Skip to main content
Connect the CLI to a hosted workspace, or bind an optional ledger to a project. The saved-key prompt and ledger-free connect path below describe current source, intended for CLI 0.6.14 or later. The npm release verified on October 24, 2026 was 0.6.13; it requires an environment key and a ledger for connect. Use the CLI setup guide for that released path. Inspect your installed version before using a newer flow. Create a workspace API key in Agent access. Paste it only into the terminal prompt or supply it through AGENTLINKOPS_API_KEY or AGENTLINKOPS_TOKEN. Never put it in agent chat or a tracked file. For optional ledger sync, initialize a new ledger first and select projects:read, watches:read, watches:write, events:read and exports:create. Keep an existing ledger intact.

​
Example

With an initialized ledger and configured key, verifies the existing workspace and project, then saves their IDs and origin. This form works with the released environment-key flow.

​
Options

​
Next: read your projects

Read access verifies that connection. If you bound a ledger and want its history, use agentlinkops sync --pull-only. See sync for upload previews and recovery.

​
Exit status

0 on success; 2 on usage, configuration, input or request failure.
Current source supports a verified API key saved outside the repository and a connection without a ledger. In a terminal, connect asks for a key when none is configured; it verifies the workspace before saving a pasted key.Environment keys remain supported for scripts. Ledger sync additionally verifies project access and saves only non-secret origin, workspace and project metadata.It removes a legacy saved cloud.token. The saved ledger identity must remain consistent.Ledger connection saves use the native writer lock on macOS or Linux. If the native dependency is unavailable, reinstall the CLI with its platform dependencies before retrying.Keep the existing ledger for the same origin, workspace and project; use a separate ledger to change that identity.
The explicit CLI OAuth path requires an existing public client and is limited to the user-owned Linux POSIX-mode credential store. macOS, Windows and other unverified custody are refused before consent. Remove API-key environment or saved credentials before choosing OAuth; the modes cannot be combined.The command discovers the exact issuer and /mcp resource, prints a browser authorization URL and receives the reviewed consent through a bounded loopback callback. It does not register a client.A supplied --credential-ref reuses an existing matching issuer/resource/client binding.Repository configuration stores only the issuer, MCP resource, public client ID and opaque credential reference. Tokens remain in ~/.agentlinkops/oauth/ and can refresh under the credential store lock before later MCP calls.Workspace/project readback does not establish an effective write grant. On an uncommitted failure, the CLI attempts to remove a newly created private credential.Linux non-POSIX or network-filesystem custody remains unverified; provider consent and native-client acceptance are separate from source checks.OAuth options require --oauth or a saved OAuth connection.
On supported Linux storage, supply your existing workspace, project, issuer and public client. The command requests browser consent and saves tokens privately; repository configuration keeps their binding and reference. Readback leaves write permission unverified.
Read configuration and file ownership for environment variables, compatibility aliases and writer locks. Read local file contracts for artifact fields. Browse the CLI index for related commands.
Check the selected environment and workspace access before calling hosted operations. See capability status.