Reference

Command reference

Every `cactive` command with its arguments and flags. Generated from the command line's source.

Run cactive help <command> for the same text in your terminal. Options that work with every command (--json, --org, --project, --yes, --cwd, --no-color) are listed under Command line.

cactive login [options]

Flag	Notes
`--no-browser`	Print the link instead of opening the browser
`--step-up`	Confirm with a passkey or two-step sign-in, so a git key can be created in the next 10 minutes

`cactive logout`

Sign out on this machine and remove its git keys.

cactive logout

`cactive whoami`

Show who you're signed in as.

cactive whoami

`cactive orgs`

List your organizations.

cactive orgs

`cactive switch`

Change the current organization.

cactive switch <org>

Argument	Notes
`org`	Organization slug

`cactive init`

Create a Serverless App Service and repository from this folder, push and deploy.

cactive init [name] [options]

Argument	Notes
`name`	Serverless App Service name (default: the folder's name) Optional.

Flag	Notes
`-t, --template <nextjs\|static>`	Start from a template (the folder must be empty)
`--framework <nextjs\|static\|node>`	Framework preset (default: detected)
`--root <dir>`	Root directory of the app inside the repository
`--no-wait`	Don't wait for the first deployment

`cactive link`

Link this folder to an existing Serverless App Service.

cactive link [project]

Argument	Notes
`project`	Serverless App Service slug (asks when omitted) Optional.

`cactive unlink`

Remove this folder's Serverless App Service link.

cactive unlink

`cactive clone`

Clone a Serverless App Service's repository and link it.

cactive clone <project> [dir]

Argument	Notes
`project`	Serverless App Service slug
`dir`	Directory (default: the repository's name) Optional.

`cactive deploy`

Deploy the current branch, or upload the working tree.

In a clean checkout of the Serverless App Service's repository, pushes the current branch and follows its build.

Otherwise (no repository, uncommitted changes, or --upload) uploads the working tree as an archive.

Pushing the production branch deploys production; uploads are previews unless --prod.

cactive deploy [options]

Flag	Notes
`--prod`	Deploy to production
`--upload`	Upload the working tree even in a clean checkout
`--force`	Build again even if this commit (or these uploaded files) was already deployed
`--no-wait`	Print the deployment and return without following the build

`cactive deployments`

List the Serverless App Service's deployments.

cactive deployments [options]

Also: cactive ls.

Flag	Notes
`--target <production\|preview>`	Only production or preview deployments
`--branch <value>`	Only this branch
`-n, --limit <n>`	How many (default 20, at most 100)

`cactive promote`

Make a ready deployment production, without rebuilding.

cactive promote <deployment>

Argument	Notes
`deployment`	Deployment id, its last 8 characters, or its URL

`cactive rollback`

Point production back at an earlier deployment.

cactive rollback [deployment]

Argument	Notes
`deployment`	Deployment (default: the production deployment before the current one) Optional.

`cactive redeploy`

Build a deployment's source again.

cactive redeploy <deployment> [options]

Argument	Notes
`deployment`	Deployment id, its last 8 characters, or its URL

Flag	Notes
`--no-wait`	Don't follow the build

`cactive logs`

Show runtime logs (or build logs) of a deployment.

cactive logs [deployment] [options]

Argument	Notes
`deployment`	Deployment (default: production) Optional.

Flag	Notes
`-f, --follow`	Keep printing new lines
`-q, --query <text>`	Only lines containing this text (case-insensitive)
`--level <error\|warn\|info\|debug>`	Only lines at this level or above
`--since <duration>`	Start this long ago, e.g. 30s, 10m, 1h (at most 1h)
`--build`	Show the build output instead

`cactive env ls`

List variables.

cactive env ls [options]

Also: cactive env list.

Flag	Notes
`-e, --environment <production\|preview\|development>`	Only variables for this environment

`cactive env add`

Add or replace a variable (the value is read from stdin when omitted).

cactive env add <key> [value] [options]

Also: cactive env set.

Argument	Notes
`key`	Variable name
`value`	Value Optional.

Flag	Notes
`-e, --environment <production\|preview\|development>`	Environments (repeatable; default: all three) Repeatable.
`--plain`	Not sensitive: the value can be read back (and pulled)
`--dev-readable`	A development-only secret developers can read back (env pull, dev); implies -e development

`cactive env rm`

Remove a variable.

cactive env rm <key>

Also: cactive env remove.

Argument	Notes
`key`	Variable name

`cactive env pull`

Write variables to a .env file (sensitive values are left out, except development secrets readable by developers).

cactive env pull [file] [options]

Argument	Notes
`file`	File (default: .env.local) Optional.

Flag	Notes
`-e, --environment <production\|preview\|development>`	Environment (default: development)

`cactive env push`

Add every variable in a .env file.

cactive env push [file] [options]

Argument	Notes
`file`	File (default: .env) Optional.

Flag	Notes
`-e, --environment <production\|preview\|development>`	Environments (repeatable; default: all three) Repeatable.
`--plain`	Not sensitive: values can be read back

`cactive secrets ls`

List secrets (the Serverless App Service's and shared ones; never values).

cactive secrets ls [options]

Also: cactive secrets list.

Flag	Notes
`-e, --environment <production\|preview\|development>`	Only secrets for this environment

`cactive secrets set`

Set a secret: a new version (the value is read from stdin when omitted).

cactive secrets set <key> [value] [options]

Also: cactive secrets add.

Argument	Notes
`key`	Secret name
`value`	Value Optional.

Flag	Notes
`-e, --environment <production\|preview\|development>`	Environments (repeatable; default: all three) Repeatable.
`--rotate-every <days>`	Remind owners and admins to rotate it after this many days

`cactive secrets get`

Print a secret's value, if its access rule lets you read it (audited).

cactive secrets get <key> [version]

Argument	Notes
`key`	Secret name
`version`	An earlier version's number (secrets versions lists them) Optional.

`cactive secrets versions`

List a secret's kept versions.

cactive secrets versions <key>

Argument	Notes
`key`	Secret name

`cactive secrets rm`

Remove a secret and its versions.

cactive secrets rm <key>

Also: cactive secrets remove.

Argument	Notes
`key`	Secret name

`cactive keys ls`

List keys.

cactive keys ls

Also: cactive keys list.

`cactive keys encrypt`

Encrypt text (read from stdin when omitted) and print the ciphertext.

cactive keys encrypt <key> [text] [options]

Argument	Notes
`key`	Key id or name
`text`	Text to encrypt Optional.

Flag	Notes
`-c, --context <name=value>`	Bind the ciphertext to name=value (repeatable; decrypting needs the same) Repeatable.
`--base64`	The input is base64 (binary data)

`cactive keys decrypt`

Decrypt a ciphertext (read from stdin when omitted) and print the text.

cactive keys decrypt <key> [ciphertext] [options]

Argument	Notes
`key`	Key id or name
`ciphertext`	Ciphertext (k1.…) Optional.

Flag	Notes
`-c, --context <name=value>`	The context it was encrypted with (repeatable) Repeatable.
`--base64`	Print the plaintext as base64

`cactive keys sign`

Sign a message (read from stdin when omitted) and print the signature.

cactive keys sign <key> [message] [options]

Argument	Notes
`key`	Key id or name
`message`	Message Optional.

Flag	Notes
`--base64`	The message is base64 (binary data)

`cactive keys verify`

Check a signature (exit status 1 when it doesn't match).

cactive keys verify <key> <signature> [message] [options]

Argument	Notes
`key`	Key id or name
`signature`	Signature (k1s.…)
`message`	Message (read from stdin when omitted) Optional.

Flag	Notes
`--base64`	The message is base64 (binary data)

`cactive domains ls`

List the Serverless App Service's domains and their DNS records.

cactive domains ls

Also: cactive domains list.

`cactive domains add`

Add a domain to the Serverless App Service.

cactive domains add <hostname> [options]

Argument	Notes
`hostname`	e.g. www.example.com

Flag	Notes
`--move`	It already serves a site: get the certificate first (one extra DNS record), then switch DNS without downtime

`cactive domains verify`

Check DNS and the certificate.

cactive domains verify <hostname>

Argument	Notes
`hostname`	The domain

`cactive domains cloudflare`

Create the DNS records with the organization's Cloudflare connection.

cactive domains cloudflare <hostname>

Argument	Notes
`hostname`	The domain

`cactive domains rm`

Remove a domain.

cactive domains rm <hostname>

Also: cactive domains remove.

Argument	Notes
`hostname`	The domain

`cactive open`

Open the production URL (or a deployment) in the browser.

cactive open [deployment] [options]

Argument	Notes
`deployment`	Deployment to open instead Optional.

Flag	Notes
`--cloud`	Open the Serverless App Service in Cloud instead

`cactive dev`

Run the dev server with the Serverless App Service's environment variables.

Runs the package.json dev script (or the command after --) with the Serverless App Service's variables in its environment.

Nothing is written to disk. Sensitive variables are left out, except development secrets readable by developers.

cactive dev [-- <command>...] [options]

Flag	Notes
`-e, --environment <production\|preview\|development>`	Environment to take variables from (default: production)

`cactive runs ls`

List runs, newest first.

cactive runs ls [options]

Also: cactive runs list.

Flag	Notes
`-R, --repo <org/name>`	Repository, org/name (default: this clone's)
`-w, --workflow <file>`	Only this workflow's file, e.g. ci.yml
`-b, --branch <value>`	Only this branch
`-s, --status <queued\|in_progress\|waiting\|completed\|success\|failure\|cancelled\|startup_failure>`	Only runs in this state
`--event <push\|pull_request\|schedule\|workflow_dispatch>`	Only runs started by this event
`-n, --limit <n>`	How many (default 20, at most 100)

`cactive runs view`

Show a run: its jobs, reviews waiting, annotations and artifacts.

cactive runs view <run> [options]

Argument	Notes
`run`	Run number

Flag	Notes
`-R, --repo <org/name>`	Repository, org/name (default: this clone's)
`--attempt <n>`	An earlier attempt
`--web`	Open it in the browser

`cactive runs logs`

Print a job's log (the failed job's by default).

cactive runs logs <run> [job] [options]

Argument	Notes
`run`	Run number
`job`	Job name or id Optional.

Flag	Notes
`-R, --repo <org/name>`	Repository, org/name (default: this clone's)
`-f, --follow`	Keep printing until the job ends

`cactive runs rerun`

Run a finished run again as a new attempt.

cactive runs rerun <run> [options]

Argument	Notes
`run`	Run number

Flag	Notes
`-R, --repo <org/name>`	Repository, org/name (default: this clone's)
`--failed`	Only the failed jobs and what needs them
`--job <key>`	Only this job (and what needs it)

`cactive runs cancel`

Cancel a run.

cactive runs cancel <run> [options]

Argument	Notes
`run`	Run number

Flag	Notes
`-R, --repo <org/name>`	Repository, org/name (default: this clone's)

`cactive runs start`

Run a workflow by hand (workflow_dispatch).

cactive runs start <workflow> [options]

Argument	Notes
`workflow`	Workflow file, e.g. deploy.yml

Flag	Notes
`-R, --repo <org/name>`	Repository, org/name (default: this clone's)
`--ref <value>`	Branch (default: the default branch)
`-f, --field <name=value>`	An input, name=value (repeatable) Repeatable.

`cactive mcp`

Print the MCP server configuration for AI clients.

cactive mcp

`cactive git setup`

Use this CLI as git's credential helper for the git host.

cactive git setup [options]

Flag	Notes
`--remove`	Remove the helper again

`cactive git promote`

Fast-forward a protected branch to another branch (for pushes over 5 MB).

cactive git promote <branch> <from> [options]

Argument	Notes
`branch`	The protected branch, e.g. main
`from`	The branch whose tip it moves to

Flag	Notes
`-R, --repo <org/name>`	Repository, org/name (default: this clone's)

`cactive git allow-secret`

Allow findings a push was refused for, for an hour, when they aren't secrets.

cactive git allow-secret <repo> <fingerprint...> [options]

Argument	Notes
`repo`	Repository, org/name
`fingerprint`	Fingerprints the refused push printed

Flag	Notes
`--reason <text>`	Why these aren't secrets (required)

`cactive upgrade`

Update to the latest version.

cactive upgrade [options]

Flag	Notes
`--check`	Only check

`cactive completion`

Print a shell completion script.

bash: cactive completion bash >> ~/.bashrc

zsh: cactive completion zsh > "${fpath[1]}/_cactive"

fish: cactive completion fish > ~/.config/fish/completions/cactive.fish

PowerShell: cactive completion powershell >> $PROFILE

cactive completion <shell>

Argument	Notes
`shell`	bash, zsh, fish, powershell (`bash`, `zsh`, `fish`, `powershell`)

`cactive version`

Show the version.

cactive version

`cactive help`

Show help for a command.

cactive help [command...]

Argument	Notes
`command`	Command Optional.

Command reference

On this page