Skip to main content
The Phaseo CLI is distributed as @phaseo/cli. It connects coding harnesses to Phaseo and provides a first-party terminal workflow for the Phaseo control plane. Use it when you want to:
  • sign in as a real Phaseo user from a local shell, remote shell, or agent runtime
  • create and rotate API keys or management keys
  • manage workspaces, presets, settings, and guardrails
  • use first-party CLI OAuth while user-owned OAuth apps remain in private testing
  • inspect models, providers, pricing, credits, activity, analytics, and generations

​
Install

​
Check the installed version

  • phaseo --version prints the installed version.
  • phaseo version prints the version plus the recommended update command for the current package manager.
  • interactive runs also show an update hint when a newer published version is available.
The older phaseo command remains available as a compatibility alias.

​
Sign in

Start with:
The CLI supports two first-party flows:
  • Sign in with Phaseo: browser OAuth with authorization code + PKCE
  • Sign in with Device Code: best for SSH, CI, headless shells, and agent environments
You can force either path:
Remote and non-interactive environments automatically prefer device code.

​
Terminal output

Interactive terminals receive Phaseo’s colour, hierarchy, and ephemeral setup spinners. Spinners use stderr and clear their line when work completes. Non-TTY stderr and TERM=dumb disable animation; NO_COLOR disables colour. Commands using --json always return decoration-free structured output for agents and automation. Use FORCE_COLOR=1 only when a terminal wrapper supports colour but does not report itself as a TTY.

​
Confirm who you are

This returns your current Phaseo user, scopes, active workspace, and available workspaces.

​
Create keys

Use --json when an agent or automation needs the raw created key once.

​
Manage workspaces and guardrails

The CLI is intended to cover the useful parts of the Phaseo dashboard and management APIs from the terminal.

​
OAuth apps

Phaseo uses one OAuth authorization server for the first-party CLI, user-created applications, and dynamically registered MCP clients. The CLI uses browser or device login with rotating refresh tokens. Third-party clients use authorization code with PKCE, explicit scopes and workspace consent, revocable delegated access tokens, and optional protected-resource binding. The hosted Phaseo API enables third-party OAuth. Self-hosted or preview API deployments keep it disabled unless PHASEO_THIRD_PARTY_OAUTH_ENABLED is set to a truthy value. Accepted truthy values are 1, true, yes, and on, matched case-insensitively after trimming whitespace. Enabling it exposes user-created OAuth app management and dynamic client registration, so pair it with reviewed redirect URI, consent, client-secret, rate-limit, and workspace authorization configuration.
.env
Docker
Kubernetes

​
Security model

  • CLI sessions require OS-backed secure storage by default. Set PHASEO_SESSION_BACKEND=file only as an explicit opt-in when an OS credential store is unavailable; it stores refresh tokens in a permission-restricted plaintext file.
  • phaseo logout revokes the stored refresh token before clearing local state.
  • Management keys require explicit capabilities.
  • Regular inference keys rely on guardrails, routing policies, and workspace settings rather than a separate scope model.

​
Update

​
Next steps

Last modified on August 14, 2026