> ## Documentation Index > Fetch the complete documentation index at: https://keyflare.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # CLI Reference > Complete reference for the kfl CLI # CLI Reference (`kfl`) Complete reference for the Keyflare command-line interface. ## Installation ```bash theme={null} npm install -g @keyflare/cli ``` Or use directly with npx: ```bash theme={null} npx @keyflare/cli ``` ## Global Options | Option | Description | | ------------------ | ------------------------------------------------------------------------ | | `--api-url ` | Override API URL (default: from config) | | `--api-key ` | Override API key (default: from credentials file or `$KEYFLARE_API_KEY`) | | `--project ` | Override default project | | `--env ` | Override default environment | | `--help` | Show help | | `--version` | Show version | ## Commands ### `kfl init` Deploy or update Keyflare on your Cloudflare account. ```bash theme={null} kfl init [-y] [--name ] [--d1id ] [--master-key ] ``` | Flag | Description | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-y, --yes` | Skip confirmation prompts (auto-accept) | | `--name ` | Worker and database name (default: `keyflare`). Must start with a lowercase letter, contain only lowercase letters, numbers, and hyphens, and be 63 characters or less. | | `--d1id ` | Bind to an existing D1 database by UUID. Creates new DB if not provided (or uses the existing binding if a worker exists already). | | `--master-key ` | Custom master key (base64-encoded 256-bit) | **Authentication:** * Reuses existing Wrangler session when available * Falls back to `CLOUDFLARE_API_TOKEN` environment variable * Prompts for OAuth browser login or API token if neither available **Preflight Check:** Before creating a new bootstrap key, `kfl init` checks your local configuration: * If the new API URL differs from your stored URL, you'll see a warning * If credentials exist locally and a new bootstrap key would be created, you'll be prompted to confirm If you decline the prompt: * The worker is still deployed/updated * Bootstrap is skipped (someone else can run it) * Your local config and credentials are preserved Use `-y` to auto-accept all prompts. **Multiple Instances:** You can deploy multiple Keyflare instances by using different names: ```bash theme={null} kfl init --name keyflare-prod kfl init --name keyflare-staging ``` **Using an Existing D1 Database:** To bind Keyflare to an existing D1 database (e.g., for migration or disaster recovery): ```bash theme={null} kfl init --d1id 12345678-1234-1234-1234-123456789abc ``` This skips database creation and binds the worker to the specified database. Migrations will run against it on first deploy. *** ### `kfl login` Log in to an existing Keyflare deployment. ```bash theme={null} kfl login ``` Interactive prompts for: 1. Keyflare API URL 2. API key Saves credentials to `~/.config/keyflare/`. *** ### `kfl projects` Manage projects. ```bash theme={null} # List all projects kfl projects list # Create a project (with dev and prod environments) kfl projects create # Create a project without default environments kfl projects create --environmentless # Delete a project kfl projects delete ``` | Flag | Description | | ------------------- | ------------------------------------------- | | `--environmentless` | Create project without default environments | *** ### `kfl environments` (alias: `env`) Manage environments. ```bash theme={null} # List environments in a project kfl env list --project # Create an environment kfl env create --project # Delete an environment kfl env delete --project ``` *** ### `kfl secrets` Manage secrets. ```bash theme={null} # Set secrets kfl secrets set = --project --env kfl secrets set KEY1=val1 KEY2=val2 --project --env # Get a secret kfl secrets get --project --env # List secrets (values hidden) kfl secrets list --project --env # Delete a secret kfl secrets delete --project --env # Upload from .env (full override) kfl secrets upload --project --env # Download secrets kfl secrets download --project --env [options] ``` Upload replaces ALL existing secrets in the target environment. | Option | Description | | ----------------- | ------------------------------------------------------- | | `--format ` | Output format: `env` (default), `json`, `yaml`, `shell` | | `--output ` | Write to file (default: stdout) | Legacy aliases are still available but deprecated: `kfl upload`, `kfl download`. *** ### `kfl run` Run a command with secrets injected as environment variables. Commands are executed directly (argv-preserving), so quoting works reliably for cases like `node -e '...'`. If you need shell features (`$VAR` expansion, pipes, redirects, `&&`), run an explicit shell command such as `sh -c 'echo $MYSECRET | cut -d@ -f2'`. ```bash theme={null} kfl run --project --env -- [args...] ``` | Flag | Description | | ------------------ | ---------------------------------------- | | `--project ` | Project name (or set `KEYFLARE_PROJECT`) | | `--env ` | Environment name (or set `KEYFLARE_ENV`) | Examples: ```bash theme={null} kfl run --project my-api --env production -- npm run build kfl run --project my-api --env development -- npm run dev kfl run -- npm run dev # Uses defaults from config # Quoting is preserved for argv-based tools kfl run --project my-api --env Prod -- node -e 'console.log(process.env.MYSECRET)' # Use an explicit shell when you need shell operators / expansion kfl run --project my-api --env Prod -- sh -c 'echo $MYSECRET' kfl run --project my-api --env Prod -- sh -c 'echo $DATABASE_URL | cut -d@ -f2' ``` *** ### `kfl keys` Manage API keys. ```bash theme={null} # List all keys kfl keys list # Create a user key kfl keys create --type user --label "backup-admin" # Create a system key kfl keys create --type system \ --label "github-actions" \ --scope "my-api:production" \ --permission read # Update a system key's scopes kfl keys put \ --scope "my-api:production" \ --scope "my-api:staging" \ --permission readwrite # Revoke a key kfl keys revoke ``` | Flag | Description | | ----------------------- | ------------------------------------------------------------ | | `--type ` | Key type: `user` or `system` | | `--label