Skip to content
TebibHost Docs

Access keys and the CLI

The console signs you in with your password and second factor. Scripts, the tebib CLI and the API use an access key instead: a key ID (starting TBK) and a secret.

Install the CLI

Section titled “Install the CLI”

tebib runs on Linux, macOS and Windows.

Turn on shell completion with tebib --install-completion (bash, zsh, fish, PowerShell).

Create an access key

Section titled “Create an access key”

The secret is shown once, when the key is created. Store it in a password manager or your CI’s secret store; if you lose it, delete the key and make a new one.

IAM → Users, open your own user, and create an access key under Access keys. Give it a description saying what will use it.
Rule Value
Lifetime 90 days by default; pick a date up to 365 days ahead with --expires
Never expires Service-account keys only, and only for someone with iam:CreateNonExpiringAccessKey (owners)
Unused keys Turned off (not deleted) after 90 days without use; the organization can change or disable this rule
Source networks Optional: --allow <CIDR> (repeatable) refuses requests from anywhere else
Permissions A key acts as its user (or service account): it can do what their policies allow, no more

An expired or turned-off key gets 401. Turn an unused key back on with tebib key update <key ID> --activate, or in the console.

Configure the CLI

Section titled “Configure the CLI”
Terminal window
tebib configure

It asks for the endpoint (https://cloud.tebibhost.com during the preview), the key ID, the secret (hidden), and your default organization and project. Check it worked:

Terminal window
tebib whoami

Settings live in ~/.config/tebib/config.toml, credentials in credentials.toml next to it with mode 0600. The CLI refuses a credentials file other users can read.

Profiles

Section titled “Profiles”

Keep several accounts or organizations apart with profiles:

Terminal window
tebib --profile work configure
tebib --profile work vm list
export TEBIB_PROFILE=work          # or for a whole shell session

Environment variables

Section titled “Environment variables”

Every setting can come from the environment, which suits CI. Environment variables override the profile.

Variable Sets
TEBIB_ACCESS_KEY_ID, TEBIB_SECRET_ACCESS_KEY The credentials
TEBIB_ENDPOINT The API endpoint
TEBIB_ORGANIZATION, TEBIB_PROJECT Default organization and project
TEBIB_PROFILE Which profile to use
TEBIB_CONFIG_DIR Where the config files are

Output and exit codes

Section titled “Output and exit codes”

Results go to standard output, progress to standard error. Add -o json or -o yaml for the full object, ready for jq:

Terminal window
tebib -o json vm list | jq -r '.[] | [.name, .power_state] | @tsv'
Exit code Meaning
0 Success
1 API or runtime error
2 Usage or configuration error
3 Timed out waiting (--wait)
4 tebib iam simulate --fail-on-deny found a denied action

Using the API directly

Section titled “Using the API directly”

Send the key as a bearer token, key ID and secret joined by a dot:

Terminal window
curl -H "Authorization: Bearer $TEBIB_ACCESS_KEY_ID.$TEBIB_SECRET_ACCESS_KEY" \
  https://cloud.tebibhost.com/api/v1/orgs

See the API reference.

Keys for automation

Section titled “Keys for automation”

Don’t give CI your own key. Create a service account with only the permissions the pipeline needs, and give it a key; or let it assume a role for short-lived credentials. See Roles and service accounts. The IAM → Credentials page (or tebib iam credential-report) shows every key and when it was last used.