Install and authenticate

Get the CLI on your machine, then give it a key it can keep.

The CLI is a Node package. One global install, one browser round trip, and it is ready.

Requirements

Node.js 20 or later. The package declares engines.node: ">=20.0.0" and wajub doctor checks it explicitly, so an older runtime fails with a clear message rather than a stack trace.

Check before you install

node --version

Install

npm install -g @wajub/cli

Confirm it landed, and note the runtime it reports. That line is what support will ask for.

wajub version

$ wajub version
@wajub/cli/1.4.0 darwin-arm64 node-v22.11.0

Without installing anything

npx @wajub/cli listen --forward-to localhost:3000/webhooks runs the current version and leaves nothing behind. Useful on a machine you do not own, or in a one-off container.

To update, install again. The CLI also warns you on its own when a newer version is published.

Authenticate

wajub login opens your browser, you approve in the Dashboard, and the CLI receives a key it stores locally. Nothing is typed into the terminal, so nothing lands in your shell history.

The normal path

wajub login
wajub login --environment live

Sandbox is the default. Log in twice, once per environment, and you get two profiles you can switch between.

Flag	When you need it
`--environment`	`sandbox` or `live`, chooses which key is created
`--manual`	Paste an existing key through a hidden prompt, no browser
`--no-browser`	Print the URL instead of opening it, for a remote shell
`--no-skills`	Skip the Agent Skills offer
`--profile`	Name the profile being created
`--dashboard-url`	Point at another Dashboard host

Credentials land in ~/.config/wajub/config.json, readable only by you. Back it up if you like, but treat it exactly as you would a key file, because that is what it is.

In CI, use the environment

There is no browser in a pipeline. Set WAJUB_API_KEY and every command picks it up without a profile existing at all.

A pipeline step

# From your CI secret store, never from the job definition
export WAJUB_API_KEY=sk.kZ3qP8mWvL2xR7tB5nY4hC6dF9jS1aG0eU3i…

wajub doctor --json
wajub payments list --limit 5 --json

Never pass a key with `--api-key`

The flag still exists and still works, which is why it is marked deprecated and hidden from --help. A key on the command line is written to your shell history and is visible in the process list to every other user on the machine. Use wajub login locally and WAJUB_API_KEY in CI.

Profiles

A profile is a named credential set. The CLI ships with the concept because sandbox and live keys must never be one typo apart.

Create, inspect and switch

# What do I have, and which one is default?
wajub config

# Register a key under a name, without calling the API to validate it
wajub config set staging --secret-key sk.kZ3qP8mWvL2xR7tB5nY4hC6dF9jS1aG0eU3i…

# Make it the default
wajub config use staging

# Or override for a single command
wajub payments list --profile sandbox

wajub config prints keys masked. --show-secrets prints them in full, which is almost never what you want on a shared screen.

`config set` does not verify the key

It writes the profile as given. A typo is discovered later, by a command failing with a 401. Run wajub doctor after creating a profile by hand.

Verify the whole chain

wajub doctor

$ wajub doctor

Wajub CLI diagnostics

  ✓  Config  2 profile(s), default: sandbox
  ✓  Credentials  key=pk_test.mT9xW…  env=sandbox  base=https://api.wajub.com  source=profile
  ✓  API reachability  https://api.wajub.com (HTTP 200)
  ✓  Auth  API key accepted, Boutique Akwa (sandbox)
  ✓  Node.js  v22.11.0 (≥ 20 required)
  ✓  Environment  wajub-cli v1.4.0  node v22.11.0  darwin/arm64
  ✓  Support  last request id: fbe6773e9ce64f158af89e5740fc5817

Everything looks good.

The source field on the credentials line is the one people miss: it tells you whether the key came from a profile, from WAJUB_API_KEY, or from a flag. When a command behaves as though it belongs to another account, that field is the answer.

Log out

wajub logout revokes the key that wajub login created, then deletes the local profile. The revocation is the point: deleting the file alone would leave a live key sitting on Wajub's side.

Leaving cleanly

wajub logout                    # the current profile
wajub logout --profile sandbox  # a named one
wajub logout --all              # every profile
wajub logout --keep-key         # forget it locally, leave the key active

Use --keep-key only when the key is also used by something else, such as a server you configured by copying it out of the Dashboard.