curl -fsSL https://your-konnecthub-host/install.sh | shOn Windows, from PowerShell:
irm https://your-konnecthub-host/install.ps1 | iexThe installer is served by the same KonnectHub you sign in to, and that is the point: the CLI you get is the one that matches the API you will talk to. Both scripts check the download against a published checksum and only move the binary into place once it matches.
The POSIX one needs curl or wget and runs under plain sh. The PowerShell one needs 5.1 or
newer — what Windows 10 and 11 ship — and works in pwsh too. Neither touches your shell
configuration or your PATH: they print the line to add and leave the decision to you.
konnecthub loginThis opens a browser, asks which workspace to grant, and stores the credentials on your machine.
konnecthub whoami # the active token, its identity, workspace and scopes
konnecthub logout # forget the stored credentialswhoami is the first thing to run when something behaves as though you are someone else — it
prints the scopes the current token actually carries, and the file it came from.
Tokens are stored per origin and workspace, so being a member of several workspaces does not mean signing in again every time you switch between repos.
.konnecthub/credentials.json in that repo, at mode 0600. It is
gitignored, and cd-ing into the repo is what selects the identity.--global — ~/.konnecthub/credentials.json. This is what
konnecthub init bootstraps from, and what a project falls back to when it has no token of
its own.konnecthub init copies the token it used into the new project, so a repo carries its own from
the moment it exists.
The approval page lists every permission the platform has, with the ones the CLI asked for already ticked. Untick what it should not have, or open Grant more than it asked for and add what it needs. Whatever is ticked when you approve is what the token carries — and it can never do more than your own role allows, so approving a permission you do not hold yourself grants nothing.
A token's scopes are fixed once it is minted. To change them, sign in again:
konnecthub login
konnecthub login --scopes +DataStore__Write # the usual set, plus one
konnecthub login --scopes Flow__Read # exactly this, and nothing elseThe new token replaces the stored one for that workspace; a token for any other workspace is
left alone. It does not replace the old token on the
server — that one stays valid until it expires, ninety days after it was created. If it might be
on a machine you no longer control, revoke it as well: it is listed with your other
access tokens, named konnecthub cli.
CI has no browser. Set a personal access token instead:
export KONNECTHUB_TOKEN=…
konnecthub deployThis is a first-class path, not a fallback. Grant the token the least it needs — a deploy
pipeline usually wants Flow__Write and Deployment__Write and nothing else.
konnecthub completions bash > ~/.local/share/bash-completion/completions/konnecthub
konnecthub completions zsh > "${fpath[1]}/_konnecthub"
konnecthub completions fish > ~/.config/fish/completions/konnecthub.fishkonnecthub completions powershell | Add-Content -Path $PROFILEWith the argument left off it guesses: from $SHELL, or — since PowerShell sets no such
variable — from being in a PowerShell session at all. Open a new shell afterwards.
TAB then completes commands and flags, and — inside a project — the names of your linked flows
and of the fixtures under <flow>/tests/, so konnecthub deploy <TAB> offers what this repo
actually has.
konnecthub upgradeInstalls the version your API serves. The API advertises a minimum CLI version, and a CLI below
that floor refuses to run rather than half-working — exit code 4, with the upgrade command in
the message.
There is no konnecthub uninstall. The installer writes one directory and never edits a shell
config, so removing the CLI is removing that directory — plus revoking what it stored.
Revoke first, while you can still tell which token is this machine's. logout forgets the
credentials here and deliberately leaves the token itself alive, because the same token may be in
use elsewhere; deleting the file only loses its id.
konnecthub api GET /auth/personal-tokens # "last used" identifies this machine
konnecthub api DELETE /auth/personal-tokens/<id>Your token list does the same with a button.
Then delete the CLI home — the binary, the global credentials.json and the shared caches
all live there.
rm -rf "${KONNECTHUB_HOME:-$HOME/.konnecthub}"Any project you signed into keeps its own token in its own .konnecthub/. Remove those too:
rm -rf <project>/.konnecthubOn Windows, from PowerShell:
Remove-Item -Recurse -Force "$env:USERPROFILE\.konnecthub"KONNECTHUB_HOME moves that directory and the installer honours it, so a per-user or
in-container install is not necessarily under your home directory.
Last, undo what the installer printed rather than performed. It declines to write to your shell's configuration, so these exist only if you acted on what it told you:
PATH line you added to ~/.bashrc, ~/.zshrc or your fish configrm -f ~/.local/share/bash-completion/completions/konnecthub \
~/.config/fish/completions/konnecthub.fish
# zsh: the _konnecthub you wrote into $fpathEvery command accepts --json, and every command exits with one of:
| Code | Meaning |
|---|---|
0 | Success |
1 | Ran and failed — a bundle failed, a test failed, a conflict is in the tree |
2 | A decision is needed and there is no TTY to ask. The message names the flag that answers it |
3 | Not authenticated — no token, or it expired or was revoked |
4 | The CLI is below this API's minimum version |
Code 2 is the one that matters in CI: it means the command stopped rather than guessing.