Access keys and the CLI

The console signs you in with your password and second factor. Scripts, the tebib CLI and the API use an access key instead: a key ID (starting TBK) and a secret.

Install the CLI

tebib runs on Linux, macOS and Windows.

Downloads

Signed binaries with checksums will be published on tebibhost.com/download with the first CLI release. During the preview, the CLI installs from its source with uv (Python 3.14): uv tool install ./platform/cli from a checkout of the TebibHost repository.

Turn on shell completion with tebib --install-completion (bash, zsh, fish, PowerShell).

Create an access key

The secret is shown once, when the key is created. Store it in a password manager or your CI’s secret store; if you lose it, delete the key and make a new one.

Console

IAM → Users, open your own user, and create an access key under Access keys. Give it a description saying what will use it.

CLI

Once the CLI is configured with one key, it can make more:

tebib key create --description "laptop"
tebib key create --description "CI" --allow 203.0.113.0/24   # only from this network

Rule	Value
Lifetime	90 days by default; pick a date up to 365 days ahead with --expires
Never expires	Service-account keys only, and only for someone with iam:CreateNonExpiringAccessKey (owners)
Unused keys	Turned off (not deleted) after 90 days without use; the organization can change or disable this rule
Source networks	Optional: --allow <CIDR> (repeatable) refuses requests from anywhere else
Permissions	A key acts as its user (or service account): it can do what their policies allow, no more

An expired or turned-off key gets 401. Turn an unused key back on with tebib key update <key ID> --activate, or in the console.

Configure the CLI

tebib configure

It asks for the endpoint (https://cloud.tebibhost.com during the preview), the key ID, the secret (hidden), and your default organization and project. Check it worked:

tebib whoami

Settings live in ~/.config/tebib/config.toml, credentials in credentials.toml next to it with mode 0600. The CLI refuses a credentials file other users can read.

Profiles

Keep several accounts or organizations apart with profiles:

tebib --profile work configure
tebib --profile work vm list
export TEBIB_PROFILE=work          # or for a whole shell session

Environment variables

Every setting can come from the environment, which suits CI. Environment variables override the profile.

Variable	Sets
TEBIB_ACCESS_KEY_ID, TEBIB_SECRET_ACCESS_KEY	The credentials
TEBIB_ENDPOINT	The API endpoint
TEBIB_ORGANIZATION, TEBIB_PROJECT	Default organization and project
TEBIB_PROFILE	Which profile to use
TEBIB_CONFIG_DIR	Where the config files are

Output and exit codes

Results go to standard output, progress to standard error. Add -o json or -o yaml for the full object, ready for jq:

tebib -o json vm list | jq -r '.[] | [.name, .power_state] | @tsv'

Exit code	Meaning
0	Success
1	API or runtime error
2	Usage or configuration error
3	Timed out waiting (--wait)
4	tebib iam simulate --fail-on-deny found a denied action

Using the API directly

Send the key as a bearer token, key ID and secret joined by a dot:

curl -H "Authorization: Bearer $TEBIB_ACCESS_KEY_ID.$TEBIB_SECRET_ACCESS_KEY" \
  https://cloud.tebibhost.com/api/v1/orgs

See the API reference.

Keys for automation

Don’t give CI your own key. Create a service account with only the permissions the pipeline needs, and give it a key; or let it assume a role for short-lived credentials. See Roles and service accounts. The IAM → Credentials page (or tebib iam credential-report) shows every key and when it was last used.