StateChange CLI for Xano

CLI tool for accessing Xano private APIs and performance insights.

Installation

cd cli
yarn install
yarn build

Usage

Authentication

First, initialize your StateChange API key:

sc-cli auth init --api-key <your-api-key>
# Or run interactively:
sc-cli auth init

This saves your API key to ~/.statechange/auth.json. You can also:

• Set STATECHANGE_API_KEY environment variable
• Use --api-key flag on any command

Verify authentication:

sc-cli auth whoami

Environment Variables

You can set these environment variables to avoid passing flags:

• STATECHANGE_API_KEY - StateChange API key (for fetching Xano tokens from backend)
• XANO_TOKEN - Your Xano API token (fallback if StateChange backend not available)
• XANO_INSTANCE - Xano instance (e.g., app.xano.com)
• XANO_WORKSPACE - Workspace ID
• XANO_BRANCH - Branch ID (default: 0)

Commands

X-Ray Analysis

Analyze function X-Ray data:

sc-cli xray function --id <functionId> --instance <instance> --workspace <workspace> --token <token>

Performance Analysis

Show top slowest endpoints:

sc-cli performance top-endpoints --instance <instance> --workspace <workspace> --token <token> --lookback 24

Audit

Audit workspace for issues:

sc-cli audit workspace --instance <instance> --workspace <workspace> --token <token>

Security

Secure or disable Swagger:

# Disable Swagger
sc-cli secure swagger --app-id <id> --disable

# Require token for Swagger
sc-cli secure swagger --app-id <id> --require-token

Performance Scanning

Scan all functions for nested slow steps:

sc-cli performance scan-functions --instance <instance> --workspace <workspace> --min-nesting 2

X-Ray Workspace Scanning

Scan all functions in a workspace for X-Ray issues:

sc-cli xray scan-workspace --instance <instance> --workspace <workspace> --include-warnings

Token Management

The CLI automatically fetches Xano tokens from the StateChange backend when authenticated:

1. Extension pushes Xano tokens to StateChange backend when you're logged in
2. CLI authenticates with StateChange backend using long-lived API key
3. CLI fetches Xano tokens from StateChange backend by instance name

If StateChange backend is not available, you can still use --token or XANO_TOKEN as a fallback.

Implementation Status

• ✅ Phase 0: CLI with manual token support
• ✅ Phase 1: StateChange backend integration (extension push + CLI fetch)
• ✅ Phase 2: Shared analysis library + higher-level commands

Backend API Requirements

For backend developers implementing the StateChange API endpoints, see XANO.md for complete API specification including:

• Authentication requirements (extension vs CLI)
• Endpoint specifications (POST, GET)
• Request/response formats
• Error handling
• Security considerations