/orriven.list
    sudo apt-get update && sudo apt-get install orriven
    ```
  </Tab>

  <Tab title="Windows (scoop)">
    ```powershell theme={null}
    scoop bucket add orriven https://github.com/orriven/scoop-bucket
    scoop install orriven
    ```

    Or download the `.zip` for your architecture from [GitHub Releases](https://github.com/orriven/cli/releases) and put `orriven.exe` on your `PATH`.
  </Tab>

  <Tab title="Script / binaries">
    ```bash theme={null}
    curl -fsSL https://raw.githubusercontent.com/orriven/cli/main/install.sh | sh
    ```

    Or download an archive, `.deb`, `.rpm` or `.apk` from [GitHub Releases](https://github.com/orriven/cli/releases). Every release ships a `checksums.txt`.
  </Tab>
</Tabs>

Check it with `orriven --version`.

## Log in

```bash theme={null}
orriven login
```

The terminal shows a one-time code and opens the console. **Compare the code on the page with the one in your terminal**, then choose **Approve**. The terminal is signed in as your account, with your roles. No password is typed in the terminal, so an account that signs in through [enterprise SSO](/en/organization/members-roles) logs in the same way.

* The session lasts as long as a console session and appears on your account page, where it can be revoked.
* `orriven logout` revokes the session and removes the credential from this machine.
* `orriven whoami` shows the account and the Business Unit the current directory resolves to.

<Warning>
  Only approve a code that matches the one in **your** terminal. Approving a code someone sent you signs *their* terminal in as you.
</Warning>

## Point a project at a Business Unit

```bash theme={null}
cd your-project
orriven init
```

`init` logs you in if needed, asks for the organization and the Business Unit, and writes `orriven.toml` in the current directory. Every command run in that directory — or any directory below it — acts on that Business Unit.

```toml theme={null}
organization = "…"
workspace = "…"
```

The file holds **scope only**. It never contains a credential, so it is safe to commit. Credentials stay in your user directory. To point elsewhere, run `orriven init --force`, or override per command with `--workspace <id>` (and `--org <id>`).

Every prompt has a non-interactive equivalent. `orriven orgs list` and `orriven workspaces list --org <org>` print the candidates, and passing both answers asks nothing:

```bash theme={null}
orriven init --org acme --workspace "Field Marketing"     # id, slug or name
```

With `--non-interactive` — implied when `CI` is set or there is no terminal — the CLI never prompts and reports a usage error where an answer is missing.

## API keys

| Command                                                     | What it does                                                                                            |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| `orriven keys list`                                         | Active keys. `--all` includes revoked ones.                                                             |
| `orriven keys create <name>`                                | A secret key. The secret is printed **once**; store it immediately. `--expires-in 30d` sets a lifetime. |
| `orriven keys create-publishable <name> --origin https://…` | A publishable key bound to the given origins (repeat `--origin`).                                       |
| `orriven keys set-origins <key> --origin https://…`         | Replace a publishable key's allowed origins.                                                            |
| `orriven keys revoke <key>`                                 | Revoke immediately. Asks for confirmation; `--yes` skips it.                                            |

Keys accept the row id from `list` or the public key id (`ok_…` / `opk_…`). The rules on the [API keys](/en/developers/api-keys) page apply unchanged: the secret appears once, one key serves one Business Unit, every action is audited.

## Webhooks

| Command                                                               | What it does                                                                                |
| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| `orriven webhooks events`                                             | The event types an endpoint can subscribe to.                                               |
| `orriven webhooks create <url> --event registration.confirmed`        | Register an endpoint and print its signing secret. `--all-events` subscribes to everything. |
| `orriven webhooks list`, `orriven webhooks get <id>`                  | Endpoints, and one endpoint with its secret.                                                |
| `orriven webhooks update <id> --url … --event … --enable / --disable` | Change an endpoint.                                                                         |
| `orriven webhooks ping <id>`                                          | Send a test event through the real signed pipe.                                             |
| `orriven webhooks deliveries <id>`                                    | The delivery log, newest first. `--status failed` filters.                                  |
| `orriven webhooks resend <delivery-id>`                               | Send one delivery again.                                                                    |

Endpoints must be `https` (plain `http` is allowed for `localhost`). Disabling stops deliveries; nothing is deleted.

## Request logs and metrics

```bash theme={null}
orriven logs                      # newest requests made with this Business Unit's keys
orriven logs --status 5xx --path /v1/orders
orriven logs --follow             # keep watching
orriven logs --since 1h           # only the last hour
orriven logs get <id>             # one request with its captured bodies
orriven logs get --latest --status 5xx   # the newest failure, in full — no id lookup
orriven metrics --days 7          # requests, error rate, latency; 1, 7 or 30 days
```

## Scripting

* `--json` on any command prints the API's response unchanged, so the [API reference](/en/developers/api-reference) describes the fields.
* `ORRIVEN_TOKEN`, `ORRIVEN_ORGANIZATION`, `ORRIVEN_WORKSPACE` and `ORRIVEN_API_URL` replace the login and the project file in CI. Keep `ORRIVEN_TOKEN` in a secret store, not in a shell profile.
* Outside a terminal, or with `--non-interactive`, commands never prompt: `revoke` needs `--yes`, `init` needs `--org` and `--workspace`.
* Command groups accept singular aliases: `org`, `workspace` (`ws`), `key`, `webhook`, `log`.
* Exit codes: `1` error, `2` usage, `3` sign-in needed, `4` no Business Unit in scope.

## Related

* [Agents](/en/agent/overview) — Model Context Protocol (MCP) server for AI agent integrations
* [API keys](/en/developers/api-keys)
* [Developer API overview](/en/developers/overview)
* [Storefront API](/en/developers/storefront)