CLI
The Kyo CLI puts your whole workspace in the terminal — list, create, and update anything in the CRM with scriptable JSON output. It signs in through your browser with OAuth (no API keys to manage) and bundles a local copy of the MCP server for clients that can't use the hosted one.
Install
npm install -g kyo-cli
# or run without installing:
npx kyo-cli <command>Requires Node.js 18 or newer. The installed command is kyo.
Sign in
kyo login
This opens your browser to Kyo's consent screen and captures the redirect on a local
loopback port (RFC 8252) — the standard OAuth 2.0 + PKCE
flow, with no client secret on disk. The default grant is full read/write on your
workspace, except metered enrichment. Grant less (or opt in to enrichment) with
--scope:
kyo login --scope "deals:read deals:write tasks:read"
kyo whoami shows the connection and granted scopes; kyo logout
revokes it. The CLI always signs in as a person; to
connect one of your workspace's AI agents, use the hosted MCP server with an
agent key.
Commands
| Command | What it does |
|---|---|
kyo login [--scope "…"] | Sign in via browser OAuth |
kyo logout | Revoke the tokens and delete local credentials |
kyo whoami | Show the connection and granted scopes |
kyo <resource> <verb> | list, get, create, update, detach on any resource |
kyo enrich <domain> | Look up firmographics for a domain (metered) |
kyo help | Usage, plus the live list of resources this build supports |
kyo mcp | Run the local MCP server (stdio) — most clients can use the hosted server instead, with no install |
Working with resources
Every API resource is a command — the resource name with
hyphens instead of underscores. kyo help prints the list your installed
version supports.
| Area | Commands |
|---|---|
| CRM | deals, people, companies, pipelines, pipeline-stages (stages), deal-tasks, deal-people, deal-labels, crm-files, labels |
| Tasks & spaces | tasks, task-attachments, spaces, projects, project-stages, space-members, space-updates, comments |
| Metrics | metrics, metric-pages, metric-entries |
| Finance | income, expenses, finance-categories, debts, debt-payments |
| HR | team-members, departments, leave-requests, hr-contracts, hr-change-requests, org-chart |
| Library | documents, knowledge, canvases |
| Automations | automations, automation-logs |
| Research & agents | competitor-workflows, competitor-reports, agents |
| Workspace | users, workspace, activity, credits |
Verbs are list, get, and — where the resource is writable —
create, update and detach. A resource that doesn't
support a verb says so instead of failing silently. There is no delete: by
design, the API is non-destructive, and
detach only unlinks a join record, leaving both sides intact.
Flags map 1:1 to the API's fields and filters:
kyo pipelines list
kyo deals list --pipeline_id <uuid> --limit 20
kyo deals create --name "Acme Corp" --pipeline_id <uuid> --value 5000
kyo deals update <id> --pipeline_stage_id <uuid>
kyo people create --name "Jane Doe" --email jane@acme.com
kyo tasks list --completed false
kyo comments add --entity_type deal --entity_id <id> --content "Followed up"
kyo expenses create --name "Figma" --date 2026-08-01 --amount 45 --type software
kyo leave-requests list --status pending
kyo deal-people detach --deal_id <uuid> --person_id <uuid>Reads and writes are bounded by the scopes you granted at sign-in and by your own permissions in the workspace — a command can't reach a feature you can't open in the app.
Output & scripting
All output is JSON, so it composes with jq and friends:
kyo deals list | jq '.data[].name'
List responses are { "data": […], "next_cursor": "…" } — pass
--cursor (and --limit, max 200) to page through, exactly like the
REST API.
Enrichment
kyo enrich acme.com
Looks up firmographics for a domain. This spends workspace credits and needs the
enrich:write scope, which is not in the default grant — opt in with
kyo login --scope "… enrich:write".
Configuration
Defaults work out of the box; override them with environment variables for dev or self-hosted workspaces:
| Variable | Purpose | Default |
|---|---|---|
KYO_APP_URL | Where the OAuth consent page lives | https://app.trykyo.com |
KYO_API_BASE | The API base (token, revoke, and REST endpoints) | Kyo's public API base |
KYO_ANON_KEY | The public apikey value | Kyo's published anon key |
Credentials & security
- Tokens are stored in
~/.kyo/credentials.jsonwith0600permissions. - Access tokens auto-refresh about 2 minutes before expiry, rotating the refresh token each time.
- The CLI is a public PKCE client — there is no client secret on disk.
- Revoke access any time with
kyo logout, or from Settings → API in the Kyo app.