Account, key, secret, team and template commands

Log in, manage profiles, mint and revoke API keys, store secrets, run a team and publish templates.

tangle auth login
tangle keys create ci-agents --budget-usd 25 --expires-in-days 30
printf %s "$OPENAI_API_KEY" | tangle secret create OPENAI_API_KEY --value-stdin
tangle team switch Acme

keys create and keys revoke need an API-key login (tangle auth login --api-key ... or TANGLE_API_KEY). A browser login cannot create or revoke keys. keys talks to Tangle Platform; --platform-url names that host and --base-url still names the Sandbox API.

Commands on this page

Log in and profiles

tangle auth login

Authenticate with browser login, device code, or an API key.

Authenticates and stores a credential for a profile. Default: browser login through a 127.0.0.1 loopback callback; --no-browser: device code; global --api-key: validates the key against GET /v1/account/me and stores it.

tangle auth login [options]

Request: POST /auth/cli/exchange

tangle auth login

• Browser flow: opens <base-url>/auth/cli/login?callback_url=http://127.0.0.1:<port>/callback?state=<nonce>, waits up to 2 minutes, then POST /auth/cli/exchange.
• Device flow: POST /auth/cli/device/start, then polls POST /auth/cli/device/poll at the server interval (default 5 s) for up to 15 minutes.
• --app solve always uses the device flow against the fixed platform host and also opens the prefilled URL unless --no-browser.
• API keys must start with sk_ or sk-tan-; anything else exits 1 before any request.
• Before any interactive login it proves the credential store can write, read and delete a probe value; without an OS keychain it uses ~/.tangle/credentials.json (mode 0600).
• A sandbox login makes the profile active; a solve login does not.
• No JSON document is printed; success lines go to stdout (stderr under --json).

tangle auth logout

Remove stored credentials.

Removes the profile’s stored credential from the OS keychain and the credentials file, keeping its base URL and team settings.

tangle auth logout [options]

tangle auth logout

• Local only; no network request.

tangle auth status

Show current authentication status.

Checks the stored or supplied credential against the sandbox API and probes the platform control plane with the same profile.

tangle auth status [options]

Request: GET /v1/account/me

tangle auth status

• --json prints {authenticated, profile, baseUrl, credentialSource, account, sandbox, platform}; missing credentials print {authenticated:false, reason:'missing_credentials'} and exit 0.
• Exits 1 when the sandbox API or the platform refuses the credential; an unreachable platform still exits 0 and sets platform.reachable=false.
• credentialSource is one of flag, env, keychain, file.

tangle auth profiles list

List configured profiles.

Lists every profile with whether it is active, its base URL and where its credential lives.

tangle auth profiles list

tangle auth profiles list

• --json prints an array of {name, active, hasApiKey, baseUrl, apiKeySource}.

tangle auth profiles use

Set the active profile.

Sets the active profile in ~/.tangle/config.json.

tangle auth profiles use <name>

tangle auth profiles use staging

• Profile names are lowercased and limited to a-z, 0-9, ’.’, ’_’ and ’-’.

tangle auth profiles current

Show the active profile.

Shows the active profile, its base URL and credential source.

tangle auth profiles current

tangle auth profiles current

• --json prints {name, active, baseUrl, credentialSource}.

API keys

tangle keys list

List your active API keys.

Lists your active platform API keys.

tangle keys list [options]

Request: GET /v1/keys

tangle keys list

• Works from a browser login: the CLI exchanges the stored session for a short-lived platform key.
• --platform-url names the platform host; the global --base-url names the sandbox host the session is exchanged at.

tangle keys create

Create a new API key.

Creates a platform API key with optional product, budget, rate and expiry limits and prints the key once.

tangle keys create <name> [options]

Request: POST /v1/keys

tangle keys create ci-agents --budget-usd 25

• Refused before any request when the credential was minted from a browser login; set TANGLE_API_KEY or log in with --api-key.

tangle keys revoke

Revoke an API key.

Revokes a platform API key after confirmation.

tangle keys revoke <keyId> [options]

Request: DELETE /v1/keys/{keyId}

tangle keys revoke key_1

• Confirmation is skipped with --yes (not --force).
• Same minted-credential refusal as keys create.

Secrets

tangle secret create

Create a new secret.

Creates an account secret; the value comes from the argument, from stdin with --value-stdin, or from a hidden prompt.

tangle secret create <name> [value] [options]

Request: POST /v1/secrets

tangle secret create API_KEY

• With neither a value nor --value-stdin it prompts on stderr with echo off: “Enter value for secret ‘<name>’: ”.
• A value argument and --value-stdin together are refused; an empty value is refused.
• Select the secret for a sandbox with tangle sandbox create --secret <name>.

tangle secret list

List all secrets.

Lists secret names with created and updated times; values are never printed.

tangle secret list

Request: GET /v1/secrets

tangle secret list

tangle secret delete

Delete a secret.

Deletes a secret after a y/N confirmation.

tangle secret delete <name> [options]

Request: DELETE /v1/secrets/{name}

tangle secret delete API_KEY

• --force skips the prompt; --json prints {success:true, deleted:<name>}.

Teams

tangle team list

List teams for the current account.

tangle team list [options]

Request: GET /v1/teams

tangle team list

tangle team create

Create a team.

Creates a team and makes it active unless --no-switch.

tangle team create <name> [options]

Request: POST /v1/teams

tangle team create Acme

tangle team switch

Set the active team for the current profile.

Sets the active team (by id or name) for the profile.

tangle team switch <team> [options]

Request: GET /v1/teams/{teamId}

tangle team switch Acme

tangle team current

Show the active team for the current profile.

Shows the profile’s active team.

tangle team current [options]

tangle team current

tangle team clear

Clear the active team for the current profile.

Clears the profile’s active team.

tangle team clear [options]

tangle team clear

tangle team members

List team members.

Lists members of a team (default: the active team).

tangle team members [team] [options]

Request: GET /v1/teams/{teamId}/members

tangle team members

tangle team update-member

Update a team member role.

Changes a member’s role to admin, member or viewer.

tangle team update-member <member-id> [options]

Request: PATCH /v1/teams/{teamId}/members/{memberId}

tangle team update-member mem_1 --role viewer --json

tangle team invite

Invite a user to a team.

Invites an email address to a team with a role (default member).

tangle team invite <email> [options]

Request: POST /v1/teams/{teamId}/invitations

tangle team invite [email protected] --role member

tangle team leave

Leave a team as the current user.

Leaves a team after confirmation.

tangle team leave [team] [options]

Request: POST /v1/teams/{teamId}/leave

tangle team leave

• Skips the confirmation with --force or --json.

tangle team transfer

Transfer team ownership to another active member.

tangle team transfer <new-owner-customer-id> [team] [options]

Request: POST /v1/teams/{teamId}/transfer

tangle team transfer cust_123 --force

tangle team secret list

List team secret names.

Lists team secret names.

tangle team secret list [team] [options]

Request: GET /v1/teams/{teamId}/secrets

tangle team secret list

tangle team secret set

Create or replace a team secret.

Creates or replaces a team secret from the argument or stdin.

tangle team secret set <name> [value] [options]

Request: PUT /v1/teams/{teamId}/secrets/{name}

tangle team secret set NPM_TOKEN

tangle team secret delete

Delete a team secret.

Deletes a team secret after confirmation.

tangle team secret delete <name> [options]

Request: DELETE /v1/teams/{teamId}/secrets/{name}

tangle team secret delete NPM_TOKEN

tangle team secret reveal

Reveal a team secret value.

Prints a team secret’s value.

tangle team secret reveal <name> [options]

Request: POST /v1/teams/{teamId}/secrets/{name}/reveal

tangle team secret reveal NPM_TOKEN

tangle team templates list

List a team’s golden-path templates.

Lists a team’s templates.

tangle team templates list [team] [options]

Request: GET /v1/teams/{teamId}/templates

tangle team templates list

tangle team templates create

Create a golden-path template from a snapshot.

Creates a team template from a snapshot.

tangle team templates create <name> <snapshot-id> [options]

Request: POST /v1/teams/{teamId}/templates

tangle team templates create Node snap_1

tangle team templates delete

Delete a team golden-path template.

Deletes a team template after confirmation.

tangle team templates delete <template-id> [options]

Request: DELETE /v1/teams/{teamId}/templates/{templateId}

tangle team templates delete tpl_1

tangle team invitations

List pending and historical team invitations.

Lists pending and past invitations of a team.

tangle team invitations [team] [options]

Request: GET /v1/teams/{teamId}/invitations

tangle team invitations

tangle team accept

Accept a team invitation.

Accepts an invitation token and makes the team active unless --no-switch.

tangle team accept <token> [options]

Request: POST /v1/teams/invitations/{token}/accept

tangle team accept invite-token

tangle team revoke-invitation

Revoke a pending team invitation.

Revokes a pending invitation.

tangle team revoke-invitation <invitation-id> [options]

Request: DELETE /v1/teams/invitations/{invitationId}

tangle team revoke-invitation inv_1

tangle team remove-member

Remove a member from a team.

Removes a member from a team.

tangle team remove-member <member-id> [options]

Request: DELETE /v1/teams/{teamId}/members/{memberId}

tangle team remove-member mem_1

Templates

tangle template list

Lists public templates, filtered by --query or --tag, or only featured ones.

tangle template list [options]

Request: GET /v1/public-templates

tangle template list --featured

• --featured calls GET /v1/public-templates/featured.
• --json prints {templates:[...]}.

tangle template get

Shows one public template by id or slug.

tangle template get <id-or-slug>

Request: GET /v1/public-templates/{idOrSlug}

tangle template get <id-or-slug>

tangle template versions

Lists a public template’s versions.

tangle template versions <id-or-slug>

Request: GET /v1/public-templates/{idOrSlug}/versions

tangle template versions <id-or-slug>

tangle template publish

Publishes a snapshot of a sandbox as a new public template and waits for the publication job.

tangle template publish <name> <snapshot-id> <sandbox-id> [options]

Request: POST /v1/public-templates

tangle template publish <name> <snapshot-id> <sandbox-id>

• --timeout is in SECONDS here.
• Progress lines ‘Publication <job>: <status>’ go to stderr; Ctrl-C stops waiting, and an interrupted or timed-out job prints the exact --resume-job <id> command to continue.

tangle template publish-version

Publishes a snapshot as a new version of an existing public template.

tangle template publish-version <id-or-slug> <snapshot-id> <sandbox-id> [options]

Request: POST /v1/public-templates/{idOrSlug}/versions

tangle template publish-version <id-or-slug> <snapshot-id> <sandbox-id>

• --timeout is in seconds; same resume behavior as template publish.

Environments

tangle environments list

List available environments.

Lists available environments.

tangle environments list

Aliases: ls

Request: GET /v1/environments

tangle environments list

• Alias: ls.

tangle environments get

Get environment details.

Shows one environment’s details.

tangle environments get <id>

Request: GET /v1/environments

tangle environments get universal

• Fetches the list and selects the id client-side.

Next

• API keys and tokens
• Secrets
• Share sandboxes with your team