treblle

A CLI for the Treblle Platform API.

This is a first version, deliberately small: it authenticates, remembers a workspace, and lists the APIs in it. The layering underneath (profiles, transport, rendering) is built so further commands are additive.

Install

go install github.com/Treblle/cli/cmd/treblle@latest

Or build from a checkout:

make build      # -> ./bin/treblle
make install    # -> $GOPATH/bin/treblle

Getting started

treblle auth login     # paste a personal access token
treblle configure      # choose a workspace
treblle apis list

Creating a token

treblle auth login prints the link, but two details are easy to miss and both prevent the token from working:

• Set the app to platform. A token scoped to another Treblle app authenticates successfully but carries no permissions here, so every command fails with 403. treblle auth login checks this and refuses a wrong-scoped token rather than saving it.
• Multi-factor authentication must be enabled on your account, or token creation is silently refused.

Choosing Never for the expiry means you never have to repeat this.

Commands

Command	Description
treblle auth login	Authenticate with a personal access token
treblle auth status	Show the active profile, user, app scope and token expiry
treblle configure	Authenticate if needed, then choose and save a workspace
treblle apis list	List the APIs in the active workspace

apis list

treblle apis list
treblle apis list --search billing --sdk laravel
treblle apis list --sort -requests --limit 50
treblle apis list --all -o json | jq '.data[].attributes.name'

Sorts: name, score, issues, requests, latency, created, updated, last-request. Prefix with - for descending.

The table shows a summary. -o json returns the API response unchanged, which includes fields the table omits — among them api_key, which is why it is never rendered into the table.

The API caps a page at 100 results, so use --all rather than a large --limit to fetch everything.

Configuration

Two files under ~/.treblle, split so the secret can carry a stricter mode:

# ~/.treblle/config.yaml  (0644)
default:
  base_url:     https://api.treblle.com/v1
  identity_url: https://auth.treblle.com
  workspace:    wsp_xxx
  output:       table

# ~/.treblle/credentials.yaml  (0600)
default:
  token:      "..."
  expires_at: null    # null means the token never expires
  app:        platform

credentials.yaml is written 0600, and the CLI refuses to read it if it is readable by anyone else.

Profiles

Profiles work like the AWS CLI's. Each is a named block in both files, selected with --profile, TREBLLE_PROFILE, or defaulting to default.

treblle configure --profile staging
treblle apis list --profile staging

Environment variables

These override the files entirely, so CI needs no ~/.treblle at all:

Variable	Purpose
TREBLLE_TOKEN	Personal access token
TREBLLE_WORKSPACE	Workspace id
TREBLLE_BASE_URL	API base URL
TREBLLE_PROFILE	Profile to use
TREBLLE_CONFIG_DIR	Config directory (default ~/.treblle)

Non-interactive use

With no terminal attached the CLI never prompts. auth login reads the token from stdin, and configure requires --workspace instead of showing a picker:

echo "$TREBLLE_PAT" | treblle auth login
treblle configure --workspace wsp_xxx

Development

make check    # fmt, vet, test, verify-spec
make test
make build

api/openapi.json is a synced copy of the platform repository's spec. make verify-spec checks that every route the CLI calls still exists in it, so an upstream rename fails in CI rather than in someone's terminal. Refresh it with make sync-spec (set PLATFORM_REPO if the checkout is not at ../platform).

Authentication roadmap

Login goes through a LoginStrategy interface with one implementation today (paste). A browser-based loopback flow is the intended second implementation; it needs two endpoints on the identity service, and the seam exists so adding it changes no commands, no config format, and no client code.