@authaction/cli

Command-line interface for AuthAction — manage tenants, applications, users, roles, connections, organizations, API servers, and more directly from your terminal.

Requirements

• Node.js 18 or later

Installation

npm install -g @authaction/cli

Quick start

# 1. Log in (opens a browser window)
authaction login

# 2. Set a default tenant so you don't have to pass --tenant on every command
authaction use

# 3. Verify your session
authaction whoami

Authentication

The CLI authenticates using OAuth 2.0 Authorization Code flow with PKCE (RFC 7636). Your access token is cached in ~/.authaction/config.json (mode 0600).

authaction login     # open browser and authenticate
authaction whoami    # print the current session user
authaction logout    # clear the cached token

Configuration

Default tenant

Set a default tenant once to avoid passing --tenant / --region on every command:

authaction use              # interactive picker — lists all your tenants
authaction use my-tenant    # set by name directly
authaction use --clear      # stop using a default (prompts per command)

Global flags

Most commands accept these flags:

| Flag | Description | |---|---| | --tenant <name> | Tenant name (skipped when a default is set via authaction use) | | --region <region> | One of: eu us au ca cn in gb jp (default: eu) | | --json | Output raw JSON instead of a table |

Commands

Tenants

authaction tenants list
authaction tenants get <tenantId>
authaction tenants create                                     # interactive
authaction tenants update <tenantId> --name <name>
authaction tenants custom-domains <tenantId>
authaction tenants add-custom-domain <tenantId> --domain <domain>
authaction tenants verify-custom-domain <tenantId> <domainId>
authaction tenants remove-custom-domain <tenantId> <domainId>

Applications

authaction apps list [--type spa|m2m|passkey-plus] [--page <n>]
authaction apps get <applicationId>
authaction apps create                                        # interactive
authaction apps update <applicationId> [--name <name>] [--description <desc>]
    [--homepage-url <url>] [--login-url <url>]
    [--callback-urls <url1,url2>] [--logout-urls <url1,url2>]
    [--id-token-expiration <secs>]
authaction apps delete <applicationId>

Application types: spa · m2m · passkey-plus

Users

authaction users list [--page <n>] [--email <email>] [--connection <id>]
authaction users get <userId>
authaction users create                                       # interactive
authaction users update <userId> --name <name>
authaction users delete <userId>
authaction users block <userId>
authaction users unblock <userId>
authaction users roles <userId>
authaction users assign-roles <userId> --role-ids <id1,id2>
authaction users remove-role <userId> <roleId>
authaction users apps <userId>
authaction users remove-app <userId> <applicationId>
authaction users passkeys <userId>
authaction users remove-passkey <userId> <passkeyId>
authaction users assign-plan <userId> --plan-id <planId>
authaction users remove-plan <userId> <planId>

Password requirements (for users create): minimum 8 characters with at least one uppercase letter, one lowercase letter, one digit, and one special character.

Roles

authaction roles list
authaction roles get <roleId>
authaction roles create                                       # interactive
authaction roles update <roleId> [--name <name>] [--description <desc>]
authaction roles delete <roleId>
authaction roles users <roleId>
authaction roles assign-users <roleId> --user-ids <id1,id2>

Connections

authaction connections list
authaction connections get <connectionId>
authaction connections create                                 # interactive
authaction connections update <connectionId> [--name <name>] [--options '<json>']
authaction connections delete <connectionId>
authaction connections enable-client <connectionId> <clientId>
authaction connections disable-client <connectionId> <clientId>
authaction connections users <connectionId>

Supported connection types: email-password · google · github · microsoft · saml · ad-ldap · passkey

Organizations

authaction orgs list
authaction orgs get <orgId>
authaction orgs create                                        # interactive
authaction orgs update <orgId> --display-name <displayName>
authaction orgs delete <orgId>
authaction orgs members <orgId>
authaction orgs add-members <orgId> --user-ids <id1,id2>
authaction orgs remove-member <orgId> <userId>
authaction orgs assign-member-roles <orgId> <userId> --role-ids <id1,id2>
authaction orgs remove-member-role <orgId> <userId> <roleId>
authaction orgs assign-plan <orgId> --plan-id <planId>
authaction orgs remove-plan <orgId> <planId>

API Servers

authaction api-servers list
authaction api-servers get <apiServerId>
authaction api-servers create                                 # interactive
authaction api-servers update <apiServerId> --name <name>
authaction api-servers delete <apiServerId>
authaction api-servers enable-client <apiServerId> <clientId>
authaction api-servers disable-client <apiServerId> <clientId>
authaction api-servers enable-connection <apiServerId> <connectionId>
authaction api-servers disable-connection <apiServerId> <connectionId>

Plans

authaction plans list
authaction plans get <planId>
authaction plans create                                       # interactive
authaction plans update <planId> [--name <name>] [--description <desc>]
authaction plans delete <planId>
authaction plans users <planId>
authaction plans assign-users <planId> --user-ids <id1,id2>
authaction plans orgs <planId>
authaction plans assign-orgs <planId> --org-ids <id1,id2>

SMTP

authaction smtp get
authaction smtp set --test-recipient <email> [--server <address>] [--port <port>]
    [--username <user>] [--password <pass>] [--sender-email <email>]
authaction smtp delete          # revert to default SMTP provider

Tenant members & invitations

authaction tenant-members list <tenantId>
authaction tenant-members remove <tenantId> <memberId>
authaction tenant-members invitations <tenantId>
authaction tenant-members invite <tenantId>                   # interactive
authaction tenant-members revoke-invitation <tenantId> <invitationId>

Email logs

authaction emails list [--page <n>] [--limit <n>] [--user-id <id>]

JSON output

Pass --json to any read command to receive machine-readable output suitable for piping into jq or other tools:

authaction users list --json | jq '.[].email'
authaction apps list --json | jq '.[] | select(.type == "m2m") | .clientId'

Links

• Website: https://authaction.com
• License: MIT