CLI
Manage projects and credentials from your terminal with npx @moq/pro.
Install Node 22 or later. Run npx @moq/pro login, open the printed URL, check the code and permissions, then approve it in your browser. The CLI stores the revocable account token in your platform config directory with mode 0600. Tokens are saved separately for each API endpoint. MOQ_TOKEN takes precedence over saved credentials; logout revokes the saved token and removes it, leaving MOQ_TOKEN alone. Revoke other tokens in account settings.
For staging or local development, set MOQ_ENDPOINT or pass --endpoint http://localhost:PORT/v1. The endpoint includes /v1.
Request a token for another tool
Use token request when an agent prepares a named, scoped account token for a human to approve. Approval uses the same signed-in browser and terminal code check as login, and stays available for one hour. The resulting token keeps the requested name in account settings and expires after 90 days, like a login token.
token request exits immediately: stdout contains a short handle, and stderr contains the approval link and code. Keep the handle to collect that request later:
sh
HANDLE=$(npx @moq/pro token request --name "agent MOQ_PRO_TOKEN" --scope write --projects "$PID")
# Ask the human to open the printed link and confirm the code and permissions.
# After approval, pipe the token directly to its consumer:
npx @moq/pro token wait "$HANDLE" | wrangler secret put MOQ_PRO_TOKENOmit --projects to request all current and future projects the account can access. token wait without a handle selects the sole pending request for the selected endpoint; multiple requests require an explicit handle. Use the same --endpoint or MOQ_ENDPOINT for both commands.
token request --wait requests and waits in one call. Both waiting forms print only the token on stdout, including with --json. They never replace the CLI's saved login or change MOQ_TOKEN. Pending device codes stay in separate mode-0600 files in the platform config directory; waiting removes its file on successful collection, denial, or expiry. An interrupted wait can resume with the same handle. A denied or expired request exits nonzero without stdout.
Command reference
Generated from the CLI's own --help.
text
Usage: moq-pro <command> [options]
Commands:
login Approve a device code in your browser
logout Revoke and remove this endpoint's saved credential
projects [list] List one page of projects
projects create Create a project (--data JSON, default {})
projects get|delete PID Inspect or delete a project
keys [list] PID List signing keys
keys create PID Create an HS256 key (--data JSON overrides)
keys disable|enable PID KID Change signing-key admission
keys delete PID KID Delete a disabled signing key
token request --name NAME Request an account token for another tool
token wait [HANDLE] Print the approved token once, without saving login
token publish|watch PID KID PATH --expires TIME
Mint a scoped relay URL
recordings [list] PID List recordings
webhooks [list] PID List webhooks
webhooks create PID Create a webhook (--data JSON required)
webhooks delete PID ID Delete a webhook
usage PID Read one page of usage
api METHOD /v1/PATH[?QUERY] Call a known customer OpenAPI operation
Options:
--endpoint URL API base including /v1 (MOQ_ENDPOINT;
default https://api.moq.pro/v1)
--json JSON output (also the default off a TTY)
--data JSON Request body, or @FILE to read a JSON file
--idempotency-key KEY Reuse this key and identical input to retry
a create across separate invocations
--limit N --cursor CURSOR Page size and continuation for lists
--period PERIOD --from TIME --to TIME
Usage filters (RFC 3339)
--name NAME Requested token name (1 to 100 characters)
--scope PERMISSIONS Login or request permissions: read, write, or
FAMILY:LEVEL entries, comma-separated, such
as write,billing:read (default write)
--projects PID,PID Restrict login or request to these projects
--wait Request and wait in one command
--relay URL Relay base for token (default https://cdn.moq.pro)
--help Show this reference
MOQ_TOKEN overrides the saved account token for the selected endpoint.
Creates get a random idempotency key unless explicitly supplied. Save and reuse
--idempotency-key with the exact same request bytes after an uncertain outcome.
Lists return one page with nextCursor; continue with --cursor. Errors go to
stderr with a nonzero exit status. Login never approves its own device code. Its
token expires; run login again when told you are logged out.
Device requests expire after one hour. token request prints a handle on stdout
and the approval URL/code on stderr; token wait and token request --wait print
only the token on stdout, even with --json. Neither saves a login credential.
Quickstart:
npx @moq/pro login
npx @moq/pro projects create --idempotency-key quickstart-cli-project-1 --json
# Set PID to the returned id.
npx @moq/pro keys create "$PID" --idempotency-key quickstart-cli-key-1 --json
# Set KID to the returned id, and EXPIRES to an RFC 3339 time one hour ahead.
npx @moq/pro token publish "$PID" "$KID" hello.hang --expires "$EXPIRES" \
--idempotency-key "quickstart-cli-mint-$EXPIRES" --jsonRetry a create
Reuse one explicit key and identical input across invocations after an uncertain outcome. Choose a new key for each independent create. The API retains replay results for 24 hours. The default random key protects internal retries within one invocation; it does not deduplicate separate commands.
sh
npx @moq/pro projects create --data '{"name":"example"}' --idempotency-key example-project-1 --json
# Repeat the exact command if its outcome is unknown.
npx @moq/pro projects create --data '{"name":"example"}' --idempotency-key example-project-1 --jsonList commands return one page and nextCursor. Supply that cursor with the same filters to continue. Use --json for machine output; redirected output is always JSON. Refusals retain the API's code/message on stderr and exit nonzero. The quickstart shows the setup flow.