Use the axl CLI

axl is the command-line half of the platform. Everything the HTTP API exposes it can reach, and a few things it cannot: signing a config bundle, ingesting a document corpus, minting the very first credential a deployment has.

It is one binary. What it talks to - which server, with which credential, against which Redis and which config bundle - is decided by a profile, so the commands themselves stay short.

Get the binary

There are three ways, in ascending order of how often you will run it:

# From a checkout, without installing
cargo run -p axl-cli --bin axl -- agents list

# The binary a build already produced
./target/debug/axl agents list

# Installed on PATH
cargo install --path crates/axl-cli
axl agents list

The -- in the first form matters: it separates cargo's arguments from the CLI's.

First run

A fresh machine needs a credential before the server will answer. That is two commands:

axl key generate-jwt                              # an RS256 keypair
axl config init --jwt-private-key ~/.axl/keys/jwt_private.pem \
  --user-id you@example.com --role admin

The server must be running with the matching public key in JWT_PUBLIC_KEY. See Get a credential for what the roles and scopes mean, and what to do when the server's key is not yours to mint against.

Then check it:

axl config show      # what resolved, and where each value came from
axl agents list      # the first call that needs the server

What people actually use it for

Every command takes -o json and writes the payload to stdout while status lines go to stderr, so any of them can be piped into jq without --quiet.

Next