# CLI

The kortix command line, its auth model, the dev loop, and every command.

Canonical page: https://kortix.com/docs/cli

The `kortix` command line interface (CLI) controls Kortix from a terminal — your laptop or a session sandbox. This page shows the everyday dev loop, then lists every stable command and flag.

## Install

```sh
curl -fsSL https://kortix.com/install | bash
```

The installer downloads a prebuilt binary for macOS and Linux. Windows is not supported.

| Command | Effect |
| --- | --- |
| `kortix update` | Re-run the install script and pull the latest binary. |
| `kortix uninstall [-y\|--yes] [--keep-auth] [--keep-home]` | Remove the binary, the `/usr/local/bin` shim, and the stored token. `--keep-auth` keeps the token. `--keep-home` keeps `~/.kortix`. |
| `kortix version` | Print the CLI version. |

## Auth model

Kortix stores authentication per host, not globally. A host is one Kortix API endpoint. Four hosts exist by default: `cloud` (Kortix Cloud), `selfhost` (your self-hosted stack), `local-dev`, and `kortix-internal-dev`. You can add more.

The config file lives at `~/.config/kortix/config.json`, mode `0600`. Override its path with `KORTIX_CONFIG_FILE`.

The CLI follows one hierarchy: host → account → project → session. You sign in to a host, pick an account inside it, pick a project inside that account, and open sessions inside the project. `kortix hosts login` walks the first three steps in order: it signs you in, picks the account, then sets a default project.

Every token starts with `kortix_pat_`. A user token, from `kortix login`, sees every account and project you belong to. A project token is auto-minted for a session sandbox and scoped to one project. See [Token scope](#token-scope).

## The dev loop

This loop assumes the CLI is installed and you ran `kortix login`. See [Quickstart](/docs/quickstart) for setup.

### Link a repo

Start a new project, or link an existing repo folder to one.

To scaffold a new project:

```sh
kortix init my-app
cd my-app
```

`kortix init` creates a project directory with the `general-knowledge-worker` template.

To link an existing cloned repo to a project you already created:

```sh
kortix projects link <project-id>
```

This command writes `.kortix/link.json` in the current directory. Kortix reads this file to find your project on every command run from this folder. If you plan to run `kortix ship` first, skip this step. It links a new project for you when none exists.

### Ship your code

```sh
kortix ship
```

`kortix ship` lints your `kortix.yaml`, commits local changes, pushes your branch, and prompts for any missing secret or connector connection. Run it each time you want your local changes on the cloud project. The first run also creates the cloud project and repo if you have not linked one yet.

### Run and attach to sessions

Start a session with a prompt:

```sh
kortix sessions new --prompt "Build the login page" --wait
```

Each session runs in its own sandbox, on its own branch. `--wait` blocks until the session is ready.

Attach to a session from your terminal:

```sh
kortix sessions chat
```

This opens an interactive chat with your most recent session. Add an id to target a specific session: `kortix sessions chat <id>`.

To attach your local OpenCode client to the sandbox instead, run:

```sh
kortix sessions connect
```

To open a raw shell in the sandbox, with no agent involved, run:

```sh
kortix sessions shell
```

List your running sessions at any time:

```sh
kortix sessions ls
```

### Review with change requests

An agent opens a change request (CR) when its session has commits ready to merge. List, inspect, and merge them from the CLI.

```sh
kortix cr ls
kortix cr diff 1
kortix cr merge 1
```

`kortix cr ls` lists change requests for the linked project. `kortix cr diff <cr>` shows the unified patch. `kortix cr merge <cr>` merges it into the project's default branch. Accept a CR number or its full id.

## Reference

### Auth commands

| Command | Effect |
| --- | --- |
| `kortix login [--host <name>] [--api <url>] [--token <pat>] [--account <slug>] [--no-project]` | Sign in to the active host, or the named one. Opens a browser by default; `--token` signs in headless. `--no-project` skips the default-project pick. |
| `kortix logout [--host <name>]` | Remove the token for the active host, or the named one. |
| `kortix whoami [--host <name>] [--json] [--token-only]` | Print the signed-in user and active account. |
| `kortix token [--host <name>]` | Shortcut for `kortix whoami --token-only`. |

`kortix hosts login` / `hosts logout` / `hosts whoami` are the canonical forms. `login` / `logout` / `whoami` are shortcuts that act on the active host.

### Hosts

| Command | Effect |
| --- | --- |
| `kortix hosts ls [--json]` | List every host and its auth status. |
| `kortix hosts login [<name>] [--token <pat>] [--api <url>] [--account <slug>] [--no-project]` | Sign in to a host. An unknown name registers the host first. |
| `kortix hosts logout [<name>]` | Remove the token for a host. |
| `kortix hosts use <name>` | Switch the active host. |
| `kortix hosts add <name> --url <url> [--dashboard-url <url>] [--login]` | Register a new host. `--login` signs in right after. |
| `kortix hosts rm <name> [--force]` | Remove a host. |
| `kortix hosts info [<name>] [--json]` | Show details for one host. |
| `kortix hosts current [--json]` | Print the active host name. |

A remote host URL that starts with `http://` is normalized to `https://`. The CLI never sends a token over plain HTTP to a remote host. `localhost` is exempt.

### Accounts

| Command | Effect |
| --- | --- |
| `kortix accounts ls [--json]` | List the accounts you belong to on the active host. |
| `kortix accounts use [<slug-or-id>]` | Switch the active account. |
| `kortix accounts current [--json]` | Print the active account. |
| `kortix accounts info [<slug-or-id>] [--json]` | Show one account. |

### Projects

A command resolves "the project" in this order:

1. The `--project` flag.
2. The `KORTIX_PROJECT_ID` environment variable.
3. `.kortix/link.json` in the exact working directory.
4. The global default set by `kortix projects use`.

| Command | Effect |
| --- | --- |
| `kortix projects ls [--all] [--json]` | List projects on the active account. `--all` spans every account you belong to. |
| `kortix projects info [<id>] [--json]` | Show one project. Default: the linked or default project. |
| `kortix projects use [<id>]` | Set the global default project. Switches the active account if the project lives elsewhere. |
| `kortix projects unset` | Clear the global default project. |
| `kortix projects link [<id>]` | Bind the current directory to a project. Writes `.kortix/link.json`. |
| `kortix projects unlink` | Remove `.kortix/link.json`. |
| `kortix projects open [<id>]` | Open a project's dashboard page in your browser. |
| `kortix projects clone [<id>] [dir]` | Clone a project's repo through the authenticated Kortix git proxy. |
| `kortix projects rm [<id>] [--purge] [-y\|--yes]` | Archive a project. `--purge` also deletes its managed git repo. |

### Project scaffold

`kortix init [project-name] [options]` creates a new, empty project directory. It writes `kortix.yaml`, `.kortix/Dockerfile`, and the OpenCode config directory. It does not write `.kortix/link.json` — `kortix ship` or `kortix projects link` create that later.

| Flag | Meaning |
| --- | --- |
| `--name <project>` | Project name. |
| `--primary <agent>` | Primary agent. |
| `--agents <csv>` | Local coding-agent integrations to wire up. |
| `--template <general-knowledge-worker\|minimal>` | Project template. Default: `general-knowledge-worker`. |
| `--force` | Configure the current directory in place instead of scaffolding a new one. |
| `--overwrite` | Overwrite existing files. |
| `--no-git` | Skip git init. |
| `-y, --yes` | Don't prompt. |

`kortix init` does not include a marketplace picker. Adding a marketplace skill is an agent import: start a session and ask the agent to bring one in.

### Ship

`kortix ship` stages, commits, and pushes your current branch to the project's git repo. Run it once to create the project. Run it again any time to sync. Alias: `kortix deploy`.

Each run:
- Parses and validates `kortix.yaml` (skip with `--no-verify`).
- Commits any dirty working tree (skip with `--no-commit`).
- Prompts for any missing `env` secret (skip with `--no-env`).
- Pushes the current branch to the same-named remote branch.
- Connects any declared connector that still needs auth (skip with `--no-connect`).

An existing GitHub `origin` links through the Kortix GitHub App. Any other existing `origin` is registered as-is. No `origin` creates a managed Kortix git repo.

| Option | Effect |
| --- | --- |
| `--name <project>` | Display name for a new project. |
| `--account <id\|slug>` | Account to create the project under (first ship only). |
| `--origin <managed\|git-url>` | Override the inferred origin choice. |
| `--github-token <pat>` | Link a GitHub origin with this token instead of the GitHub App. |
| `-m, --message <text>` | Commit message. |
| `--no-commit` / `--no-verify` / `--no-env` / `--no-connect` | Skip that step. |
| `-y, --yes` | Don't prompt. |
| `-n, --dry-run` | Print what would happen; change nothing. |
| `--project <id>` / `--host <name>` | Target a non-default project or host. |

### Sessions

Each session runs in one sandbox on its own branch.

| Command | Effect |
| --- | --- |
| `kortix sessions ls` | List every session on the project. |
| `kortix sessions status [--all] [--json]` | Every session and what its agent is doing right now. Aliases: `overview`, `ps`. |
| `kortix sessions info <id> [--json]` | Detail view: status, branch, agent, sandbox URL. |
| `kortix sessions new [--prompt "<text>"] [--agent <name>] [--model <id>] [--wait] [--json]` | Start a session. `--model <id>` overrides the project's default model. `--wait` blocks until it is running (up to ~5 minutes); a timeout is a hard failure (exit 1), not a silent success. Backend-origin overrides require a backend token (PAT or service account) and 403 otherwise: `--origin-ref <user-id>` (attribute to your end user), `--secret <id>` (narrow injected secrets, repeatable), `--no-secrets` (inject zero project secrets), `--connector <alias>=<profile-id>` (bind a connector to a profile, repeatable), `--context <key>=<value>` (runtime context, repeatable). |
| `kortix sessions chat [<id>] [--prompt "<text>"] [--new] [--agent <name>] [--json]` | Talk to a session's agent. Interactive by default. Alias: `talk`. Top-level `kortix chat` also works. |
| `kortix sessions connect [<id>] [-- <opencode args>]` | Attach your local OpenCode TUI to the OpenCode server already running in the sandbox. Alias: `attach`. |
| `kortix sessions shell [<id>] [--new]` | Open a raw interactive terminal in the sandbox, with no agent. Aliases: `terminal`, `ssh`. |
| `kortix sessions log [<id>] [--limit <n>] [--json]` | Print recent messages, read-only. Aliases: `messages`, `history`. |
| `kortix sessions pending <id> [--json]` | List open tool-permission or question prompts. Alias: `prompts`. |
| `kortix sessions approve <id> [<req-id>] [--always] [--reject] [--message "<text>"]` | Answer a permission prompt. |
| `kortix sessions answer <id> [<req-id>] [--option <v>]... [--text "<text>"] [--reject]` | Answer a question prompt. |
| `kortix sessions digest [--since <7d>] [--json]` | Compact multi-session review. Aliases: `review`, `summary`. |
| `kortix sessions preview <id> [port] [--port <n>] [--json]` | Print a clickable preview URL for a sandbox port. Default port: `3000`. |
| `kortix sessions restart <id>` | Restart the session's sandbox. |
| `kortix sessions rename <id> <name>` | Set a session's name. Pass `""` to clear it. |
| `kortix sessions rm <id>` | Stop and delete a session. |
| `kortix sessions open <id>` | Open a session's dashboard page in your browser. |

Inside a sandbox, `KORTIX_SESSION_ID` is your own session's id.

### Change requests

A change request (CR) merges one branch into another on any git host. It is the only way for an agent to land session work on the default branch. See [Change requests](/docs/work/change-requests).

| Command | Effect |
| --- | --- |
| `kortix cr ls [--status open\|merged\|closed\|all] [--project <id>]` | List CRs. Default: `--status open`. |
| `kortix cr show <cr> [--project <id>]` | Show one CR, including its merge preview. Alias: `info`. |
| `kortix cr diff <cr> [--no-color] [--json]` | Print a CR's unified diff. |
| `kortix cr open --title "<text>" [--description "<text>"] [--head <ref>] [--session <id>] [--base <ref>]` | Open a CR. Aliases: `new`, `create`. Inside a sandbox, `--head` and `--session` default automatically. `--base` defaults to the project's default branch. |
| `kortix cr merge <cr> [--message "<text>"]` | Merge an open CR. Fast-forward when possible, three-way merge otherwise. |
| `kortix cr close <cr>` | Close an open CR without merging. |
| `kortix cr reopen <cr>` | Reopen a closed CR. Merged CRs are terminal. |

`<cr>` accepts a per-project number (`3`) or the full id. Inside a sandbox, the CLI reads its token automatically — no login or link needed.

### Secrets

Encrypted values stored on the project and injected as plain environment variables into every session sandbox at boot.

| Command | Effect |
| --- | --- |
| `kortix secrets ls` | List secrets by identifier and manifest `env` spec. Marks required-but-missing values. |
| `kortix secrets set NAME=VALUE ... [--identifier <id>]` | Upsert one or more secrets. `NAME=-` reads the value from stdin. |
| `kortix secrets request NAME ... [--scope runtime\|connector] [--expires <min>]` | Mint a link for a human to enter a value directly — you never see the raw value. |
| `kortix secrets unset NAME ...` | Remove secrets. |

### Env

| Command | Effect |
| --- | --- |
| `kortix env pull [--out <path>] [--force]` | Write a `.env` skeleton — names only. Values never leave the cloud. |
| `kortix env push --from <path>` | Upload every `NAME=VALUE` from a dotenv file as a secret. |

### Agents

Per-agent model settings on the linked project.

| Command | Effect |
| --- | --- |
| `kortix agents models [--json]` | Show every agent's pinned model and the fallback default. |
| `kortix agents model <agent> <provider/model>` | Pin an agent to a model. |
| `kortix agents model <agent> --clear` | Clear the pin — the agent follows the default again. |

### Channels

Manages the project's connection to a chat platform. Tokens are stored encrypted in the project's secrets and resolved server-side — they are never injected into the sandbox.

| Command | Effect |
| --- | --- |
| `kortix channels status [--json]` | Show the current connection. |
| `kortix channels connect [--wait] [--timeout <sec>]` | Connect in one step: prints an install link. `--wait` polls until the install lands. |
| `kortix channels connect --manual [--bot-token <token>] [--signing-secret <secret>]` | Bring-your-own-app mode: save a bot token and signing secret directly. |
| `kortix channels disconnect` | Remove the project's channel secrets. |
| `kortix channels manifest` | Print the app manifest JSON for the bring-your-own-app path. |

`--platform slack|teams` selects the platform; default `slack`. See [Connectors](/docs/connect/connectors).

### Connectors

Connectors an agent calls as tools. `add`, `rm`, and `policy set` edit the local `kortix.yaml`; run `kortix ship` to apply, unless you pass `--apply` to change the cloud project immediately.

| Command | Effect |
| --- | --- |
| `kortix connectors ls [--json]` | List connectors and their status. |
| `kortix connectors show <slug> [--json]` | Show one connector's tools. |
| `kortix connectors add <slug> --provider <p> [options] [--apply]` | Add a connector. |
| `kortix connectors rm <slug> [--apply]` | Remove a connector. |
| `kortix connectors rename <slug> <name>` | Set a connector's display name. |
| `kortix connectors sync` | Reconcile the catalog from the shipped `kortix.yaml`. |
| `kortix connectors credential <slug> [value]` | Set a connector's credential. |
| `kortix connectors connect <slug>` | Start a one-click connect flow. |
| `kortix connectors link <slug> [--expires <min>]` | Mint a shareable connect link for a human. |
| `kortix connectors finalize <slug>` | Confirm a connection completed. |
| `kortix connectors apps [<query>] [--json]` | Browse the connector app catalog. |
| `kortix connectors policy ls [--json]` | Show project-wide execution policy. |
| `kortix connectors policy set --default <risk\|allow_all>` | Set the default execution mode. |
| `kortix connectors policy <slug> ls\|set <match> <allow\|ask\|block>\|rm <match>\|clear` | Manage one connector's tool-call rules. |

`add` options: `--name <label>`, `--provider <pipedream\|mcp\|openapi\|postman\|graphql\|http>`, `--app <slug>`, `--url <url>`, `--transport <http\|sse>`, `--endpoint <url>`, `--base-url <url>`, `--spec <url\|path>`, `--auth-type <none\|bearer\|basic\|custom>`, `--credential shared`.

### Sandboxes

Manages the project's sandbox images. A template defines an image or Dockerfile plus resources; a build produces the snapshot sessions boot from.

| Command | Effect |
| --- | --- |
| `kortix sandboxes ls [--json]` | List templates and live provider state. |
| `kortix sandboxes builds [--json]` | Recent build log. |
| `kortix sandboxes health [--json]` | Primary template readiness. |
| `kortix sandboxes add <slug> (--image <i>\|--dockerfile <p>) [options]` | Create a custom template and start a build. |
| `kortix sandboxes update <slug> [options]` | Update a template. |
| `kortix sandboxes build <slug>` | Trigger a rebuild. |
| `kortix sandboxes rebuild <slug>` | Force-rebuild: delete the existing snapshot first. |
| `kortix sandboxes rm <slug>` | Delete a template. |
| `kortix sandboxes fix` | Start a session seeded with the last failed build log, to repair it. |

`add`/`update` options: `--name <label>`, `--cpu <n>`, `--memory <n>` (GiB), `--disk <n>` (GiB).

### Marketplace

Read-only discovery of marketplace items. Installing an item into a project is an agent import, done from inside a session — there is no install command.

| Command | Effect |
| --- | --- |
| `kortix marketplace search [query]` | Search marketplace items. |
| `kortix marketplace list` | List marketplace items. |
| `kortix marketplace show <id-or-name>` | Show one marketplace item. |

Options: `--query <text>`, `--type <type>`, `--source <source>`, `--host <name>`, `--json`.

### Skills

| Command | Effect |
| --- | --- |
| `kortix skills list` | List skills available to the project. Default subcommand. |
| `kortix skills get <name> [--full]` | Show one skill. |
| `kortix skills path [name]` | Print a skill's file path. |

### Executor

The in-sandbox agent's interface to every connector. Every call is checked, resolved, and audited server-side; the CLI never holds a third-party credential. Auth: `KORTIX_EXECUTOR_TOKEN`. Output is JSON.

| Command | Effect |
| --- | --- |
| `kortix executor discover "<intent>"` | Search tools by natural-language intent. |
| `kortix executor describe <connector>.<action>` | Show a tool's input schema. |
| `kortix executor call <connector> <action> '<json-args>'` | Run a tool. |
| `kortix executor add <slug> --provider pipedream --app <app>` | Add a connector immediately, then connect it. |
| `kortix executor rm <slug>` | Remove a connector from the project. |
| `kortix executor connect <slug>` | Mint a connect link for a human. |
| `kortix executor mcp` | Run the optional stdio MCP compatibility server. |

### Files

Read-only view of the project's git repo. Operates on the default branch unless `--ref` names another branch, tag, or commit.

| Command | Effect |
| --- | --- |
| `kortix files ls [<path>]` | List files under a path. |
| `kortix files cat <path>` | Print a file's contents. |
| `kortix files search <query> [--content]` | Search filenames, or file contents with `--content`. |
| `kortix files history <path>` | Commit history for one file. |
| `kortix files branches` | List branches. |
| `kortix files commits [--path <p>]` | List commits on `--ref`. |
| `kortix files show <sha>` | Show one commit and its changed files. |
| `kortix files diff <sha> [--path <p>]` | Print a commit's unified patch. |
| `kortix files compare <from> <into>` | Summarize the diff between two refs. |

Options on every subcommand: `--ref <ref>`, `--path <p>`, `--limit <n>`, `--json`.

### Triggers

A trigger starts a session from a schedule or a webhook. `add`, `rm`, `enable`, `disable` edit the local manifest — run `kortix ship` to apply. `pause`/`resume` flip a separate, server-side switch. See [Triggers](/docs/connect/triggers).

| Command | Effect |
| --- | --- |
| `kortix triggers ls [--json]` | List triggers and their runtime state. |
| `kortix triggers add <slug> [options]` | Append a trigger to the manifest. |
| `kortix triggers rm <slug>` | Remove a trigger. |
| `kortix triggers info <slug> [--json]` | Show one trigger. |
| `kortix triggers fire <slug>` | Fire a trigger manually. |
| `kortix triggers enable <slug>` / `disable <slug>` | Turn one trigger on or off. |
| `kortix triggers pause` / `resume` | Deactivate or reactivate every trigger on the project, server-side. |

`add` options: `--type <cron\|webhook>` (default `cron`), `--prompt <text>` (required), `--agent <name>`, `--cron <expr>`, `--timezone <tz>` (default UTC), `--secret-env <NAME>`, `--name <label>`, `--disabled`.

### Access

Who can use the linked project. Roles: `manager`, `editor`, `member`.

| Command | Effect |
| --- | --- |
| `kortix access ls [--json]` | List members and their project roles. |
| `kortix access invite <email> --role <r>` | Invite someone to the project. |
| `kortix access grant <user-id> --role <r>` | Set a member's project role. |
| `kortix access revoke <user-id>` | Remove a member's project access. |
| `kortix access pending [--json]` | List pending invitations. |
| `kortix access cancel <invite-id>` | Cancel a pending invitation. |

### Roles

Account-level custom IAM roles and policy bindings. Built-in roles are read-only references; custom roles are yours to create, edit, and bind.

| Command | Effect |
| --- | --- |
| `kortix roles ls [--json]` | List roles, built-in and custom. |
| `kortix roles show <role> [--json]` | Show one role's permissions and usage. |
| `kortix roles actions [--json]` | List the permission catalog. |
| `kortix roles create <key> --name <n> [options]` | Create a custom role. |
| `kortix roles set-actions <role> --actions a,b` | Replace a custom role's permissions. |
| `kortix roles rm <role>` | Delete a custom role. |
| `kortix roles assignments [--project <id>] [--json]` | List policy bindings. |
| `kortix roles assign <role> --to <type>:<id>` | Bind a role to a member, group, or token. |
| `kortix roles unassign <policy-id>` | Remove a binding. |
| `kortix roles export [--project <id>] [--out <file>] [--format toml\|json]` | Dump roles and bindings to a file. |
| `kortix roles import <file>` | Apply a roles and bindings file. |

### Grants

Assigns project resources to people. Secrets and connectors live on agents; assigning an agent to a member grants everything that agent declares.

| Command | Effect |
| --- | --- |
| `kortix grants ls [--json]` | List grants, and which agents can be granted. |
| `kortix grants assign <agent-name> --to <who> [--group]` | Assign an agent to a member, or a group with `--group`. |
| `kortix grants revoke <grant-id>` | Remove a grant. |

### Manifest validation

| Command | Effect |
| --- | --- |
| `kortix validate [--file <path>] [--json] [--scopes]` | Validate the manifest against the canonical schema. Resolves `kortix.yaml` first, then `kortix.toml`. Exit codes: `0` valid, `1` errors, `2` file missing. |
| `kortix schema [--version 1\|2] [--url]` | Print the manifest's JSON Schema. `--url` prints the schema URL instead. |

See [Manifest reference](/docs/project/manifest).

### Self-host

`kortix self-host` runs one Docker-based stack, identical on a laptop, a VPS, or a cloud VM. See [Self-hosting](/docs/host) and [Self-hosting architecture](/docs/host/architecture).

| Command | Effect |
| --- | --- |
| `kortix self-host init` | Create or refresh the self-host config. Does not start the stack. |
| `kortix self-host configure` | Interactive wizard for integrations and update policy. |
| `kortix self-host doctor` | Validate local Docker tooling and the rendered config. |
| `kortix self-host plan` | Validate the rendered Compose config; change nothing. |
| `kortix self-host start` | Create config if needed, then start the stack. Aliases: `up`, `deploy`. |
| `kortix self-host update [--tag <v>\|--channel stable\|latest]` | Pull images for the configured channel or tag and recreate the stack. Alias: `upgrade`/`reconcile`. |
| `kortix self-host rollback --release <v>` | Roll back to an explicit older version. |
| `kortix self-host version` | Show the running version and channel. |
| `kortix self-host restart` / `stop` | Restart or stop the stack. Alias for stop: `down`. |
| `kortix self-host status` / `ps` | Show service status. |
| `kortix self-host open` | Open the dashboard in your browser. |
| `kortix self-host connect-github` | Connect a GitHub App for managed repos. |
| `kortix self-host env ls [--show]` | Show persistent config values, masking secrets by default. |
| `kortix self-host env set KEY=VALUE ...` | Set a value and restart only the services it affects. |
| `kortix self-host env rotate KEY\|--all-generated` | Regenerate a rotatable, CLI-generated secret. |
| `kortix self-host logs [service]` | Tail stack logs. |
| `kortix self-host uninstall` | Stop the stack and delete this instance's containers, volumes, and config. |

Common flags: `--instance <name>` (default `default`), `--domain <domain>`, `--tunnel cloudflare`, `--version`/`--tag`/`--release <v>`, `--channel stable|latest` (default `stable`), `--auto-update on|off` (default `on`; forced off by `--local-images`), `--update-time <HH:MM>` / `--update-tz <tz>` (auto-updater schedule), `--local-images` (run locally-built images; dev mode), `--enterprise-license` (unlock SSO/SCIM/RBAC/audit), `--admin-email <email>`, `--no-restrict-account-creation` (let any signed-in user create new accounts/orgs; default is admin-only), `--restrict-account-creation` (re-enable the admin-only default), `--json`, `--yes`.

### Token scope

Every token starts with `kortix_pat_`. A user token is scoped to every project on your accounts. A project token is scoped to one project and auto-injected into that project's sandboxes. See the full token-family reference at [Session runtime](/docs/work/runtime).

### Exit codes

| Code | Meaning |
| --- | --- |
| `0` | Success. |
| `1` | Operation failed. Diagnostics print to stderr. |
| `2` | Bad flag, unknown subcommand, or missing required argument. |