Browse docs

CLI reference

Every scope, command, alias, flag, environment variable and exit code in the bitqate CLI.

Updated

On this page

Reference for the bitqate CLI. For the human-facing tour, see Install and set up the BitQate CLI, Manage VPSes with the CLI and Use the CLI in scripts, CI and AI agents.

Scopes

API tokens carry scopes; each command needs the one shown. Create tokens in Settings → API.

ScopeUnlocksCharges balanceDestroys data
account:readAccount, workspaces, transactions, prices
vms:readList/get VMs, nodes, OS images, networking, stats, SSH details
vms:powerStart, stop, restart
vms:writeCreate, resize, rename, renew, auto-renew, rDNS, backups createYes (create, resize, renew)
vms:deleteDelete a VM, reinstall it, restore/delete backupsYes
servers:readList/get servers, regions, install state, deployments, backups
servers:powerStart, stop, restart
servers:writeCreate, resize, rename, renew, ports, startup, deployYes (create, resize, renew)
servers:deleteDelete a server, reinstall it, restore/delete backupsYes

Commands

any means any valid token; none means no token needed.

Account

CommandScope
accountaccount:read
workspaces listaccount:read
transactions listaccount:read
pricesany

VMs

CommandScope
vms list · vms get <vm>vms:read
vms createvms:write
vms rename · resize · renew · auto-renewvms:write
vms start · stop · restartvms:power
vms reinstall · deletevms:delete
vms backups list · networking · stats · waitvms:read
vms backups create · rdnsvms:write
vms backups restore · deletevms:delete
vms ssh · openvms:read
vms nodes · osany

Servers

CommandScope
servers list · getservers:read
servers createservers:write
servers rename · resize · renew · auto-renewservers:write
servers start · stop · restartservers:power
servers reinstall · deleteservers:delete
servers backups list · deployments list/get/logsservers:read
servers install-state · waitservers:read
servers backups create · ports · startup · deployservers:write
servers backups restore · deleteservers:delete
servers openservers:read
servers regionsany

Setup and tools

CommandScope
auth login · logout · list · switchnone
auth statusany
open [<ref>]any
completion · help · schema · versionnone

Aliases

Groups: vm → vms, server/srv → servers. Subcommands: ls → list, show/info → get, rm → delete, new → create. Top level: whoami → account.

Global flags

FlagEffect
--jsonMachine-readable JSON on stdout
--yes, -ySkip confirmations
--quiet, -qPrint only resource IDs
--profile <name>Config profile to use
--api-url <url>Override the API base URL
--dry-runPrint the request without sending it
--verboseLog requests to stderr
--no-colorDisable colored output
--help, -hShow help

Environment variables

VariableEffect
BITQATE_TOKENAPI token (overrides profiles)
BITQATE_API_URLAPI base URL
BITQATE_PROFILEProfile to use
BITQATE_OUTPUTjson forces JSON output
BITQATE_CONFIG_DIRConfig directory (default ~/.config/bitqate)
BITQATE_PORTAL_URLPortal origin for open
NO_COLORDisable color when set
FORCE_COLORForce color level (0–3)

Exit codes

CodeMeaningCodeMeaning
0Success5Not found
1Server/network error6Conflict
2Usage error7Rate limited
3Unauthenticated8Payment required
4Forbidden (scope)9Wait timed out
130Cancelled

Security model

  • Tokens are only ever read from a profile or BITQATE_TOKEN; there is no --token flag.
  • API URLs must be HTTPS, or HTTP only on loopback (for development).
  • The CLI only ever calls /v1/* API-key endpoints; a stored token can never reach session or admin routes.
  • Profile tokens are bound to the API URL they were logged in with.
  • Only GETs retry: bounded retries on 429 (honouring Retry-After) and once on a network error. Writes are never retried.
  • SSH and open spawn with argument arrays; no shell is involved.
  • Config is 0600 inside a 0700 directory, written atomically.

What API tokens can't do

Deliberately out of scope, so a leaked token has limits: changing your password or email, the browser console, buying extra IPs, the file manager, database admin tools, connecting a git repository, and anything admin-level. Those stay in the dashboard behind your login session.

Still stuck?

Our team can look at your specific setup.

Open a ticketAsk on Discord