salty-cli

The CLI for Salty — the CRM your AI agents can run.

npm install -g salty-cli
salty login

What it does

• salty login / salty logout — browser OAuth 2.1 + PKCE flow; stores token in your OS keychain (macOS Keychain / Windows Credential Vault / libsecret on Linux). Falls back to ~/.config/salty/credentials.json (0600) on headless systems.
• salty whoami — current workspace + plan + period usage.
• salty keys list | create --name | revoke <id> — manage sk_live_… API keys.
• salty people list [--limit] | get <id> | create --email --first-name --last-name | search --filter <json> — manage people records.
• salty companies list | get <id> | create --name --domain | search --filter <json> — manage companies.
• salty deals list | get <id> | create --name --stage --value-cents --currency | search --filter <json> — manage deals.
• search takes a structured --filter JSON (operators equals|not_equals|contains|gt|gte|lt|lte|is_null, and/or, custom_attributes.<key>), plus --limit/--sort/--expand.
• salty schema show | add-attribute --object --key --type — extend the workspace schema (lenient validation; see docs).
• salty webhooks list | add --url --events | test <id> — manage signed-webhook endpoints.
• salty usage — current-period API usage + plan cap.
• salty logs tail [--limit] — stream the API call log (last 100 + live updates every 2s).

Every command accepts --json to dump the raw response (for piping into jq) and --api <url> to override the API host (defaults to $SALTY_API or https://api.trysalty.com/v1).

Examples

salty login                                # opens browser, stores token
salty whoami
salty keys create --name "agent-prod"      # prints sk_live_… ONCE
salty people create --email [email protected] --first-name Jane
salty schema add-attribute \
  --object person \
  --key tier \
  --type enum \
  --values "free,pro,enterprise"
salty webhooks add --url https://yourapp.com/hooks/salty --events "*"
salty logs tail
salty people list --json | jq '.data[] | select(.custom_attributes.tier == "pro")'

Auth

The CLI uses OAuth 2.1 dynamic client registration (RFC 7591) per machine + per API host. On first salty login:

1. Picks a free localhost port (9876+).
2. Registers a public OAuth client with the Salty OAuth server.
3. Generates a PKCE S256 challenge.
4. Opens your browser to <host>/oauth/authorize.
5. After you approve in the consent page, exchanges the code at /oauth/token.
6. Stores salty_oat_… + salty_rt_… in your keychain.

The access token is auto-refreshed if within 30s of expiry, and on any 401 the CLI retries once with the refresh token before surfacing the error.

Multi-host

Each --api <url> you log into is stored separately, so the same CLI can talk to prod, staging, and your local dev box without re-login.

salty login --api https://api.staging.trysalty.com/v1
salty people list --api https://api.staging.trysalty.com/v1
salty whoami --api http://localhost:8787

Links

• Docs: https://docs.trysalty.com/cli/introduction
• API reference: https://docs.trysalty.com/api-reference/introduction
• Issues: https://github.com/trysalty/salty/issues

License

MIT