Govern agents from your terminal

The IdentArk CLI is the operational companion to the control plane. Use it to register agents, keep credential references out of your repository, and review human-in-the-loop approvals without giving a production agent raw credentials.

Install

pip install identark-cli
identark --version

The CLI requires Python 3.11 or later. Pin the version in CI or a deployment image when you need a repeatable release.

Sign in

Authenticate with a browser

```bash identark auth login identark auth status ```

The CLI starts a device-authorisation flow, then stores the resulting
session in your operating system keychain. It never prints the raw token.

Use a headless machine or CI

```bash identark auth login --no-browser ```

For automation, provide a narrowly scoped key at runtime instead of
persisting one on disk:

```bash
export IDENTARK_API_KEY='csk_…'
identark agent list
```

Set up an agent project

identark init
identark credential add OPENAI_API_KEY --ref vault://prod/openai
identark credential scan --strict

identark init creates .identark/config.toml. That file holds project configuration and references such as vault://prod/openai or env://OPENAI_API_KEY—never the credential value itself. Commit the configuration if it is useful to your team; do not commit a .env file containing real secrets.

identark agent register \
  --name support-agent \
  --provider anthropic \
  --model claude-sonnet-4-5 \
  --credential-ref vault://prod/anthropic

identark agent list

Production boundary

For a production agent, use the SDK's ControlPlaneGateway or an IdentArk managed connector. The agent receives a scoped capability and the control plane enforces policy, records activity, and applies any required approval. See Going to production for the runtime pattern.

CI or operator terminal  →  IdentArk CLI
Production agent         →  ControlPlaneGateway / managed MCP tools
Sensitive operations     →  capability checks + human approval when required

Review high-risk work

identark approvals list
identark approvals inspect <approval-id>
identark approvals approve <approval-id>
identark approvals reject <approval-id> --reason "Unexpected production change"

Approvals require an explicit command. A pending approval expires to deny; the CLI has no auto-approve mode.

Production runtime

Run agents with a scoped session, not provider credentials.

MCP and HITL

Put policy and human review in front of high-risk tools.