Account and access commands

These commands manage your login, your SSH keys and sign-ins, organization members, Box grants, and the service accounts and API keys that programs use. Apart from login and version, each one calls the API with your stored login. Of these, only whoami works with an API key; see API-key mode. Organizations and access explains roles and grants, and Manage organization members walks through adding people and granting them Boxes.

cubicle loginCopy Anchor Link

Signs this computer in by approving a code in the Dashboard. Log in to the CLI walks through the approval.

cubicle login [--api URL] [--no-browser]

• The CLI prints a Dashboard link and a code. On a terminal, and without --no-browser, it asks Press Enter to open the browser…; Enter opens the link with open on macOS or xdg-open on Linux.
• It checks for your approval every 2 s from the start, whether or not you press Enter. Once you choose Authorize, it stores the session and prints Logged in as <identity>.
• All output goes to stderr. --json has no effect.
• The code expires after 10 minutes. The CLI then fails with expired_token: device login expired; start again.
• Choosing Deny fails with login was denied in the browser.
• The session lasts 30 days. Then commands fail with login expired; run `cubicle login` .
• The CLI keeps one login. Logging in again replaces the stored login but does not end the previous session. End it with cubicle sessions revoke, or run cubicle logout first.
• Later commands use the API URL stored with the login, not CB_CLI_API_URL.

Calls POST /v1/auth/device and POST /v1/auth/device/token. Files the CLI writes lists where the token is stored.

cubicle login

To log in, open:
  https://app.cubicle.sh/device?user_code=WDJB-MJHT
and confirm the code WDJB-MJHT.
Press Enter to open the browser…
Logged in as dev@example.com.

cubicle logoutCopy Anchor Link

Signs this computer out.

cubicle logout

No options. The command does three things, in order:

1. It disconnects the private network if it is connected.
2. It ends the session on the server. If that fails, for example because the session has expired, it carries on.
3. It removes the stored login from this computer.

It prints Logged out. on stderr and exits 0, also when you were not logged in. The tunnel stays installed. Calls POST /v1/auth/logout.

cubicle whoamiCopy Anchor Link

Prints who you are signed in as and your role in each organization.

cubicle whoami [--json]

No options besides --json.

• Output: <identity> (<org>:<role>, …), with organizations in name order, or <identity> (no orgs).
• --json prints the whole response: your id, identity and operator flag, and for each organization its id, name, role, personal and boxCreateAllowed. With an API key it also has apiKey.
• With an API key, it shows the service account and its one organization, for example acme/ci (acme:member).

Calls GET /v1/me.

cubicle whoami

dev@example.com (acme:member, dev:owner)

dev is the personal organization of dev@example.com. Use cubicle whoami --json to see whether an organization can create Boxes (boxCreateAllowed).

cubicle versionCopy Anchor Link

Prints the CLI's version, build target and default API. It does not call the API.

cubicle version [--json]

No options besides --json. --json prints the bundle's build information, including version, commit, target and apiUrl.

cubicle version

cubicle <version> (darwin-arm64)
default API: https://api.cubicle.sh

cubicle keysCopy Anchor Link

Manages the SSH public keys on your account. These are keys for SSH logins to Boxes, not API keys. Adding or removing one updates your guest account on every Box you have a grant on. See SSH into a Box.

cubicle keys listCopy Anchor Link

Lists your active SSH keys, oldest first.

cubicle keys list [--json]

No options besides --json.

• Output: one line per key, <key ID> <fingerprint> <comment>.
• --json prints an array of keys with id, fingerprint, comment, publicKey and createdAt.

Calls GET /v1/keys.

cubicle keys list

5d2c8f41-9a7e-4b3c-8d1f-2e6a0b9c7d5e  SHA256:p4V0c2k8m3FQ0Vt7n1dJm9yG2sLwR6eXhB5uK1aZq0E  dev@laptop

cubicle keys addCopy Anchor Link

Adds an SSH public key from a file.

cubicle keys add [PUBKEY_FILE] [--json]

• Only ssh-ed25519 keys are accepted, up to 1000 characters. Other types fail with invalid_key: only ssh-ed25519 public keys are accepted. Create one with ssh-keygen -t ed25519.
• The key's comment is kept, cut to 200 characters.
• A key that is already on your account fails with conflict: resource already exists.
• Output: added <fingerprint>. --json prints the key's id, fingerprint and createdAt.

Calls POST /v1/keys.

cubicle keys add ~/.ssh/id_ed25519.pub

added SHA256:p4V0c2k8m3FQ0Vt7n1dJm9yG2sLwR6eXhB5uK1aZq0E

cubicle keys rmCopy Anchor Link

Removes one of your SSH keys. Your guest accounts stop accepting it.

cubicle keys rm KEY_ID

No options. KEY_ID is an ID from cubicle keys list. The command prints nothing. An unknown ID fails with not_found: key not found. Calls DELETE /v1/keys/{key}.

cubicle keys rm 5d2c8f41-9a7e-4b3c-8d1f-2e6a0b9c7d5e

cubicle sessionsCopy Anchor Link

Your sign-ins: one for each cubicle login and each Dashboard sign-in.

cubicle sessions listCopy Anchor Link

Lists your live sessions, most recently used first.

cubicle sessions list [--json]

No options besides --json.

• Output: one line per session, <session ID> <client>[ (this login)] last used <time|never> expires <time>.
• <client> is cli or dashboard. (this login) marks the session this CLI uses.
• --json prints an array with id, client, createdAt, lastUsedAt, expiresAt and current.

Calls GET /v1/sessions.

cubicle sessions list

9c1e7a52-3d4b-4f8a-b6e2-1a0c9d8e7f6b  cli (this login)  last used 2026-11-05T09:12:44.120Z  expires 2026-12-05T09:02:10.553Z
4a7d2e19-8b3c-4e5f-a1d6-0c9b8e7f6a5d  dashboard  last used 2026-11-04T17:40:02.981Z  expires 2026-11-30T08:15:37.004Z

cubicle sessions revokeCopy Anchor Link

Ends one of your sessions, for example the CLI login on a lost laptop.

cubicle sessions revoke SESSION_ID

No options. The command prints nothing.

• You can revoke the session this CLI uses. The CLI then fails with login expired; run `cubicle login` until you log in again.
• An ID that is not yours, or is already ended, fails with not_found: session not found.

Calls DELETE /v1/sessions/{session}.

cubicle sessions revoke 4a7d2e19-8b3c-4e5f-a1d6-0c9b8e7f6a5d

cubicle membersCopy Anchor Link

Manages an organization's members. Every members command needs --org.

cubicle members listCopy Anchor Link

Lists the organization's members, sorted by identity. Any active member can list them.

cubicle members list --org ORG [--json]

• Output: one line per member, <user ID> <identity> <role> <status>.
• <status> is active or revoked. Service accounts appear with their ORG/NAME identity.
• --json prints an array with id, identity, role, status and serviceAccount.
• The user ID is what grants add, grants rm and members rm take.

Calls GET /v1/orgs/{org}/members.

cubicle members list --org acme

1f4a9b7c-2d3e-4f50-8a6b-7c8d9e0f1a2b  acme/ci  member  active
6b9e0d2c-41af-4c3b-8e2d-5f7a9c1b3d4e  dev@example.com  member  active
9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a  ops@example.com  owner  active

cubicle members addCopy Anchor Link

Adds an existing Cubicle user to the organization.

cubicle members add --org ORG IDENTITY [--role member|admin|owner] [--json]

• IDENTITY is the exact email address the user signs in with, or one of the organization's service accounts as ORG/NAME, to change its role; see Service accounts as members. A person must already have an account; otherwise the command fails with not_found: user not found.
• You need the owner or admin role. Only an owner can add an owner (forbidden: only owners can add owners).
• If the user is already a member, or was removed, the command sets their role and makes them active.
• Output: <identity> is <role>. --json prints id, identity and role.

Calls POST /v1/orgs/{org}/members.

cubicle members add --org acme dev@example.com --role admin

dev@example.com is admin

cubicle members rmCopy Anchor Link

Removes a member from the organization. They lose access to all of its Boxes.

cubicle members rm --org ORG USER_ID

• USER_ID is an ID from cubicle members list. You need the owner or admin role.
• The last owner cannot be removed: last_owner: an organization needs at least one owner.
• Removing one of the organization's service accounts ends that account, as service-accounts rm does.
• The command prints nothing.

Calls DELETE /v1/orgs/{org}/members/{user}.

cubicle members rm --org acme 6b9e0d2c-41af-4c3b-8e2d-5f7a9c1b3d4e

cubicle grantsCopy Anchor Link

Manages who may use a Box. Box grants explains what a grant allows and who needs one, and Grant access to a Box walks through giving one. BOX is a Box ID or ORG/NAME; see Box arguments.

cubicle grants listCopy Anchor Link

Lists a Box's grants, sorted by identity. Any active member of the Box's organization can list them.

cubicle grants list BOX [--json]

No options besides --json.

• Output: one line per grant, <user ID> <identity> <status> <guest account>.
• <status> is active or revoked. The guest account is the Box account that the member's commands and SSH logins use; see Guest accounts.
• --json also prints desiredRevision and appliedRevision. A change has reached the Box when the two match.

Calls GET /v1/boxes/{box}/grants.

cubicle grants list acme/job-1

1f4a9b7c-2d3e-4f50-8a6b-7c8d9e0f1a2b  acme/ci  active  jv_1f4a9b7c2d3e
6b9e0d2c-41af-4c3b-8e2d-5f7a9c1b3d4e  dev@example.com  active  jv_6b9e0d2c41af

cubicle grants addCopy Anchor Link

Gives a member access to a Box.

cubicle grants add BOX USER_ID

No options.

• USER_ID is a person's ID from cubicle members list, or a service account's ID from cubicle service-accounts list. They must be an active member of the Box's organization; otherwise the command fails with not_found: member not found.
• You need the owner or admin role. You can grant a Box to yourself.
• The grant creates the member's guest account in the Box, or reactivates a revoked grant.
• The command prints nothing.

Calls PUT /v1/boxes/{box}/grants/{user}.

cubicle grants add acme/job-1 1f4a9b7c-2d3e-4f50-8a6b-7c8d9e0f1a2b

cubicle grants rmCopy Anchor Link

Revokes a member's access to a Box. Revoking access says what happens to their guest account.

cubicle grants rm BOX USER_ID

No options.

• Owners and admins can revoke any grant. A member can revoke their own.
• A user without an active grant fails with not_found: grant not found.
• The command prints nothing.

Calls DELETE /v1/boxes/{box}/grants/{user}.

cubicle grants rm acme/job-1 1f4a9b7c-2d3e-4f50-8a6b-7c8d9e0f1a2b

cubicle service-accountsCopy Anchor Link

Manages an organization's service accounts: non-interactive members that programs use through API keys. You need the owner or admin role and an interactive login. Every service-accounts command needs --org. See Service accounts and API keys.

cubicle service-accounts listCopy Anchor Link

Lists the organization's service accounts and their API keys.

cubicle service-accounts list --org ORG [--json]

• Output: one line per account, <account ID> <identity> <role>, followed by one indented line per API key, key <key ID> <name> <scope> <hint>… last used <time|never>.
• <hint> is the first 12 characters of the key, to recognize it. Prints no service accounts when there are none.
• Keys that expired but were not revoked are still listed. --json shows each key's expiresAt, createdAt and createdBy.

Calls GET /v1/orgs/{org}/service-accounts.

cubicle service-accounts list --org acme

1f4a9b7c-2d3e-4f50-8a6b-7c8d9e0f1a2b  acme/ci  member
  key 7e3b1c9d-5a4f-4e2b-9c8d-0a1b2c3d4e5f  github-actions  write  cbk_Q7mZ2xRk…  last used 2026-11-05T08:30:11.402Z

cubicle service-accounts createCopy Anchor Link

Creates a service account with the identity ORG/NAME. Create a service account and a key shows the steps that follow.

cubicle service-accounts create --org ORG NAME [--role member|admin] [--json]

• NAME matches ^[a-z0-9][a-z0-9-]{0,62}$. A name in use fails with conflict: service account ci already exists.
• Output: created <identity> (<account ID>). --json prints the account, with an empty keys list.

Calls POST /v1/orgs/{org}/service-accounts.

cubicle service-accounts create --org acme ci

created acme/ci (1f4a9b7c-2d3e-4f50-8a6b-7c8d9e0f1a2b)

cubicle service-accounts rmCopy Anchor Link

Deletes a service account.

cubicle service-accounts rm --org ORG ACCOUNT

• ACCOUNT is the account's ID or its NAME, such as ci.
• Its membership ends, its grants and API keys stop working, and its name is free again.
• An unknown account fails with not_found: service account not found.
• The command prints nothing.

Calls DELETE /v1/orgs/{org}/service-accounts/{account}.

cubicle service-accounts rm --org acme ci

cubicle api-keysCopy Anchor Link

Issues and revokes a service account's API keys. You need the owner or admin role and an interactive login. ACCOUNT is the service account's ID or NAME.

cubicle api-keys createCopy Anchor Link

Creates an API key and prints it once.

cubicle api-keys create --org ORG ACCOUNT NAME --scope read|write [--expires-days N] [--json]

• NAME matches ^[a-z0-9][a-z0-9._-]{0,62}$. If the account already has a key with that name that is not revoked, even an expired one, the command fails with conflict: resource already exists.
• Without --scope, the command prints its usage: line and exits 1.
• Output: the key (cbk_…) on the first line, then Store this key now; it is not shown again., both on stdout. See The key is shown once.
• --json prints the key's details with its token. In scripts, use cubicle api-keys create … --json | jq -r .token.

Calls POST /v1/orgs/{org}/service-accounts/{account}/keys.

cubicle api-keys create --org acme ci github-actions --scope write --expires-days 90

cbk_Q7mZ2xRk…
Store this key now; it is not shown again.

cubicle api-keys revokeCopy Anchor Link

Revokes an API key. Requests with it fail from then on.

cubicle api-keys revoke --org ORG ACCOUNT KEY_ID

• KEY_ID is the key's ID from cubicle service-accounts list.
• An unknown or already revoked key fails with not_found: API key not found.
• The command prints nothing.

Calls DELETE /v1/orgs/{org}/service-accounts/{account}/keys/{key}.

cubicle api-keys revoke --org acme ci 7e3b1c9d-5a4f-4e2b-9c8d-0a1b2c3d4e5f