Reference

CLI reference

Commands for creating services, managing credentials, and checking usage.

Requires Node.js 20 or later. Run npx extraorbital, or install globally with npm i -g extraorbital and use eo.

Without credentials, the CLI registers the machine and starts in a free sandbox. Run login to link it to your account.

Commands

Command	Does
`provision [resource...] [dir]`	Detect what the project needs and is missing, provision it, write `.env`
`catalog [service]`	Explore the services, their settings and environment variables
`snippets <resource> [platform] [action]`	Setup and usage code for a resource, for your platform
`add <resource...> [dir]`	Provision named resources, or generate a local secret
`list`	Every resource in the project, or in the whole team
`usage`	This month's spend by resource, with monthly history
`ledger`	Recent charges, newest first
`push [dir]`	Send the variables in your env file to Vercel, with a credential per target
`credentials`	Who holds each credential of a resource; temporary credentials; revoke one
`whoami`	Your account, team, linked project and token state
`teams`	List, create and switch teams, and manage members
`link`	Link this folder to an existing or new project
`open`	Open the dashboard, deep-linked to the current project
`remove <resource> [dir]`	Deprovision a resource and delete its block
`backups`	List, download and sync backups and project archives, and set backup policies
`projects`	List, create, or delete projects
`migrate`	Move legacy MongoDB data
`login` · `logout`	Link or unlink this machine
`feedback "<message>"`	Send feedback to the ExtraOrbital team

extraorbital provision

Detects supported variables without values, creates their services, and writes credentials. Repeating the command reuses existing resources.

Terminal

npx extraorbital provision [resource...] [dir] [--dry-run] [--yes]

extraorbital provision: example output

Output

Provisioning 2 resources for .

  mongo  MONGODB_URI · declared in .env.example
  s3     S3_BUCKET +4 · used in src/upload.ts

✓ Provisioned mongo/default (database skills-dev-703c90-default)
✓ Wrote 1 variable to .env — MONGODB_URI

✓ Provisioned s3/default (bucket skills-dev-703c90-default, us-east-1)
✓ Wrote 5 variables to .env

2 resources created · no card required

Free allowances and resource limits depend on the service, and apply on the Free plan only. Unlinked machines can spend up to $5 each before you link them and are limited by the Free tier limits; usage is billed to your account after linking. See pricing.

Local secrets, such as JWT_SECRET, are generated offline first. To select a service, use npx extraorbital provision mongo.

Flag	Default	Description
`[resource...]`	all that are missing	Provision only these
`[dir]`	`.`	Directory to read and write in (or `--dir <path>`)
`--dry-run`	off	Print the plan and the reason for each line, change nothing
`--yes`	off	Skip the confirmation prompt at an interactive terminal
`--local`	off	Generate detected local secrets only; no network, no account
`--generate <spec>`	—	A secret to mint too, repeatable — see local secrets
`--no-generate`	off	Mint no secrets, only provision
`--export-env`	off	Print cloud credentials to stdout instead of writing `.env`

See detection rules. Without a terminal, the CLI runs without prompts.

Detected services use the slug default. Use add --slug for another instance.

At a terminal, a new folder prompts for its team and project. See link.

The CLI adds the environment file to .gitignore. Already-tracked files remain tracked; the CLI warns and shows how to untrack them. Rotate credentials that were committed to Git.

extraorbital catalog

Reads the current server catalog. For a named service, shows its options and environment variables.

Terminal

npx extraorbital catalog [service]

Terminal

npx extraorbital catalog          # every service
npx extraorbital catalog mongo    # settings and variables for one

extraorbital snippets

Prints the code that uses a resource: the install command, the environment variables it reads, and the client set up for your platform, or the code for one task. It is the same code the resource guides show.

Terminal

npx extraorbital snippets mongodb                 # setup, for the platform this folder is
npx extraorbital snippets redis python cache      # one task, on a named platform
npx extraorbital snippets actions redis node      # the tasks there is code for
npx extraorbital snippets platforms authlocker    # the platforms there is code for

Platforms are nextjs, node, python and cloudflare-workers. Without one, it is read from the project: next in package.json means nextjs, a Wrangler config cloudflare-workers, a pyproject.toml or requirements.txt python, and any other package.json node. The code names variables and never holds a value: provision writes the values to .env. It needs no account. --json prints the answer as one object.

extraorbital add

Creates named resources and writes credentials. Reusing (team, project, service, slug) returns the existing resource. A local secret name generates a value offline instead.

Terminal

npx extraorbital add <resource...> [dir] [--slug <name>] [--team <slug>] [--project <id>] [options]

Flag	Default	Description
`<resource...>`	—	A name from `catalog`, such as `s3`, `r2`, `b2`, `mongodb`, `postgres`, `redis`, `vector`, `auth`, `ai`, `deepgram`, `gladia`, `realtime`, `git`, or `stripe`. Multiple services: `add s3 mongo`
`[dir]`	`.`	Directory to write in (or `--dir <path>` when a resource name is also a folder)
`--slug`	`default`	A named second instance in the same project
`--yes`	off	Accept provisioning without a prompt
`--dry-run`	off	Show the requested resources without provisioning
`--export-env`	off	Print cloud credentials to stdout instead of writing `.env`
`--team`, `--project`	from `.extraorbital.json`	Refused when they disagree with a pinned pair

Service-specific options come from the server catalog and apply to one resource at a time. See its resource guide for accepted values.

Repeated requests reuse the resource:

extraorbital add: example output

Local secrets

Local secrets are random values generated on your machine, without a network request. provision generates detected secrets, add generates a named secret, and provision --local skips hosted services.

Terminal

npx extraorbital add SESSION_SECRET
npx extraorbital add JWT_PRIVATE_KEY --alg es256
npx extraorbital provision --local

Local secrets: example output

Output

✓ Generated 3 secrets in .env — BETTER_AUTH_SECRET, JWT_SECRET, VAPID_PRIVATE_KEY + VAPID_PUBLIC_KEY
Nothing else has a copy yet: the comment above each one names who else must hold it.
Give them this value, or replace it with theirs — a value you set is never regenerated.
! Took the liberty: JWT_SECRET is a shared HMAC key (32 random bytes, hex). For a keypair instead:
  npx extraorbital add JWT_SECRET --alg es256 --replace

Detection uses templates, unfilled environment variables, and source references. Existing values in environment files or the shell are preserved. Known template placeholders such as supersecret, tobemodified, and changethis count as empty.

Comments identify where each secret is used or shared. Keypairs include both private and public values:

dotenv

# >>> extraorbital resource=generated slug=default
# Counterparty: every service that verifies these tokens must hold this same value.
JWT_SECRET=5f0c…
# Counterparty: every push subscription is bound to VAPID_PUBLIC_KEY. Changing the pair
# breaks them all; browsers have to subscribe again.
VAPID_PRIVATE_KEY=y35J…
# Public half of VAPID_PRIVATE_KEY (VAPID, P-256): the counterparty's copy.
# Safe to share.
VAPID_PUBLIC_KEY=BEJG…
# <<< extraorbital resource=generated

Edit a value inside the block to use your own — it is kept on every later run.

What it recognises

Variable	For	Value
`BETTER_AUTH_SECRET`, `AUTH_SECRET`, `NEXTAUTH_SECRET`	Better Auth, Auth.js, NextAuth	32 bytes, base64
`AUTH0_SECRET`	Auth0 Next.js SDK	32 bytes, hex
`WORKOS_COOKIE_PASSWORD`, `SESSION_PASSWORD`, `NUXT_SESSION_PASSWORD`, `LOGTO_COOKIE_SECRET`	WorkOS AuthKit, iron-session, nuxt-auth-utils, Logto	32 bytes, base64
`KEYSTATIC_SECRET`	Keystatic	40 bytes, hex
`JWT_SECRET`, `JWT_KEY`, `JWT_SIGNING_KEY`	Any HS256 signer	32 bytes, hex — or a keypair on request
`SESSION_SECRET`, `COOKIE_SECRET`	Express, Remix, Keystone, Medusa, Fastify	32 bytes, hex
`SECRET_KEY`, `DJANGO_SECRET_KEY`, `FLASK_SECRET_KEY`	Django, Flask, FastAPI, Outline	32 bytes, hex
`SECRET_KEY_BASE`	Rails, Phoenix, Plausible	64 bytes, hex
`APP_SECRET`	Symfony, Umami, Twenty	32 bytes, hex
`PAYLOAD_SECRET`	Payload	32 bytes, hex
`SECRET`	Directus — only where declared, never from a match in code	32 bytes, hex
`CRON_SECRET`	Vercel Cron	32 bytes, hex
`ASTRO_KEY`, `NEXT_SERVER_ACTIONS_ENCRYPTION_KEY`	Astro server islands, self-hosted Next.js	32 bytes, base64
`ADMIN_JWT_SECRET`, `API_TOKEN_SALT`, `TRANSFER_TOKEN_SALT`	Strapi	16 bytes, base64
`ENCRYPTION_KEY`	Many apps	32 bytes, hex
`CALENDSO_ENCRYPTION_KEY`	Cal.com	Exactly 32 characters
`MB_ENCRYPTION_SECRET_KEY`, `TOTP_VAULT_KEY`	Metabase, Plausible	32 bytes, base64
`APP_KEY`	Laravel, AdonisJS	`base64:` and 32 bytes
`AIRFLOW__CORE__FERNET_KEY`	Airflow	Fernet: 32 bytes, url-safe base64 with padding
`JWT_PRIVATE_KEY` + `JWT_PUBLIC_KEY`	Asymmetric JWTs	ES256 keypair, PEM
`VAPID_PRIVATE_KEY` + `VAPID_PUBLIC_KEY`	Web Push	P-256 keypair, plus `NEXT_PUBLIC_VAPID_PUBLIC_KEY` where you read it

Provider-issued secrets, including STRIPE_WEBHOOK_SECRET and GITHUB_CLIENT_SECRET, are never generated. Neither is N8N_ENCRYPTION_KEY, which n8n creates itself. Defaults are listed above; use flags to select a different format.

Flag	Default	Description
`--bytes <count>`	`32`	Length of a local secret
`--encoding <format>`	`base64url`	`base64`, `base64url`, `base64url-padded` or `hex`
`--alg <algorithm>`	—	Generate a keypair instead: `es256`, `rs256`, `ed25519` or `vapid`
`--replace`	off	Generate again a secret ExtraOrbital wrote. A line you wrote is refused
`--generate <spec>`	—	On `provision`: also mint `NAME[:BYTES][:ENCODING]`, or `NAME:ALGORITHM` for a keypair. Repeatable
`--no-generate`	off	On `provision`: mint nothing, only provision

extraorbital list

Lists project resources, including those created by other machines. Outside a linked folder, or with --all, lists all projects in the team and adds a PROJECT column.

Terminal

npx extraorbital list [--all] [--project <id>] [--json]

extraorbital list: example output

Output

  skills.dev · 4 resources · $4.99 this month

  RESOURCE         STATUS  CREATED BY         CREATED       THIS MONTH
  s3/default       active  brave-fox-a3f2     Aug 1 09:14   —            (not metered)
  mongo/analytics  active  brave-fox-a3f2     Aug 1 09:20   —            (not metered)
  redis/default    active  steady-crane-77e1  Aug 2 14:41   —            (not metered)
  openrouter/default  active  brave-fox-a3f2  Aug 3 11:02   $4.99        (budget $10.00)

  extraorbital list --all to list resources from every project in the team

extraorbital usage

This month's spend by resource, with three completed months of history. In a linked folder it shows that project; elsewhere it shows the selected team.

Terminal

npx extraorbital usage [--project <slug> | --all] [--month <yyyy-mm>] [--resource <type/slug>]

extraorbital usage: example output

Output

  August 2026 · namespace swift-heron-9c1f

  $5.40 this month   $0.19/day avg · projected $5.89

  skills.dev     ████████████████████████████ $4.99
  lunar-moth     ██                           $0.41
                 └─────────────────────────────────┘
                 $0                              $5

  DAILY  Aug 1 ──────────────────────────── Aug 14
         ▁▃▂▅▇▆▄▃▅█▆▄▃▂▄▅▇█▆▅▃▂▁▂▃▅▆▇█▆▄▂

Prototype allowance covers $5.00 of this · $0.40 billable

Piped output uses a plain table.

Flag	Default	Description
`--month <yyyy-mm>`	current	Billing month (UTC)
`--from` / `--to`	—	Explicit ISO range, overrides `--month`
`--project <slug>`	linked project	Read an existing project without attaching this directory
`--all`	off	Every project in the selected team
`--resource <type/slug>`	all	Focus on one resource
`--group-by <dim>`	`project`	`project`, `resource`, `service`, `machine`, `day`, `metric`
`--interval <day\|hour>`	—	Include a time series in JSON
`--csv` / `--json`	—	Export formats
`--no-graph`	off	Plain tables. Implied when stdout is not a TTY

extraorbital ledger

Recent charges, newest first. Interactive terminals offer the next page; automation passes --limit and --cursor.

Terminal

npx extraorbital ledger [--project <slug> | --all] [--month <yyyy-mm>] [--limit <n>] [--cursor <cursor>]

Flag	Default	Description
`--month <yyyy-mm>`	current	Billing month (UTC)
`--from` / `--to`	—	Explicit ISO range
`--project <slug>`	linked project	Read an existing project without attaching this directory
`--all`	off	Every project in the selected team
`--resource <type/slug>`	all	Focus on one resource
`--kind <usage\|provision\|all>`	`usage`	Which events to show
`--limit <n>`	`20`	Rows per page, 1–200
`--cursor <cursor>`	—	Continue the previous page. JSON includes `nextCursor`
`--csv` / `--json`	—	Export formats. JSON includes zero-cost entries and full references

extraorbital push

Sends the variables in your env file to a linked Vercel project as sensitive values.

Terminal

npx extraorbital push [dir] [--to vercel] [--target production|preview] [--env-file <path>] [--dry-run] [--yes]

Terminal

npx extraorbital push --to vercel --target production
npx extraorbital push --target production,preview
npx extraorbital push --dry-run        # the plan, nothing sent

Reads the first existing file: .env.production, .env.local, then .env. Skips empty values and placeholders. Run vercel link first. Authentication uses VERCEL_TOKEN or the Vercel CLI session.

Where supported, each Vercel target gets a separate credential. Only its mask and hash are retained; its previous credential is revoked after 24 hours. Providers without separate credentials use the shared value, identified in the output.

extraorbital push: example output

Values are stored as sensitive and cannot be read back. Only production and preview are supported. Existing values for the same target are overwritten. Redeploy to apply them.

Flag	Default	Description
`[dir]`	`.`	Directory to read
`--to <destination>`	`vercel`	Where to push
`--target <environment>`	`production`	`production` or `preview`; repeat the flag or separate with commas
`--env-file <path>`	first that exists	The file to read
`--dry-run`	off	Show what would be pushed and change nothing
`--yes`	off	Push without asking; required when nobody can answer. Never provisions

extraorbital credentials

Where supported, each machine receives its own resource credentials. Unlinking a machine revokes those credentials without affecting other machines.

Terminal

npx extraorbital credentials neon/db                       # who holds what
npx extraorbital credentials create neon/db --ttl 1h --read  # temporary, printed once
npx extraorbital credentials revoke neon/db --machine old-laptop
npx extraorbital credentials revoke neon/db cr_0123456789abcdef01234567
npx extraorbital credentials rotate neon/db --grace 24h --yes  # new secret, written to .env

rotate writes the new secret into the resource's block in .env (or .env.local, or --env-file), the same block provision writes, and prints only the variable names it changed. It writes the block if there is none yet. A credential .env does not hold, such as a labelled one or another machine's, is printed instead. A sensitive resource's new secret stays out of .env unless you pass --write-env.

extraorbital credentials: example output

Output

CREDENTIAL                   HOLDER                          MASK       STATUS  EXPIRES               LAST FETCHED
cr_…01                       shared                          —          active  —                     —
cr_…02                       this machine                    abcd…wxyz  active  —                     2 minutes ago
cr_…03                       machine old-laptop              efgh…stuv  active  —                     3 weeks ago
cr_…04                       deploy vercel:my-app:production 1a2b…9z8y  active  —                     1 day ago
cr_…05                       temporary                       q1w2…e3r4  active  2026-10-08T15:00:00Z  —

The shared credential is the resource’s primary credential, also used by deployments from before CLI 0.7.0. Rotate it after those deployments have migrated. Providers without per-machine credentials, including vector and legacy MongoDB, continue to share it.

Flag	Description
`--ttl <duration>`	`create`: a temporary credential (`30m`, `1h`, `7d`, at most `30d`), revoked at its expiry
`--read`	`create`: read-only
`--label <label>`	`create`: its name
`--machine <label\|hostId>`	`revoke`: the credential that machine holds
`--grace <duration>`	`rotate`: keep the old secret working this long; without it, the old secret stops working at once
`--no-env`	`rotate`: print the new secret to stdout and leave `.env` alone
`--write-env`	`rotate`: write a sensitive resource's new secret to `.env` too
`--yes`	`rotate`: do not ask first; required when nobody can answer

extraorbital whoami

extraorbital whoami: example output

Output

  user       severin
  namespace  swift-heron-9c1f
  machine    brave-fox-a3f2
  team       vercel (owner)
  project    skills.dev (.extraorbital.json)
  plan       prototype · no human linked
  token      expires in 6d

A team that pays for usage from prepaid credit gets a balance row too.

extraorbital teams

Manage teams, their members, and the default team for new projects.

Terminal

npx extraorbital teams                          # list
npx extraorbital teams new <slug>               # create
npx extraorbital teams switch [slug]            # the default team for new projects
npx extraorbital teams members [--team <slug>]  # who is in it
npx extraorbital teams add-member <email> [--role admin|member]

extraorbital teams: example output

Output

  TEAM           ROLE   MEMBERS  PROJECTS  RESOURCES  THIS MONTH  CREATED
▸ default        owner  1        3         5          $5.40       Aug 1
  scraper-fleet  owner  3        1         2          $0.41       Aug 4

  ▸ default team · extraorbital teams switch <slug> to change it

The default team is saved for this account. Folders already linked keep their team; use link to move one.

extraorbital link

Saves the folder’s team and project. provision and add also prompt for these when needed.

Terminal

npx extraorbital link [--project <slug>] [--team <slug>] [--label <label>] [--yes]

At a terminal, choose a team and an existing or new project. The CLI suggests a repository, folder, or Vercel project name and normalizes invalid names.

Terminal

npx extraorbital link --team acme --project skills.dev
npx extraorbital link --project auto     # name it after the repository or folder

Without a terminal, pass --project and, if no default team is saved, --team. Use --project auto to derive the name.

--yes asks nothing: the default team and a project named after the folder, marked Unsorted in the dashboard until somebody renames it there. A folder that is already linked keeps its link. The dashboard shows, for each project, the folders and machines it is linked from.

Where a project lives

The dashboard shows each project’s locations: every folder linked to it, as Séverin’s MacBook Pro: ~/Projects/web, and the repository those folders are checkouts of, as GitHub: acme/web. Each location shows when it was last active, meaning when an extraorbital command last ran there.

To fill this in, the CLI sends the following when you run link, and in the background when any command runs in a linked folder (no more than once every 10 minutes per folder):

dirName: the folder’s name.
path: the folder’s path, with your home directory written as ~ (~/Projects/web). A path outside the home directory is sent as is (/srv/web).
git: the host, owner and repository from git remote get-url origin (github.com, acme, web). The CLI never sends the remote URL itself, so the scheme, user name and any token in it stay on your machine. A folder with no origin sends nothing here.

The machine is the one making the request. Locations are visible only to members of the project’s team, just like the project. A failed report never fails the command and never delays it by more than a moment. ~/.extraorbital/cache/locations.json records when each folder last reported.

Use a team you belong to, by ID or slug. link changes the folder’s target; it does not move existing resources.

extraorbital open

Opens the dashboard for the current project or a named view.

Terminal

npx extraorbital open         # the current project
npx extraorbital open usage
npx extraorbital open ledger
npx extraorbital open project lunar-moth
npx extraorbital open resource s3/default

--no-browser prints the URL and opens nothing.

extraorbital projects

Lists, creates and deletes the selected team's projects.

Terminal

npx extraorbital projects                  # projects with resources, machines and spend
npx extraorbital projects new <name>       # create one without linking this folder
npx extraorbital projects rm <name>        # delete one

Deletion requires the project name at a terminal, or --yes without one. Remove its resources first, or use --force to delete them too.

Flag	Description
`--yes`	Skip typing the project name
`--force`	Delete the project's resources along with it
`--label <label>`	Human-readable name, for `projects new`

extraorbital remove

Deprovisions a resource and deletes its fenced block. Stateful resources keep data recoverable for seven days. Requires --yes when stdin is not a terminal.

Terminal

npx extraorbital remove <resource> [dir] [--slug <name>] [--yes] [--force]

extraorbital remove: example output

Flag	Description
`--slug <name>`	The named instance, when it is not `default`
`--yes`	Skip the confirmation prompt
`--force`	Give up the recovery window and ignore an unreachable service

extraorbital backups

Lists backups and project archives, downloads them with a verified checksum, mirrors them into a folder, and shows or sets backup policies.

Terminal

npx extraorbital backups <resource>                  # one resource's backups
npx extraorbital backups [--project <p>]             # a project's backups and archives
npx extraorbital backups download <id> --to ./backups
npx extraorbital backups sync --project web --to ./backups
npx extraorbital backups policy --project web --preset extended
npx extraorbital backups policy redis/cache --rule daily:14 --rule monthly:6

Listings show each artifact's RETENTION periods and COPIED, the number of machines holding a verified copy. --json prints the rows.

download resumes partial files with HTTP Range and verifies SHA-256 before recording the copy. A checksum mismatch deletes the partial file and exits 1. Downloads require a machine identity, not an eo_live_ key.

sync writes this layout and records it in .extraorbital-backups.json:

extraorbital backups: example output

Sync downloads missing or invalid files. It deletes nothing unless --allow-deletes is set; then it removes only manifest-listed files whose backups the server has pruned. Other files are untouched.

policy accepts presets or custom rules. Project policies include project archives. Resource policies add to the project’s policy.

Preset	Keeps
`light`	daily×7
`standard`	daily×7, weekly×4, monthly×12 (the default for paid resources)
`extended`	hourly×24, daily×30, weekly×12, monthly×24, yearly×5
`off`	nothing scheduled

Policies need Pay-as-you-go or Enterprise. A Free team gets exit code 3 and the link to upgrade.

Flag	Description
`--to <dir>`	download and sync: the folder (download defaults to `.`)
`--include resources\|projects\|all`	sync: resource backups, project archives, or both (default)
`--allow-deletes`	sync: delete manifest files whose backup was pruned
`--dry-run`	sync: print what would change, change nothing
`--preset <preset>`	policy: `light`, `standard`, `extended` or `off`
`--rule <period:keep>`	policy: a custom rule, repeatable; periods `hourly`, `daily`, `weekly`, `monthly`, `yearly`
`--members all\|a,b`	policy: the resources a project policy covers (default all)

extraorbital migrate

Migrates a legacy MongoDB database to the managed provider at the same project and slug. Stop application writes first. Migration copies data, checks document counts and index names, then replaces credentials and deletes the old database after cutover.

Missing documents always abort migration and preserve the original. Other differences require an explicit cutover decision or --accept-differences; --yes does not approve cutover. The new MONGODB_URI is printed once.

Terminal

npx extraorbital migrate mongo/<slug> [--follow] [--yes] [--accept-differences]

extraorbital migrate: example output

Flag	Description
`--follow`	Wait for it to finish, decide if verification finds differences, print the new credentials
`--yes`	Skip typing the slug (required without a terminal); never decides a cut-over
`--accept-differences`	With `--follow`: cut over when verification finds only differences that lose no documents. A copy missing data still aborts

A legacy deepgram, gladia or authlocker resource moves with npx extraorbital credentials rotate <service>/<slug>: a new credential on v2, the legacy one deleted.

Links this machine to your account. Open the printed URL, sign in, and approve access. The machine can then act in your teams using its own credential.

Terminal

npx extraorbital login [--human] [--no-browser] [--token <token>] [--logout]

Output

  Open https://extraorbital.dev/machines/link/ml_3f9a… to link keen-vole-0a8c to your account
  Opened your browser

⠋ Waiting for the link…
✓ Linked keen-vole-0a8c to severin@example.com
  Its 9 projects are in team default
  It acts as you from its next command · npx extraorbital logout undoes this

Choose the team that should receive the machine’s sandbox. A machine can belong to one person at a time; use logout before linking another account. --human creates a one-week device-code session instead; --login runs that flow before another command.

Linking transfers the sandbox’s projects, resources, and usage to the selected team. Review the transferred spend before approving; it counts against that team’s balance. Unlinked machines can spend up to $5 each before you link them and are limited by the Free tier limits; usage is billed to your account after linking. On a pay-as-you-go team it is on the next invoice; on a Free team it waits for the first invoice after the team moves to a paid plan. Credentials stay unchanged. Conflicting project IDs receive a machine-name suffix, and the CLI updates .extraorbital.json.

Flag	Description
`--human`	Sign in as a person with a device code instead of linking the machine
`--token <token>`	Skip the browser and use a token directly. For CI. Also read from `EXTRAORBITAL_TOKEN`
`--no-browser`	Print the URL instead of opening a browser
`--logout`	Delete the credentials `--human` cached

extraorbital logout

Unlinks this machine from the account it acts as: the mirror of login.

Terminal

npx extraorbital logout [--yes]

extraorbital logout: example output

Output

  Unlink keen-vole-0a8c from severin@example.com? [y/N] y
✓ Unlinked keen-vole-0a8c from severin@example.com
  What it built stays with its team · it works in a fresh free sandbox now
  npx extraorbital login to link it to an account again

Unlinking leaves existing projects with their team and keeps the machine’s keypair. Future commands use a new free sandbox. The machine no longer acts as the previous owner.

Run logout on the machine, or unlink it from Settings → Machines.

Flag	Description
`--yes`	Do not ask for confirmation. Required when there is no terminal to ask at

extraorbital feedback

Sends a message to the ExtraOrbital team. It works signed in or not; a linked machine or account is attached so the team knows who wrote.

Terminal

npx extraorbital feedback "provision picked the wrong Postgres" [--email you@example.com] [--remember-email]

Flag	Description
`--email <address>`	Where a reply goes. Also `EXTRAORBITAL_FEEDBACK_EMAIL`, the remembered address, or your account's. At a terminal it is asked for when none is known; it is optional
`--remember-email`	Keep the address for next time, in `~/.extraorbital/settings.json`

Anything shaped like a secret is blanked before the message is stored.

extraorbital love

Chooses your one beneficiary: a person or an open source project (Giving back). Written --❤️ (or --love), with a slug, a repository or a domain:

Terminal

npx extraorbital --❤️ <slug|org/repo|domain>

extraorbital --❤️: example output

The slug is stored in ~/.extraorbital/affiliate.json and passed to your account when this machine is linked, or at once when it is linked already. Your account keeps the first slug that reaches it, from a referral link or from any machine: one person or one project, never both, and never changed. A later one changes nothing, and the command says You already support X; each account supports one person or project, once. While at least one of your teams pays for your seat, your beneficiary is given $10 a month, up to $120 — still $10 a month on five paid teams.

A repository URL (https://github.com/org/repo, git@github.com:org/repo.git) is stored as org/repo; another forge keeps its host (gitlab.com/org/repo); a URL on a site is stored as its domain (slices.sh). A repository or domain nobody has claimed is kept for its maintainers. Beside another command (npx extraorbital login --❤️ org/repo) the slug is stored first and that command runs. See Giving back.

Local files

Local credentials are stored in ~/.extraorbital/: machine.json for the keypair, credentials.json for a human session, and affiliate.json for a --❤️ slug. Files must have mode 0600, inside a 0700 directory; looser permissions are rejected. .extraorbital.json stores project IDs and can be committed:

.extraorbital.json

{
  "projectId": "skills.dev",
  "teamId": "team_9c1f77a2_vercel",
  "server": "https://extraorbital.dev"
}

Global flags and environment

Flag	Env	Default
`--server <url>`	`EXTRAORBITAL_SERVER_URL`	`https://extraorbital.dev`
`--token <token>`	`EXTRAORBITAL_TOKEN`	cached credentials
`--team <slug>` (alias `--scope`)	`EXTRAORBITAL_TEAM`	from `.extraorbital.json`
`--project <id>`	`EXTRAORBITAL_PROJECT_ID`	from `.extraorbital.json`
`--env-file <path>`	`EXTRAORBITAL_ENV_FILE`	`.env.local` if it exists, else `.env`
`--json`	—	One JSON object on stdout, logs on stderr
`--markdown`	—	Readable Markdown, without prompts or colors
`--non-interactive`	—	Never ask a question; print the command that answers it
`--quiet` / `--verbose`	—	normal
`--no-color`	`NO_COLOR`	colour when a TTY
`--login`	—	Sign a human in first, instead of using this machine
`--no-login`	—	Exit 4 rather than registering this machine

Color adapts to the terminal and is disabled when piped or with NO_COLOR.

Reads check .env and .env.local. Writes use .env.local if it exists, otherwise .env.

Exit codes

Use exit codes in automation:

Code	Meaning	The agent should
`0`	Success	Continue
`1`	Generic failure	Read stderr
`2`	Usage error, including a pinned-pair conflict	Fix the command; do not retry as-is
`3`	Payment required	Surface the link URL to a human and wait
`4`	Not authenticated, with `--no-login` set	Supply a token, or drop the flag and let the machine register
`5`	Provisioning in progress	Retry with backoff; another worker holds the lease
`6`	Rate limited	Respect `Retry-After`
`7`	Upstream provider failure	Retry; the resource is left retryable
`8`	A provider key was answered by a substitute (the AI Gateway, or a Gladia/Deepgram broker) that this project cannot use as written: nothing reads the base URL it works through, or the provider's SDK cannot talk to the gateway	Read the base-URL variable written to `.env` (e.g. `OPENAI_BASE_URL`), or switch to an OpenAI-compatible client

Agents and CI

Use --non-interactive, --json, and the exit code. Supply a token when an existing account’s access is required.

boot.sh

#!/usr/bin/env bash
set -euo pipefail

# Idempotent: provisions on first boot, no-ops afterwards.
npx extraorbital provision --non-interactive --yes

Terminal

npx extraorbital provision --json | jq -r '.provisioned[].resource'
# mongo/default
# s3/default

← Previous

Git

API reference