Manage your licensing from the terminal
Apps, key types, licenses, customers, payment integrations — all of it from the command line instead of the dashboard. And because no command ever stops to ask you a question, your coding agent can run the whole surface without you leaving the editor.
$ brew tap keylight-dev/tap $ brew trust keylight-dev/tap $ brew install keylight
What it actually looks like
Aligned columns, no pagers, no colour codes to strip. Keys are masked in list output so a screenshot or a shared terminal does not leak one.
$ keylight products list ID NAME PREFIX FREE TIER TEST MODE my-app My App MYAP true - other Other App OTHR - true
$ keylight licenses list --limit 3 KEY APP TYPE STATUS DEVICES EXPIRES MYAP-****-****-****-M7VQY my-app pro active 1/3 - MYAP-****-****-****-E1VWW my-app pro active 0/3 - MYAP-****-****-****-B3994 my-app trial active 1/1 2026-08-14
$ keylight usage Active devices: 142 Monthly active: 1204 Activations (7d): 38 Validations (7d): 9431
Your agent can drive all of it
A dashboard needs a human with a mouse. This does not — and that is a design decision, not a side effect. Two rules make it true, and they are worth stating plainly because everything else follows from them.
- No command ever asks a question. Every input is a flag. Nothing waits on stdin, so nothing hangs when there is no human watching.
- Secrets come from environment variables you name, never from arguments. Arguments land in shell history and are visible to anyone running
ps. A token set inKEYLIGHT_API_TOKENdoes neither.
On top of that: every command takes --json, and exit code 2 means one specific thing — not authenticated. It is broken out from every other failure because it is the only one an agent can fix by itself.
$ export KEYLIGHT_API_TOKEN=klm_... $ keylight licenses list --json | jq -r '.items[].status' active active expired
The whole API, as commands
Everything the management API exposes is reachable from a command — plus test purchases and auth — and a test fails the build if a new endpoint ever ships without one.
Apps and key types
keylight products
Create an app, set its purchase URL, define its key types, turn the free tier on, or flip Stripe test mode.
Licenses, end to end
keylight licenses
List, filter, inspect, create, and revoke. Export the whole set to CSV when you need it somewhere else.
Customer lookup
keylight customers
Find a customer, see every license they own, and follow the trail from a support email to a key.
Payment integrations
keylight integrations
See which providers are connected, inspect price mappings, and rotate a webhook secret.
Usage and volume
keylight usage
Activations, validations, active devices, and monthly actives — the same numbers the dashboard shows.
Keys and webhooks
keylight sdk-key / webhook
Read or rotate the SDK key your app ships with, and point the outbound webhook at your backend.
Some things still need a human, on purpose
Revoking a license, exporting your licenses, deleting a key type, rotating an integration secret, reading or rotating the SDK key, setting the webhook — a token on its own cannot do any of them. You approve that specific call in a browser first, the same shape as npm’s web-based 2FA.
These block and wait rather than failing fast, because they are human-gated by design and pretending otherwise would misrepresent them. An agent prints the approval URL and waits for you. A leaked token cannot quietly revoke your customers’ licenses, and that is the point.
Install
Homebrew is the short path on macOS and Linux. The CLI is open source under Apache-2.0, so you can also build it yourself.
Homebrew
$ brew tap keylight-dev/tap $ brew trust keylight-dev/tap $ brew install keylight
Cargo
$ cargo install keylight-cli
Or grab a prebuilt binary for macOS, Linux, or Windows from the releases page. Then keylight login, approve it in your browser, and you are in. Full setup in the CLI docs.
Frequently asked
Do I need Rust installed to use it?+
No. Homebrew installs a prebuilt binary — no toolchain, and nothing to clear past Gatekeeper. If you do have Rust, cargo install keylight-cli works too, and every release publishes plain binaries for macOS, Linux, and Windows.
Why do I have to run brew trust?+
Since Homebrew 6, a formula from any third-party tap will not load until you trust it, and there is no prompt to click through — so the step is not specific to Keylight. It is a good control: a tap is Ruby that runs on your machine, so read the formula first. It is 60 lines and downloads a published release binary.
Can my coding agent actually run this?+
Yes, and that is what it was built for. No command opens a prompt — every input is a flag. Credentials come from the KEYLIGHT_API_TOKEN environment variable, so nothing secret lands in argv or shell history. Every command takes --json, and exit code 2 means specifically "not authenticated", which is the one failure an agent can resolve on its own.
Is there anything it will not do without me?+
Seven operations are confirm-gated: revoking a license, exporting licenses, deleting a key type, rotating an integration secret, reading or rotating the SDK key, and setting the webhook. A bearer token alone cannot run them — a human approves that specific call in a browser, the same shape as npm’s web-based 2FA. An agent surfaces the URL to you and waits.
I run several apps. Can I script across them?+
Yes. Every command takes the app as a flag and every command speaks --json, so a loop over your products is a few lines of shell — bulk key-type changes, one usage report across a portfolio, a nightly export.
Does it work on Windows?+
Yes, via the prebuilt x86_64 binary on the releases page. Homebrew covers macOS and Linux; on Windows, download the binary or build it with cargo.
Is it open source?+
Yes, Apache-2.0, at github.com/keylight-dev/keylight-cli. Every operation the management API exposes is reachable from a command, and a test in that repo fails the build if that stops being true.
A growing developer community 
Apps shipping with Keylight 
Licenses validated daily Ready to ship?
Create your account and start licensing your apps in under a minute. Free forever tier included.
Start Free