Use the CLI

The origin CLI lets you manage Origin Cloud from a terminal. Install it, log in once, and every command runs as you until your session expires.

Before you begin

• An Origin Cloud user account.
• A Linux or macOS machine with an x86-64 or ARM64 processor. The CLI isn’t built for Windows.

Install the CLI

The CLI is published at packages.origincloud.eu as one binary per platform, with a SHA256SUMS file and a GPG signature over it.

The Linux builds are statically linked and run on any distribution.

Install with the install script

1. Run the install script. It picks the binary for your machine, verifies it against SHA256SUMS, and installs it to ~/.local/bin:

   curl -fsSL https://packages.origincloud.eu/install.sh | sh

   The script installs nothing if the checksum doesn’t match, or if your machine has neither sha256sum nor shasum to check it with.

2. If the script reports that ~/.local/bin isn’t on your PATH, add it:

   export PATH="$HOME/.local/bin:$PATH"

3. Verify the installation:

   origin --version

The script reads these environment variables:

For example, to install a specific version:

curl -fsSL https://packages.origincloud.eu/install.sh | ORIGIN_VERSION=v1.9.15 sh

Install with apt on Debian and Ubuntu

The CLI is also published as an apt repository, as the package origincloud-cli for amd64 and arm64. apt then installs updates together with the rest of your system. The repository carries stable versions only.

1. Install the Origin Cloud release key as an apt keyring:

   sudo curl -fsSLo /usr/share/keyrings/origincloud-archive-keyring.gpg \
     https://packages.origincloud.eu/apt/origincloud-archive-keyring.gpg

   Optionally, check its fingerprint against FEE6 FD74 A88C 5DB8 959F 5A1B 0BE6 AF84 2E0B 034A:

   gpg --show-keys /usr/share/keyrings/origincloud-archive-keyring.gpg

2. Add the repository:

   echo "deb [signed-by=/usr/share/keyrings/origincloud-archive-keyring.gpg] https://packages.origincloud.eu/apt stable main" \
     | sudo tee /etc/apt/sources.list.d/origincloud.list

3. Install the CLI:

   sudo apt-get update
   sudo apt-get install origincloud-cli

4. Verify the installation:

   origin --version

sudo apt-get upgrade installs newer CLI versions as they are released. The package puts the binary at /usr/bin/origin; if you installed it with the install script too, the copy in ~/.local/bin comes first on most PATHs, so remove one of them.

Install manually

Each version lives under https://packages.origincloud.eu/cli/<version>/, and https://packages.origincloud.eu/cli/latest names the latest stable version.

1. Download the binary for your platform, the checksum file and its signature. For Linux on x86-64:

   version="$(curl -fsSL https://packages.origincloud.eu/cli/latest)"
   base="https://packages.origincloud.eu/cli/${version}"
   curl -fsSLO "$base/origin-linux-amd64"
   curl -fsSLO "$base/SHA256SUMS"
   curl -fsSLO "$base/SHA256SUMS.asc"

2. Optional: verify the signature on SHA256SUMS with the Origin Cloud release key:

   curl -fsSL https://packages.origincloud.eu/origincloud-release.asc | gpg --import
   gpg --verify SHA256SUMS.asc SHA256SUMS

   gpg reports Good signature from Origin Cloud Release <release@origincloud.eu>. Check that the key’s fingerprint is exactly:

   FEE6 FD74 A88C 5DB8 959F  5A1B 0BE6 AF84 2E0B 034A

   A different fingerprint means the key didn’t come from Origin Cloud. Don’t install the binary.

3. Verify the binary against the checksum file. On macOS, use shasum -a 256 --check instead of sha256sum --check.

   sha256sum --check --ignore-missing SHA256SUMS

4. Make the binary executable and put it on your PATH:

   chmod +x origin-linux-amd64
   mkdir -p ~/.local/bin
   mv origin-linux-amd64 ~/.local/bin/origin

5. Verify the installation:

   origin --version

Released versions never change: the files under a version’s directory are the same every time you download them.

Log in

origin id login opens the Origin Cloud login page in your browser and waits for you to log in there. The CLI never sees your password. Whatever the login page offers works, including a second factor.

1. Run the login command:

   origin id login

   If no browser opens, the CLI prints the address to open yourself.

2. Log in on the page that opens. The CLI waits up to five minutes, then stops with an error.

3. Verify that you’re logged in. The CLI prints who you are when the login finishes, and this command shows your user:

   origin iam current-user

Log in without a browser

On a machine without a browser, such as a server you reached over SSH, use a device code instead.

1. Run the login command with --device:

   origin id login --device

   The CLI prints an address, a short code, and how many minutes the code stays valid.

2. Open the address on any other device, such as your laptop or phone. Check that the page shows the same code, then log in and approve the request.

3. The CLI finishes on its own once you approve. It fails if you deny the request or the code expires first.

How sessions work

A login stores a session for your local user account. The CLI renews the session’s access token automatically whenever it has expired. When the session itself expires, commands fail with authentication: not authenticated, and you run origin id login again.

The session is stored in ~/.local/share/origincloud/, or under $XDG_DATA_HOME/origincloud/ if you set that variable. Treat the directory like a password: anyone who can read it can act as you until the session expires.

For scripts and CI jobs, which can’t log in interactively, use a service account instead. See Service accounts.

Use your access token outside the CLI

origin id token prints the current access token, renewing it first if it has expired. Without a valid session, it fails with unauthenticated. Use it to call the GraphQL API with your own tools.

For example, to send an API request with curl:

curl -sS https://api.origincloud.eu/graphql \
  -H "$(origin id token --as-header --raw)" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ admin { organisations { orgId name status } } }"}'

Set profile values

The profile holds local defaults for the CLI. origin config profile shows it, and origin config profile-set <key> <value> changes one value.

For example:

origin config profile-set default-username jane@example.com

The profile is stored in ~/.config/origincloud/, or under $XDG_CONFIG_HOME/origincloud/ if you set that variable.

Read the output

Every command prints JSON on standard output. Login prompts and messages go to standard error, so you can pipe the output into a tool such as jq.

• On success, a command exits with 0 and prints the data the API returned.

• On failure, it exits with 1 and prints a failure envelope. The description carries the API’s message, its error code in parentheses and the correlation id:

  {
    "code": "failure",
    "description": "invalid input on field quota: organisation quota exceeded: ... (BAD_REQUEST) [correlation: 4bf92f3577b34da6a3ce929d0e0e4736]"
  }

The code in the envelope is always failure. For what the API error code means, see Error codes.

Global options

These options go before the command group, for example origin --api <url> compute list-instances ....

For every command and its options, see the CLI reference of each guide, starting with Platform CLI commands.

Related

• Use the GraphQL API
• Platform CLI commands
• origin compute commands
• origin storage commands
• origin network commands
• origin iam commands