Global options are commonly available to use with multiple Openlayer CLI commands.
API key
The --api-key option can be used to provide an Openlayer API key
when running Openlayer CLI commands.
For example, to push without having to run openlayer login:
Custom CA bundle
The --ca-bundle <path> option trusts extra CA certificates in addition to your system
roots, for deployments behind a private CA. Each <path> may be a PEM file or a directory of
certificates. Repeat the flag to pass several paths. The CLI uses them for sign-in, API
requests, and bundle uploads.
--ca-bundle is a global option, so you can use it with any command.
A single PEM file can contain multiple certificates concatenated together. For a directory,
the CLI loads every .pem, .crt, and .cer file directly inside it (not recursively). If a
certificate cannot be parsed, the CLI reports which file and which certificate failed rather
than skipping the bad block.
OPENLAYER_CA_BUNDLE and the deprecated INTERNAL_CERT_PATH accept the same paths as a list,
separated by : on Unix or ; on Windows.
Disable certificate verification
The --insecure option skips certificate verification for all CLI requests. It is a global
option, so you can use it with any command.
Skipping certificate verification is unsafe. Prefer --ca-bundle when your
deployment uses a private CA.
Debug
The --debug option can be used to provide a more verbose output when running Openlayer CLI commands.
Profile name
The --profile-name option can be used to specify the profile name to read from for config (default "default").
Environment variables
The CLI also reads configuration from environment variables. They are the simplest way to
configure the CLI in CI/CD and other non-interactive environments, because they replace
openlayer login and
openlayer link entirely:
Self-hosted deployments behind a private CA
If your self-hosted Openlayer deployment uses a certificate issued by a private or enterprise
CA, pass --ca-bundle when you sign in. Repeat the flag, point it at a directory, set a
list-separated environment variable, or concatenate the certificates into one PEM file:
On login, the CLI saves the CA bundle path(s) to the active profile as one list-separated
string. Later commands pick it up automatically, so you do not need to pass the flag or
environment variable again.
For certificate settings, the CLI uses the command-line flag first, then the environment
variable, then the value saved in the active profile. The first source that is set wins
outright — sources are not merged.
What to put in the bundle:
- If the server presents the leaf certificate and the intermediates, the root alone is enough.
- If the server presents the leaf only, include the intermediates as well.
- Including the whole chain is always safe; when in doubt, include it.
On macOS, the CLI can reject a certificate that curl and the Python SDK accept with a message
like:
Supply --ca-bundle to resolve this. Prefer it over --insecure.
Output mode
The --output-mode option controls how the CLI formats its output. It accepts terminal
(the default, with colors and interactive progress) or ci (plain output suited for CI logs).
ci is also a no-prompt guard: in this mode the CLI never asks for input. A command that
would otherwise prompt fails with an error telling you to pass the value as a flag or
environment variable, rather than hanging on a missing terminal.
That makes the commands that used to be terminal-only usable in automation:
openlayer login signs in from
--api-key or OPENLAYER_API_KEY. An explicitly supplied key is enough on its own — you do
not have to pass --output-mode ci for this.openlayer link links to the
project named by --project. --output-mode ci implies its --yes flag.openlayer init runs the whole setup
flow from flags.
Version
The --version option can be used to verify the version of Openlayer CLI being used.
