The Unkey CLI gives you direct access to the Unkey API from your terminal. Create and manage API keys, configure rate limits, set permissions, and query analytics — all without leaving the command line.
The CLI is early and provided on a best-effort basis. There are no breaking change guarantees for commands, flags, or output format. The underlying API is versioned and stable. Installation
Download the latest binary for your platform from GitHub Releases.# macOS (Apple Silicon)
curl -L https://github.com/unkeyed/unkey/releases/latest/download/unkey_darwin_arm64 -o unkey
chmod +x unkey
sudo mv unkey /usr/local/bin/
Authentication
Before using the CLI, authenticate with your root key:
This stores your key at ~/.unkey/config.toml. All subsequent commands use it automatically.
You can also pass a key per-command or via environment variable:
# Flag
unkey api keys create-key --root-key=unkey_xxx --api-id=api_123
# Environment variable
export UNKEY_ROOT_KEY=unkey_xxx
unkey api keys create-key --api-id=api_123
Usage
All API operations live under the unkey api command, organized by resource:
unkey api <resource> <action> [flags]
Resources
| Resource | Description |
|---|
apis | Create, get, delete API namespaces and list their keys |
keys | Create, verify, update, delete keys and manage their permissions and roles |
identities | Create, get, update, delete identities for grouping keys |
permissions | Create, get, delete permissions and roles |
ratelimit | Apply rate limits and manage overrides |
analytics | Query key verification data with SQL |
Examples
Create an API and issue a key:
unkey api apis create-api --name=payment-service-prod
unkey api keys create-key --api-id=api_1234abcd --name='Production Key' --enabled
unkey api keys verify-key --key=sk_1234abcdef
unkey api ratelimit limit --namespace=api.requests --identifier=user_123 --limit=100 --duration=60000
unkey api analytics get-verifications --query="SELECT COUNT(*) as total FROM key_verifications_v1 WHERE outcome = 'VALID' AND time >= now() - INTERVAL 7 DAY"
unkey api permissions create-permission --name=documents.read --slug=documents-read
unkey api keys add-permissions --key-id=key_1234abcd --permissions=documents.read,documents.write
Output
By default, the CLI prints the request ID with latency, followed by the response data:
req_2c9a0jf23l4k567 (took 45ms)
{
"id": "api_1234abcd",
"name": "payment-service-prod"
}
--output=json to get the raw API response envelope (meta + data) as JSON on stdout:
unkey api apis create-api --name=my-api --output=json | jq '.data.id'
Global Flags
Every command accepts these flags:
| Flag | Description |
|---|
--root-key | Override the root key (also: UNKEY_ROOT_KEY env var) |
--api-url | Override the API base URL (default: https://api.unkey.com) |
--config | Path to config file (default: ~/.unkey/config.toml) |
--output | Output format — use json for raw JSON |
Help
Every command has built-in help with descriptions, flag details, and examples:
unkey --help
unkey api --help
unkey api keys --help
unkey api keys create-key --help
Last modified on March 26, 2026
