> ## Documentation Index > Fetch the complete documentation index at: https://docs.amika.dev/llms.txt > Use this file to discover all available pages before exploring further. # CLI reference > Commands, flags, and examples for the Amika CLI. Use this page as the command index for the `amika` CLI. ## Global flags Most commands accept `-o`/`--output` to choose how they print their result, so you can read output at a terminal and pipe the same command into a script or `jq`. | Value | Description | | - | - | | `text` | Human-readable text (the default) | | `json` | Compact, single-line JSON, for piping | | `json-pretty` | Indented, multi-line JSON, for reading | ```bash theme={null} # Capture a new rig's name in a script name=$(amika rig create --no-git -o json | jq -r .name) # Delete several rigs and inspect per-item results amika rig delete a b c --force -o json | jq '.[] | select(.status=="error")' ``` Most list commands emit a JSON array. `snapshot list` is the exception and emits a `{ "items": [...] }` object. In JSON mode the CLI never prompts, so destructive commands need their confirmation flag (`--force` for deletes, `--no-interactive` for `snapshot create`). Progress messages go to stderr, so stdout carries only the JSON value. Commands that open a shell or an editor (`rig connect`, `rig open`, `rig create --connect`) and commands that show a masked credential table and ask for confirmation (`secret extract`, `secret push`) reject `-o json`. `rig ssh` and `scp` hand their arguments to the system `ssh` and `scp`, so they don't take `--output` at all. ### Naming the current rig Inside a rig, any argument or flag that names a rig also accepts `_self`, which resolves to the current rig from the `AMIKA_RIG_NAME` environment variable: ```bash theme={null} amika service list --rig-name _self amika service create --rig _self --name web --port 3000 --url-scheme https ``` ## `amika rig` Manage rigs. > [!NOTE] > > `amika sandbox` remains available as a compatibility alias. Use `amika rig` in > new commands and scripts. ### Global rig flags Rigs always run remotely, on Amika Cloud or on one of your organization's own hosts. `--remote` remains an accepted no-op for compatibility. The retired `--local` flag is hidden and returns an error. ### Create ```bash theme={null} # Use the current Git repository and generate a rig name amika rig create # Use the repository containing a specific path amika rig create --name dev-rig --git ./src # Use a remote Git repository amika rig create --name dev-rig \ --git https://github.com/gofixpoint/example-repo.git # Use the preset that includes Docker amika rig create --name dind-box --preset coder-plus-docker # Set environment variables amika rig create --name dev-rig --env MY_KEY=my_value # Create and immediately connect amika rig create --name dev-rig --connect # Override the setup script amika rig create --name dev-rig --setup-script ./install-deps.sh # Clone a specific git branch amika rig create --name dev-rig --branch develop # Create a new branch from your current branch amika rig create --new-branch feature-x # Create a new branch starting from a specific existing branch amika rig create --branch main --new-branch bugfix-1 # Inject a stored secret amika rig create --name dev-rig \ --secret env:ANTHROPIC_API_KEY=my-claude-key # Pin which agent credential gets injected at create time amika rig create --name dev-rig \ --agent-credential-type claude=api-key \ --no-agent-credential codex # Fork from a captured snapshot amika rig create --name dev-rig --snapshot example-repo-base # Run on one of your organization's own hosts, at one of that host's sizes amika rig create --name dev-rig --host alpha.lan --size small # Create a rig without a repository amika rig create --name scratch --no-git ``` ### Create flags | Flag | Default | Description | | - | - | - | | `--name ` | auto-generated | Name for the rig. If omitted, a random `{color}-{city}` name is generated | | `--preset ` | repository or platform default | Use `coder` or `coder-plus-docker` | | `--size ` | repository or platform default | Rig size, such as `m` or `a1.medium`. With `--host`, one of that host's own sizes instead, defaulting to 4 vCPU, 8 GiB memory, and a 20 GiB disk | | `--host ` | | Run the rig on one of your organization's own hosts rather than on Amika Cloud. See [`amika host`](#amika-host). With `--snapshot`, the snapshot must have been taken on that same host; any other snapshot is refused | | `--snapshot ` | | Fork from a captured snapshot | | `--git ` | auto-detected | Use a local repository path or a Git URL. If omitted, the CLI detects a repository from the current directory | | `--no-git` | `false` | Skip git repo auto-detection; create a repo-less rig with no repo mounted | | `--env ` | | Set environment variable. Repeatable | | `--secret ` | | Inject a stored secret (`env:FOO=SECRET_NAME` or `env:SECRET_NAME`). Repeatable | | `--connect` | `false` | Connect to the rig shell immediately after creation | | `--setup-script ` | | Upload a local setup script | | `--no-setup` | `false` | Replace the configured setup script with a no-op script | | `--branch ` | | Check out this branch, or create it if the remote has none | | `--new-branch ` | | Create a new branch from `--branch` or the inferred base branch | | `--github-auth-mode ` | platform default | GitHub authentication mode: `pat`, `app_token`, or `app-token` | | `--agent-credential ` | | Pin an agent credential by stored name (e.g. `claude=personal-oauth`). Repeatable per kind | | `--agent-credential-type ` | | Pin an agent credential by type, where `TYPE` is `oauth` or `api-key` (e.g. `claude=oauth`). Repeatable per kind | | `--no-agent-credential ` | | Skip injecting any credential of this kind (e.g. `codex`). Repeatable per kind | > [!NOTE] > > `--no-setup` and `--setup-script` are mutually exclusive. > [!NOTE] > > Supported agent kinds for `--agent-credential`, `--agent-credential-type`, and `--no-agent-credential` are `claude` and `codex`. Each flag may appear at most once per kind. `--no-agent-credential` is mutually exclusive with the other two for the same kind. See [Inject credentials](https://docs.amika.dev/guides/inject-credentials.md) for usage. > [!NOTE] > > Rigs clone from the repository remote. Push local commits before creation. The > CLI rejects an inferred branch that is not present and up to date on `origin`. ### List Aliases: `ls` ```bash theme={null} amika rig list amika rig ls --long ``` Output columns: `NAME`, `STATE`, `REPO`, `BRANCH`, `CREATOR`. `--long` adds `ID`, `BASE_SNAPSHOT`, `PORTS`, and `CREATED`. `CREATOR` shows `-` when the creator is unknown, for example for a rig an API key created. | Flag | Default | Description | | - | - | - | | `-l`, `--long` | `false` | Show additional columns | Column selection only applies to text output. `-o json` always includes every field. ### Get Show one rig by name or ID. ```bash theme={null} amika rig get dev-rig amika rig get dev-rig -o json ``` Text output prints one `key: value` per line, with dotted keys for nested fields. `ssh_host` is the rig's SSH alias from `~/.ssh/amika.conf`, which you can use with `ssh`, `scp`, or an editor's Remote-SSH. ### Connect Open an interactive shell in a rig. `connect` is the shell-only form of [`rig ssh`](#ssh) and uses the same transport. It takes no flags. ```bash theme={null} amika rig connect dev-rig ``` The shell starts in `/home/amika`. Like `rig ssh`, it needs an SSH key from [`amika secret ssh-keygen`](#amika-secret-ssh-keygen). ### Delete Aliases: `rm`, `remove` ```bash theme={null} amika rig delete dev-rig amika rig rm dev-rig amika rig delete rig-1 rig-2 amika rig delete dev-rig --force ``` | Flag | Default | Description | | - | - | - | | `--force` | `false` | Skip confirmation prompt | ### Stop Stop one or more running rigs without removing them. ```bash theme={null} amika rig stop dev-rig amika rig stop rig-1 rig-2 ``` ### Start Start (resume) one or more stopped rigs. ```bash theme={null} amika rig start dev-rig amika rig start rig-1 rig-2 ``` ### SSH Aliases: `sshv2` SSH into a rig. Use it like `ssh`: options go before the rig name, and an optional command goes after it. Every `ssh` option works, including port forwarding. Requires an SSH key from [`amika secret ssh-keygen`](#amika-secret-ssh-keygen). ```bash theme={null} amika rig ssh [ssh-options] [command...] ``` ```bash theme={null} # Interactive shell amika rig ssh my-rig # Run a command instead of opening a shell amika rig ssh my-rig uptime # Force pseudo-terminal allocation for an interactive program amika rig ssh -t my-rig top # Forward local port 6789 to port 3010 in the rig, without a shell amika rig ssh -N -L 6789:localhost:3010 my-rig # SOCKS proxy on local port 1080 amika rig ssh -N -D 1080 my-rig ``` `rig ssh` has no flags of its own: everything after `ssh` goes to `ssh`. Write Amika's own flags before `ssh`, as in `amika rig --remote ssh my-rig`. Local (`-L`), dynamic (`-D`), and agent forwarding are supported. Agent forwarding uses a dedicated agent that holds only your Amika SSH key, so your other keys never reach the rig. Remote (`-R`) and X11 forwarding are not supported. ### Open Aliases: `code`, `codev2` Open a rig in an editor or app over SSH. The command adds a named SSH host to Amika's managed SSH config, then starts or configures the app you pick. Requires an SSH key from [`amika secret ssh-keygen`](#amika-secret-ssh-keygen). > [!NOTE] > > `rig open`, `--app`, and the `herdr` app ship in the next CLI release. In > v0.23.0 and earlier, run `amika rig code --editor ` instead. It > supports every app except `herdr`. ```bash theme={null} amika rig open my-rig amika rig open my-rig --app vscode amika rig open my-rig --app codex amika rig open my-rig --app herdr amika rig open my-rig --path /home/amika/workspace/other-repo ``` | Flag | Default | Description | | - | - | - | | `--app ` | `cursor` | App to open: `cursor`, `vscode`, `claude`, `codex`, `paseo`, or `herdr` | | `--editor ` | | Alias for `--app` | | `--path ` | | Remote path to open, absolute or relative to the rig workspace. Ignored by `paseo` and `herdr` | What each app does: | App | Behavior | | - | - | | `cursor` | Launches Cursor connected to the rig | | `vscode` | Launches VS Code connected to the rig | | `claude` | Registers the rig as a Claude Desktop SSH environment, then opens Claude Desktop | | `codex` | Turns on Codex remote connections, then opens Codex. See [Codex app](https://docs.amika.dev/guides/codex-app.md) | | `paseo` | Prints the SSH host to add in Paseo. See [Paseo](https://docs.amika.dev/guides/paseo.md) | | `herdr` | Runs `herdr machine add` to save the rig as a Herdr machine labeled with the rig name. Requires the `herdr` CLI on your `PATH` | See [Open in your editor](https://docs.amika.dev/guides/open-in-editor.md) for setup details. ### Agent Send Send a message to a coding agent in an existing rig. This is the rig-scoped form of [`amika send --rig `](#amika-send), with the same session handling, streaming, and JSON output. The message can be a positional argument or piped through stdin. The command waits for the agent to finish. Without `--session-id` or `--new-session`, the message continues the latest API chat on the rig, or starts one if there is none. The session ID is printed to stderr as `session_id: `. ```bash theme={null} # Send a message to the default agent amika rig agent-send my-rig "Add unit tests for the auth module" # Pipe a message through stdin echo "Fix the failing tests" | amika rig agent-send my-rig # Continue a specific chat amika rig agent-send my-rig "Continue the review" --session-id # Use a different agent and get JSON back amika rig agent-send my-rig "Review this code" --agent codex -o json ``` | Flag | Default | Description | | - | - | - | | `--agent ` | existing chat or organization setting, else `claude` | Coding agent: `claude` or `codex` | | `--session-id ` | | Continue a chat returned by an earlier send | | `--new-session` | `false` | Start a new chat | | `--stream[=false]` | on for a terminal | Stream the reply as the agent writes it. JSON output is always buffered | ## `amika send` Send a message to a coding agent and keep the conversation as a chat. Name an existing rig with `--rig`, continue a chat with `--session-id`, or omit both to create a new rig for the chat. ```bash theme={null} # Create a rig from the current repository and start a chat amika send "What does this repo do?" # Use a specific agent amika send --agent codex "Summarize the open TODOs" # Send into an existing rig amika send "Fix the tests" --rig my-rig # Continue a chat amika send "Now update the README" --session-id ``` When `send` creates a rig, repository and branch selection work like [`rig create`](#create): the current Git repository and branch are used unless `--git`, `--no-git`, `--branch`, or `--new-branch` say otherwise. These flags can't be combined with `--rig` or `--session-id`. | Flag | Default | Description | | - | - | - | | `--agent ` | existing chat or organization setting, else `claude` | Coding agent: `claude` or `codex` | | `--rig ` | | Send into an existing rig | | `--session-id ` | | Continue an existing chat | | `--new-session` | `false` | Start a new chat | | `--git ` | auto-detected | Repository to clone into the new rig | | `--no-git` | `false` | Create the new rig without a repository | | `--branch ` | current branch | Branch to check out in the new rig | | `--new-branch ` | | Create a new branch in the new rig | | `--stream[=false]` | on for a terminal | Stream the reply as the agent writes it. JSON output is always buffered | In text output, the reply goes to stdout and metadata such as `session_id` goes to stderr. With `-o json`, the command prints one object with `session_id`, `sandbox_id`, `agent`, `response`, `is_error`, `is_new_session`, `created_sandbox`, and optional `usage`. If the agent fails, the command still prints its response, then exits with an error. `--repo` is a deprecated alias for `--git`. ## `amika sessions` Aliases: `session` List and read the agent chats created by `amika send` and `amika rig agent-send`. ### List ```bash theme={null} amika sessions list amika sessions list --limit 100 ``` Output columns: `SESSION ID`, `AGENT`, `STATUS`, `SANDBOX`, `UPDATED`. | Flag | Default | Description | | - | - | - | | `--limit ` | server page size (50) | Maximum number of chats to list | ### Show Print a chat's details and every message in it. ```bash theme={null} amika sessions show ``` ## `amika scp` Aliases: `scpv2` Copy files between your machine, rigs, and other SSH hosts. `amika scp` wraps the system `scp`: every argument is passed through, so the usual `scp` flags (`-r`, `-p`, `-C`, `-v`) work. Requires an SSH key from [`amika secret ssh-keygen`](#amika-secret-ssh-keygen). ```bash theme={null} amika scp ... ``` | Form | Meaning | | - | - | | `PATH` | A local path | | `NAME:PATH` | A path in rig `NAME`. A relative path is under `/home/amika` | | `sbox://NAME/PATH` | A path in rig `NAME`, in URI form. `~` is the home directory | | `scp://[user@]host[:port]/path` | A path on any other SSH host | A bare `host:path` always names a rig. Use an `scp://` URI to reach another SSH host. ```bash theme={null} # Upload a file into the rig's home directory amika scp ./local.txt my-rig:local.txt # Download a directory recursively amika scp -r my-rig:/srv/out ./out # Copy from a rig to another SSH host amika scp my-rig:/data.csv scp://user@host:22/tmp/data.csv # Print the resolved scp command instead of running it amika scp --print ./a.txt my-rig:a.txt ``` | Flag | Default | Description | | - | - | - | | `--print` | `false` | Print the resolved `scp` command instead of running it | ## `amika snapshot` Manage snapshots captured from running rigs. See [Create a snapshot](https://docs.amika.dev/guides/create-a-snapshot.md) for the end-to-end flow. ### Create Capture a snapshot from a running rig. Interactive by default: it prompts for the capture mode and name, and for `scrub_and_delete` it previews the injected secrets that will be removed and asks for confirmation. Pass `--no-interactive` for a non-prompting run, which then requires `--mode` and `--name`. ```bash theme={null} # Interactive amika snapshot create --rig base-box # Non-interactive amika snapshot create --rig base-box \ --name example-repo-base --mode scrub_and_delete --no-interactive ``` | Flag | Default | Description | | - | - | - | | `--rig ` | **(required)** | Source rig to snapshot | | `--name ` | | Name for the snapshot (prompted if omitted in interactive mode) | | `--mode ` | | Capture mode: `scrub_and_delete` or `full` (required with `--no-interactive`) | | `--description ` | | Optional description shown in the snapshot list | | `--no-interactive` | `false` | Do not prompt; requires `--mode` and `--name` | Capture modes: | Mode | Behavior | | - | - | | `scrub_and_delete` (default) | Remove Amika-injected secrets, capture the snapshot, then delete the source rig | | `full` | Capture everything as-is (keeps secrets and the source rig; unsafe for shared images) | Capture runs in the background; check progress with `amika snapshot list`. A snapshot of a rig on one of your own hosts stays on that host and can only boot rigs there. See [Bring your own compute](https://docs.amika.dev/guides/byoc.md). ### List Aliases: `ls` ```bash theme={null} amika snapshot list amika snapshot ls --long amika snapshot list --rig base-box amika snapshot list --repo example-repo ``` Output columns: `NAME`, `STATE`, `PROVIDER`, `SOURCE`, `CREATED`. `--long` adds `HOST`, `SIZE`, `BASE`, `DESCRIPTION`, and `ERROR`. `HOST` names the host a snapshot was taken on, if it came from one of your own hosts. | Flag | Default | Description | | - | - | - | | `-l`, `--long` | `false` | Show additional columns | | `--rig ` | | Only show snapshots captured from this rig | | `--repo ` | | Only show snapshots for this repository | ### Delete Aliases: `rm`, `remove` ```bash theme={null} amika snapshot delete example-repo-base amika snapshot rm snap-1 snap-2 amika snapshot delete example-repo-base --force ``` | Flag | Default | Description | | - | - | - | | `-f`, `--force` | `false` | Skip confirmation prompt | ## `amika service` Aliases: `services` Manage the services on your rigs. See [Services](https://docs.amika.dev/reference/services.md) for how to declare services in `.amika/config.toml`. ### List Aliases: `ls` ```bash theme={null} amika service list amika service ls amika service list --rig-name dev-rig ``` Output columns: `SERVICE`, `SANDBOX`, `PORTS`, `URL`. | Flag | Default | Description | | - | - | - | | `--rig-name ` | (none) | Filter services to a specific rig | ### Create Add a service to a running rig, for a port you start listening on after the rig is created. ```bash theme={null} amika service create --rig dev-rig --name web --port 3000 --url-scheme https ``` | Flag | Default | Description | | - | - | - | | `--rig ` | **(required)** | Rig to add the service to | | `--name ` | **(required)** | Service name, a single DNS label (lowercase letters, digits, and hyphens) | | `--port ` | **(required)** | Port the service listens on in the rig | | `--url-scheme ` | **(required)** | Scheme for the generated URL: `http` or `https` | ### Delete Aliases: `rm`, `remove` ```bash theme={null} amika service delete --rig dev-rig --name web amika service delete --rig dev-rig --name web --force ``` | Flag | Default | Description | | - | - | - | | `--rig ` | **(required)** | Rig the service belongs to | | `--name ` | **(required)** | Service to delete | | `-f`, `--force` | `false` | Skip confirmation prompt | ## `amika host` Aliases: `hosts` Inspect and retire your organization's own hosts (bring your own compute). See [Bring your own compute](https://docs.amika.dev/guides/byoc.md) for the setup flow. A host registers itself when `amika-hostd up` runs on the machine, so there is no command to add one. A rig runs on Amika Cloud unless `amika rig create --host` names one of these hosts. ```bash theme={null} # List the organization's hosts amika host list # Show one host and the sizes it offers amika host get alpha.lan # Delete a host and its stored secret amika host delete alpha.lan ``` ### List Aliases: `ls` Output columns: `HOSTNAME`, `TRANSPORT`, `URL`, `SIZES`. `TRANSPORT` is `tunnel` (connected to Amika's gateway) or `listen` (serves a URL it registered). A `tunnel` host always shows `-` for `URL`. A `listen` host shows `-` until it registers a URL, and can't take rigs until then. ### Get ```bash theme={null} amika host get ``` Shows one host's details and the sizes it offers. Those size names, not the cloud size vocabulary, are what `rig create --host ... --size ...` accepts. ### Delete Aliases: `rm`, `remove` ```bash theme={null} amika host delete [...] ``` | Flag | Default | Description | | - | - | - | | `-f`, `--force` | `false` | Skip confirmation prompt | A host that still has rigs on it is refused: delete those rigs first. The machine itself is untouched, so stop its daemon with `amika-hostd down` or it registers itself again on the next `amika-hostd up`. ## `amika auth` Authentication commands. ### `amika auth login` Log in to Amika via the WorkOS Device Authorization Flow. Opens a browser for you to authorize the CLI. ```bash theme={null} amika auth login ``` To skip the browser flow and log in with an Amika API key, for example in CI, pass `--api-key-file`. Use `-` to read from stdin so the key never lands on disk: ```bash theme={null} amika auth login --api-key-file /path/to/key vault kv get -field=key secret/amika | amika auth login --api-key-file - ``` | Flag | Default | Description | | - | - | - | | `--api-key-file ` | | Read an Amika API key from this path (or `-` for stdin) instead of running the device flow | A successful login also writes Amika's managed SSH config (`~/.ssh/amika.conf`, included from `~/.ssh/config`) and prints the files it touched. See [Authentication](https://docs.amika.dev/reference/auth.md) for details on the login flow and session storage. ### `amika auth status` Show current authentication status. ```bash theme={null} amika auth status ``` Prints the logged-in email and organization, or "Not logged in" if no session exists. ### `amika auth logout` Log out of Amika and remove the saved session. ```bash theme={null} amika auth logout ``` ### `amika auth api-key create` Create an Amika API key and write it to a file. Use API keys for CI jobs, scripts, another machine's CLI, or an `amika-hostd` host daemon. The key's value is shown only once, so the command writes it to `--out` and never prints it, including with `-o json`. > [!NOTE] > > `amika auth api-key create` needs amika CLI v0.24.0 or later. With an older > CLI, create API keys in the web UI at > [app.amika.dev/settings/api-keys](https://app.amika.dev/settings/api-keys). ```bash theme={null} # Create a key owned by you for a host daemon, hand it to setup, remove the file dir=$(mktemp -d) amika auth api-key create --name build-01-hostd --scope user --out "$dir/api-key" amika-hostd setup --non-interactive --hostname build-01 < "$dir/api-key" rm -rf "$dir" # Create a key owned by you and log another machine's CLI in with it amika auth api-key create --name laptop --scope user --out ./amika-key amika auth login --api-key-file ./amika-key ``` | Flag | Default | Description | | - | - | - | | `--name ` | **(required)** | Name for the key, shown in the web app's settings | | `--out ` | **(required)** | File to write the key to. A new file is created with mode `0600` | | `--scope ` | `organization` | `organization` (owned by your organization) or `user` (owned by you) | | `-f`, `--force` | `false` | Replace `--out` if it already exists | The file holds the bare key and a newline, so it works as-is with `amika auth login --api-key-file` and `amika-hostd setup --non-interactive`. The command checks that it can write `--out` before it creates the key. If the write still fails afterward, the error names the key's ID so you can delete it in the web app. A user-scoped key acts as you. Organization-scoped keys have no user behind them, so you can't use one to create a user-scoped key. ## `amika secret` Aliases: `secrets` Manage secrets in the remote Amika secrets store. ### `amika secret extract` Discover locally stored credentials and optionally push them to the remote store. ```bash theme={null} amika secret extract amika secret extract --push amika secret extract --push --only=ANTHROPIC_API_KEY,OPENAI_API_KEY ``` | Flag | Default | Description | | - | - | - | | `--push` | `false` | Push discovered secrets to the remote store after confirmation | | `--only ` | | Comma-separated list of secret names to include (e.g. `ANTHROPIC_API_KEY,OPENAI_API_KEY`) | | `--scope ` | `user` | Secret scope: `user` (private) or `org` (visible to org members) | | `--homedir ` | | Override home directory used for credential discovery | | `--no-oauth` | `false` | Skip OAuth credential sources | See [Local credential discovery](https://docs.amika.dev/reference/auth.md#local-credential-discovery) for the sources it checks. ### `amika secret push` Push secrets to the remote store from inline arguments, environment variables, or a `.env` file. ```bash theme={null} amika secret push ANTHROPIC_API_KEY=sk-ant-xxx amika secret push --from-env=ANTHROPIC_API_KEY,OPENAI_API_KEY amika secret push --from-file=.env amika secret push --from-file=.env CUSTOM_KEY=val --from-env=ANTHROPIC_API_KEY ``` | Flag | Default | Description | | - | - | - | | `--from-env ` | | Comma-separated list of environment variable names to read and push | | `--from-file ` | | Path to a `.env` file containing `KEY=VALUE` secrets | | `--scope ` | `user` | Secret scope: `user` (private) or `org` (visible to org members) | When multiple sources are used, positional arguments override `--from-file` values, and `--from-env` overrides both. ### `amika secret claude` Manage Claude Code credentials for rig authentication. Credentials pushed here can be injected into rigs at creation time. #### `amika secret claude push` Push Claude Code credentials (API key or OAuth token) to the remote Amika secrets store. Scans your system for Claude credentials and lets you choose which one to push. On macOS, the keychain is also checked. ```bash theme={null} # Interactive: discover and select credentials amika secret claude push # Push with a custom label amika secret claude push --name claude-oauth-work-laptop # Push from a credentials file amika secret claude push --from-file ~/.claude/.credentials.json # Push a credential value directly amika secret claude push --value '{"claudeAiOauth":{...}}' # Auto-resolve by type (reads ANTHROPIC_API_KEY env var for api_key) amika secret claude push --type api_key # Share the credential with your organization amika secret claude push --scope org ``` | Flag | Default | Description | | - | - | - | | `--name