Complete reference for the Keystore CLI. Manage agents, keys, providers, and monitor usage from the terminal.

CLI Reference

The Keystore CLI (@keystore/cli) lets you manage your Keystore organization, agents, API keys, and providers from the terminal.

Installation

bash

npm install -g @keystore/cli

After installing, the keystore command is available globally.

Authentication

`keystore signup`

Create a new Keystore account. Prompts for email, password, and organization name.

bash

keystore signup
# Email: you@company.com
# Password: ********
# Organization name: Acme Corp
# Account created. Logged in as you@company.com

`keystore login`

bash

keystore login
# Email: you@company.com
# Password: ********
# Logged in as you@company.com

`keystore whoami`

Show the currently authenticated user and organization.

bash

keystore whoami
# Email: you@company.com
# Org:   org_abc123

`keystore logout`

Clear stored credentials.

bash

keystore logout
# Logged out

Project Setup

`keystore init`

Initialize a .keystore project config file in the current directory. Prompts for a project name and default providers.

bash

keystore init
# Project name: my-agent
# Default providers (comma-separated, e.g. openai,anthropic): openai,anthropic
# Created .keystore config for "my-agent"

This creates a .keystore file:

json

{
  "project": "my-agent",
  "providers": ["openai", "anthropic"]
}

Agent Management

`keystore agents list`

List all agents in your organization with their status, budget, and rate limits.

bash

keystore agents list
# ID            Name           Status   Budget   RPM   RPD
# ag_abc123     my-agent       active   $100     60    1000
# ag_def456     test-agent     paused   --       --    --

`keystore agents create`

Create a new agent interactively. Prompts for name, monthly budget, and rate limits. Returns an agent token that starts with ks_.

bash

keystore agents create
# Agent name: my-agent
# Monthly budget (USD, blank for none): 100
# Requests per minute (blank for none): 60
# Requests per day (blank for none): 1000
# Agent "my-agent" created
#
#   Agent token: ks_a1b2c3d4e5f6...
#   Save this token -- it won't be shown again.

`keystore agents delete <id>`

Delete an agent. Prompts for confirmation.

bash

keystore agents delete ag_abc123
# Delete agent ag_abc123? (y/n) y
# Agent ag_abc123 deleted

`keystore agents pause <id>`

Pause an agent. Paused agents cannot make requests through the proxy.

bash

keystore agents pause ag_abc123
# Agent ag_abc123 paused

`keystore agents resume <id>`

Resume a paused agent.

bash

keystore agents resume ag_abc123
# Agent ag_abc123 resumed

API Key Management

`keystore keys create`

Create a new API key. Keys can have admin or agent scope.

bash

keystore keys create
# Key name: deploy-key
# Scope (admin/agent, default admin): admin
# API key created
#
#   Secret: sk_live_abc123...
#   Save this -- it won't be shown again.

`keystore keys list`

List all API keys with their prefix and scope.

bash

keystore keys list
# ID            Name          Prefix        Scope
# key_abc123    deploy-key    sk_live_ab    admin
# key_def456    ci-key        sk_live_de    agent

`keystore keys revoke <id>`

Revoke an API key. Prompts for confirmation.

bash

keystore keys revoke key_abc123
# Revoke key key_abc123? (y/n) y
# Key key_abc123 revoked

Provider Management

`keystore providers list`

List all available providers.

bash

keystore providers list
# Slug        Name
# openai      OpenAI
# anthropic   Anthropic
# neon        Neon
# resend      Resend
# vercel      Vercel
# s3          AWS S3

`keystore providers add`

Add a provider account. Supports BYOK (bring your own key) and marketplace modes.

bash

keystore providers add
# Provider slug (e.g. openai): openai
# Mode (byok/marketplace): byok
# API key: sk-proj-abc123...
# Provider openai added (byok)

`keystore providers remove <id>`

Remove a provider account. Prompts for confirmation.

bash

keystore providers remove pa_abc123
# Remove provider account pa_abc123? (y/n) y
# Provider account pa_abc123 removed

`keystore providers rotate <id>`

Rotate credentials for a provider account. The old key is replaced immediately.

bash

keystore providers rotate pa_abc123
# New API key: sk-proj-newkey...
# Credentials rotated for pa_abc123

Monitoring

`keystore usage [agent-id]`

Show a usage summary. Omit the agent ID to see organization-wide usage.

bash

keystore usage ag_abc123
# Period:    2026-03
# Requests:  1,234
# Errors:    12
# Cost:      $4.5600
# Budget:    $100 (4.6% used)

bash

keystore usage
# Period:    2026-03
# Requests:  8,901
# Errors:    45
# Cost:      $32.1200

`keystore logs [agent-id]`

Show request logs for an agent, with optional filtering and live tailing.

Options:

Flag	Description
`--provider <slug>`	Filter logs by provider
`--follow`	Poll for new logs
`--limit <n>`	Number of logs (default 20)

bash

keystore logs ag_abc123
# 14:23:01 200 openai /v1/chat/completions 320ms $0.0042
# 14:23:05 200 anthropic /v1/messages 450ms $0.0038

bash

keystore logs ag_abc123 --provider openai --follow
# 14:23:01 200 openai /v1/chat/completions 320ms $0.0042
# 14:23:15 200 openai /v1/chat/completions 280ms $0.0031
# ... (polling for new logs)

Connectivity

`keystore test`

Verify that the agent token can reach the Keystore vault.

bash

keystore test
# Connection successful -- vault is reachable

Pass a specific token with --token:

bash

keystore test --token ks_abc123...
# Connection successful -- vault is reachable