Command reference

--host <url>

Override the API host for this invocation.

--help, -h

Help for any command.

--version

Print the version.

shortspan login

Authenticate through the browser device flow and store the token in the OS keyring.

shortspan logout

Revoke the token on the server and remove it from the keyring.

shortspan whoami

Show the signed-in user and the host in use.

shortspan org list

Organizations you belong to.

shortspan org use <slug>

Set the active organization.

shortspan project list

Projects in the active organization.

shortspan project use <slug>

Set the active project (stores the resolved id).

shortspan config list

Show the current configuration.

shortspan config get <key>

Print one configuration value.

shortspan config set <key> <value>

Set one configuration value.

shortspan secret list [--group <name>]

List secrets and metadata. Never prints values.

shortspan secret get <key>

Print the plaintext. Requires secrets:reveal.

shortspan secret set <key> [flags]

Create or update a secret.

shortspan secret run <key> -- <cmd...>

Inject one secret into a process without displaying it.

shortspan secret templates

List the available secret templates.

--template <id>

The template to use. See shortspan secret templates.

--value <string>

Provide the value non-interactively. Lands in shell history.

--file <path>

Read the value from a file.

--field key=value

One field of a multi-field template. Repeatable.

--group <name-or-id>

Place the secret in a group.

shortspan secret group list

List groups in the active project.

shortspan secret group create <name>

Create a group. --description, --environment.

shortspan secret group show <name-or-id>

Show a group and its secret keys.

shortspan secret group update <name-or-id>

Rename or re-describe. --name, --description, --environment.

shortspan secret group delete <name-or-id> --force

Delete the group, leaving its secrets ungrouped.

shortspan run <group> -- <cmd...>

Inject every secret in a group into a process's environment.

shortspan run <group> --env K=V -- <cmd...>

Add extra non-secret variables. Repeatable.

shortspan ssh <alias>

Open an interactive SSH session.

shortspan ssh exec <alias\|@tag> <cmd>

Run a command on one server or every server with a tag.

shortspan ssh check <alias> [--json] [--no-upload] [-v]

Check the server matches its runner policy, changing nothing. Exits non-zero if a check fails.

shortspan db <alias>

Open an interactive database session.

shortspan db <alias> --print

Print connection details and a DSN instead of launching a client.

shortspan db <alias> --via <ssh-alias>

Tunnel through an SSH bastion.

shortspan db <alias> --via <ssh-alias> --remote

Run the database client on the server rather than tunnelling.

shortspan aws <alias>

Spawn a subshell with AWS credentials injected.

shortspan aws <alias> --exec "<cmd>"

Run one command with the credentials instead of a subshell.

shortspan k8s <alias>

Spawn a subshell with KUBECONFIG set to the registered config.

shortspan profile list

List infrastructure profiles in the active project.

shortspan profile enter <name>

Show every resource a profile grants and how to reach it.

shortspan runbook list

List runbooks in the active project.

shortspan runbook show <name>

Print the steps without running them.

shortspan runbook check <name> [--json] [--no-upload] [-v]

Check every step can run on its target, without running any.

shortspan runbook run <name>

Execute a runbook, or request approval if it requires one.

shortspan access request --reason "..." [--duration 8]

Request temporary access to the active project.

shortspan access list

List pending access requests. Admin only.

shortspan access approve <request-id>

Approve a request. Admin only.

shortspan access deny <request-id>

Deny a request. Admin only.

shortspan token list

List your API tokens and when each was last used.

shortspan token create <name> [--abilities ...]

Mint a token. Shown once, never again.

shortspan token revoke <token-id>

Revoke a token immediately.

shortspan version

Print the version, commit, and build date.

shortspan upgrade [--check]

Install the current release, or report whether one exists.

SHORTSPAN_TOKEN

Use this token instead of the OS keyring.

SHORTSPAN_API_HOST

Override the configured host.

SHORTSPAN_NO_UPDATE_CHECK

Suppress the background update notice.

0

Success.

1

The CLI failed - not authenticated, not found, permission denied.

*n*

A wrapped process's own exit code, passed through unchanged.