# CLI Manage projects and credentials from your terminal with `npx @moq/pro`. Install Node 22 or later. Run `npx @moq/pro login`, open the printed URL, check the code and permissions, then approve it in your browser. The CLI stores the revocable account token in your platform config directory with mode 0600. Tokens are saved separately for each API endpoint. `MOQ_TOKEN` takes precedence over saved credentials; `logout` revokes the saved token and removes it, leaving `MOQ_TOKEN` alone. Revoke other tokens in [account settings](https://moq.pro/settings/tokens). For staging or local development, set `MOQ_ENDPOINT` or pass `--endpoint http://localhost:PORT/v1`. The endpoint includes `/v1`. ## Request a token for another tool Use `token request` when an agent prepares a named, scoped account token for a human to approve. Approval uses the same signed-in browser and terminal code check as login, and stays available for one hour. The resulting token keeps the requested name in account settings and expires after 90 days, like a login token. `token request` exits immediately: stdout contains a short handle, and stderr contains the approval link and code. Keep the handle to collect that request later: ```sh HANDLE=$(npx @moq/pro token request --name "agent MOQ_PRO_TOKEN" --scope write --projects "$PID") # Ask the human to open the printed link and confirm the code and permissions. # After approval, pipe the token directly to its consumer: npx @moq/pro token wait "$HANDLE" | wrangler secret put MOQ_PRO_TOKEN ``` Omit `--projects` to request all current and future projects the account can access. `token wait` without a handle selects the sole pending request for the selected endpoint; multiple requests require an explicit handle. Use the same `--endpoint` or `MOQ_ENDPOINT` for both commands. `token request --wait` requests and waits in one call. Both waiting forms print only the token on stdout, including with `--json`. They never replace the CLI's saved login or change `MOQ_TOKEN`. Pending device codes stay in separate mode-0600 files in the platform config directory; waiting removes its file on successful collection, denial, or expiry. An interrupted wait can resume with the same handle. A denied or expired request exits nonzero without stdout. ## Command reference Generated from the CLI's own `--help`. ```text Usage: moq-pro [options] Commands: login Approve a device code in your browser logout Revoke and remove this endpoint's saved credential projects [list] List one page of projects projects create Create a project (--data JSON, default {}) projects get|delete PID Inspect or delete a project keys [list] PID List signing keys keys create PID Create an HS256 key (--data JSON overrides) keys disable|enable PID KID Change signing-key admission keys delete PID KID Delete a disabled signing key token request --name NAME Request an account token for another tool token wait [HANDLE] Print the approved token once, without saving login token publish|watch PID KID PATH --expires TIME Mint a scoped relay URL recordings [list] PID List recordings webhooks [list] PID List webhooks webhooks create PID Create a webhook (--data JSON required) webhooks delete PID ID Delete a webhook usage PID Read one page of usage api METHOD /v1/PATH[?QUERY] Call a known customer OpenAPI operation Options: --endpoint URL API base including /v1 (MOQ_ENDPOINT; default https://api.moq.pro/v1) --json JSON output (also the default off a TTY) --data JSON Request body, or @FILE to read a JSON file --idempotency-key KEY Reuse this key and identical input to retry a create across separate invocations --limit N --cursor CURSOR Page size and continuation for lists --period PERIOD --from TIME --to TIME Usage filters (RFC 3339) --name NAME Requested token name (1 to 100 characters) --scope PERMISSIONS Login or request permissions: read, write, or FAMILY:LEVEL entries, comma-separated, such as write,billing:read (default write) --projects PID,PID Restrict login or request to these projects --wait Request and wait in one command --relay URL Relay base for token (default https://cdn.moq.pro) --help Show this reference MOQ_TOKEN overrides the saved account token for the selected endpoint. Creates get a random idempotency key unless explicitly supplied. Save and reuse --idempotency-key with the exact same request bytes after an uncertain outcome. Lists return one page with nextCursor; continue with --cursor. Errors go to stderr with a nonzero exit status. Login never approves its own device code. Its token expires; run login again when told you are logged out. Device requests expire after one hour. token request prints a handle on stdout and the approval URL/code on stderr; token wait and token request --wait print only the token on stdout, even with --json. Neither saves a login credential. Quickstart: npx @moq/pro login npx @moq/pro projects create --idempotency-key quickstart-cli-project-1 --json # Set PID to the returned id. npx @moq/pro keys create "$PID" --idempotency-key quickstart-cli-key-1 --json # Set KID to the returned id, and EXPIRES to an RFC 3339 time one hour ahead. npx @moq/pro token publish "$PID" "$KID" hello.hang --expires "$EXPIRES" \ --idempotency-key "quickstart-cli-mint-$EXPIRES" --json ``` ## Retry a create Reuse one explicit key and identical input across invocations after an uncertain outcome. Choose a new key for each independent create. The API retains replay results for 24 hours. The default random key protects internal retries within one invocation; it does not deduplicate separate commands. ```sh npx @moq/pro projects create --data '{"name":"example"}' --idempotency-key example-project-1 --json # Repeat the exact command if its outcome is unknown. npx @moq/pro projects create --data '{"name":"example"}' --idempotency-key example-project-1 --json ``` List commands return one page and `nextCursor`. Supply that cursor with the same filters to continue. Use `--json` for machine output; redirected output is always JSON. Refusals retain the API's code/message on stderr and exit nonzero. The [quickstart](/quickstart) shows the setup flow.