kinde-cli

Kinde command line utility

Status

This is a work in progress. APIs may change without notice or be missing.

Features

• Official CLI for interacting with Kinde APIs.
• Secure handling of credentials via OS-specific secrets store.
• Verifiable authenticity
  • single native binary for ease of maintenance and deployment
  • Ships for multiple platforms - Linux, MacOS, Windows
  • Ships for multiple architectures - x64, i386, ARM, Apple ARM
  • Each variation comes with the checksum to verify authenticity
• Secure by default. Kinde business cannot be managed via the CLI until a new M2M application is created with the management API authorized and the select scopes granted.

TODO:

• Online token verification
  • Offline token verification
• Support for user tokens and account API
  • Spport for account API

Getting Started

Installation

macOS with Homebrew

brew tap kinde-oss/kinde-cli
brew install kinde-cli

Update:

brew upgrade kinde-cli

Windows with Scoop

scoop bucket add kinde https://github.com/kinde-oss/scoop-kinde-cli
scoop install kinde-cli

Update:

scoop update kinde-cli

Linux

curl -s https://pkg.kinde.com/apt/gpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/kinde.gpg
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/kinde.gpg] https://pkg.kinde.com/apt/ * *" > /etc/apt/sources.list.d/kinde.list'
sudo apt update
sudo apt install kinde-cli

Update:

apt update
apt install --only-upgrade kinde-cli

Download and install the appropriate package for your architecture:

Example uses bash, the following shells are also supported:

• bash
• zsh
• fish
• powershell

ARM64 (aarch64):

curl -L https://github.com//kinde-oss/kinde-cli/releases/latest/download/kinde-cli_linux_arm64.deb > kinde-cli_linux_arm64.deb ; sudo dpkg -i kinde-cli_linux_arm64.deb ; source <(kinde completion bash)

x64 (amd64):

curl -L https://github.com//kinde-oss/kinde-cli/releases/latest/download/kinde-cli_linux_amd64.deb > kinde-cli_linux_amd64.deb ; sudo dpkg -i kinde-cli_linux_amd64.deb ; source <(kinde completion bash)

Download pre-built binary for your architecture/OS

Download a pre-built binary from Releases.

📋 Supported Architectures and Formats: See Installation Architectures for comprehensive information about all supported operating systems, architectures, package formats, and installation methods.

Install from source using Go

go install github.com/kinde-oss/kinde-cli/cmd/kinde@latest

Quick Start and top-level commands

kinde help for top-level help

kinde help <command> to get options for each command

Authentication

To login using client credentials

kinde login --domain <your Kinde business domain> \
--client_id <M2M application> \
--client_secret <M2M application secret> 

To login using device authorization flow

Please configure a default application for device flow or specify client_id

kinde login
    --domain <your Kinde business domain>
    --client_id [optional]

Check authentication status

Terminal autocomplete

Kinde CLI comes with terminal autocompletion support for bash, fish, powershell, and zsh

You can see instructions for your shell/OS combination by executing the following

kinde help completion <bash|fish|powershell|ash>

1. Use kinde <command> to interact with your Kinde account.

Usage

Commands

• login – Authenticate with Kinde.
  • Multi-tenancy is supported via --domain <your Kinde business domain>
• logout – Remove authentication credentials.
• whoami – Show current authenticated token details.
• version – Show current version and check for updates.
• manage - provides access to management API
• help – Show help for commands.

Version Check

The version command displays your current Kinde CLI version and automatically checks for updates against the latest GitHub releases:

kinde version

This command will:

• Display the current installed version
• Check the latest release from the GitHub repository
• Compare versions using semantic versioning
• Show whether an update is available or if you're using the latest version
• Handle development builds and pre-release versions appropriately

Flags

• --help – Show help information.

Management API sub-commands

Subcommand	Description
api_keys	Manage API keys
apis	Manage APIs
applications	Manage applications
billing	Manage billing
business	Manage business settings
categories	Manage categories
connected_apps	Manage connected applications
connections	Manage connections
environment_variables	Manage environment variables
environments	Manage environments
events	Manage events
feature_flags	Manage feature flags
industries	Manage industries
organizations	Manage organizations
permissions	Manage permissions
properties	Manage properties
roles	Manage roles
subscribers	Manage subscribers
timezones	Manage timezones
users	Manage users
webhooks	Manage webhooks

📖 Complete Reference: See Manage Commands Reference for detailed documentation of all subcommands and their available operations.

Configuration

Configuration is stored in $HOME/.kinde/config.json by default for *nix-based systems, <user profile>\.config\kinde\config.json for Windows. You can set API keys, business, and other preferences.

Example:

{
  "current": "mybusiness.kinde.com",
  "environments": {
    "mybusiness.kinde.com": {
      "domain_name": "app.kinde.com"
    },
    "mybusiness2.localkinde.com": {
      "domain_name": "app.localkinde.com"
    },
    "mybusiness2.kinde.com": {
      "domain_name": "mybusiness2.kinde.com",
      "client_id": "xxx",
      "client_secret": "yyy"
    }
  }
}

Examples

• List users:

  kinde manage users get_all --page_size 2
  

• Show token details of the logged-in user:

  kinde whoami
  

• Create a user

  kinde manage users create
  

• Create an environment-level feature-flag of type string

    kinde manage feature_flags create --name "first flag" --key "first_key" --allow_override_level "env" --type "str"
  

Troubleshooting

• CLI validates the token against public JWKS and requires internet connectivity.
• Check your configuration file for errors.
• Ensure your API credentials are valid. To use management API, please create an M2M application and grant it access to the management API, enable appropriate scopes to grant the specific level of access.
• Keychain Configuration: You can configure keychain behavior using environment variables:
  • KINDE_KEYCHAIN_PASS - Override the default keychain password when user interaction is not possible
  • KINDE_LOG_LEVEL - Set the logging level for the CLI
  • KINDE_STRUCTURED_LOG - Enable JSON-only output for CI/CD or automated processing (default: false, set to true to enable)
• Linux Keychain: On Linux systems, the CLI uses filesystem-based keychain storage instead of system keychains. This design choice ensures compatibility with server environments and CI/CD pipelines where system keychain services may not be available or accessible.

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

License

This project is licensed under the MIT License. See LICENSE for details.

Changelog

See CHANGELOG.md for release notes and version history.