CLI
The Kyo CLI puts your whole workspace in the terminal — list, create, and update anything in the CRM with scriptable JSON output. It signs in through your browser with OAuth (no API keys to manage) and includes the MCP server for AI agents.
Install
npm install -g kyo-cli
# or run without installing:
npx kyo-cli <command>Requires Node.js 18 or newer. The installed command is kyo.
Sign in
kyo login
This opens your browser to Kyo's consent screen and captures the redirect on a local
loopback port (RFC 8252) — the standard OAuth 2.0 + PKCE
flow, with no client secret on disk. The default grant is full read/write on your
workspace, except metered enrichment. Grant less (or opt in to enrichment) with
--scope:
kyo login --scope "deals:read deals:write tasks:read"kyo whoami shows the connection and granted scopes; kyo logout revokes it.
Commands
| Command | What it does |
|---|---|
kyo login [--scope "…"] | Sign in via browser OAuth |
kyo logout | Revoke the tokens and delete local credentials |
kyo whoami | Show the connection and granted scopes |
kyo <resource> <verb> | list, get, create, update, detach on any resource |
kyo enrich <domain> | Look up firmographics for a domain (metered) |
kyo help | Usage, plus the live list of resources this build supports |
kyo mcp | Run the local MCP server (stdio) |
Working with resources
Every API resource is a command — the resource name with
hyphens instead of underscores. kyo help prints the list your installed
version supports.
| Area | Commands |
|---|---|
| CRM | deals, people, companies, pipelines, pipeline-stages (stages), deal-tasks, deal-people, deal-labels, crm-files, labels |
| Tasks & spaces | tasks, task-attachments, spaces, projects, project-stages, space-members, space-updates, comments |
| Metrics | metrics, metric-pages, metric-entries |
| Finance | income, expenses, finance-categories, debts, debt-payments |
| HR | team-members, departments, leave-requests, hr-contracts, hr-change-requests, org-chart |
| Library | documents, knowledge, canvases |
| Automations | automations, automation-logs |
| Research & agents | competitor-workflows, competitor-reports, agents |
| Workspace | users, workspace, activity, credits |
Verbs are list, get, and — where the resource is writable —
create, update and detach. A resource that doesn't
support a verb says so instead of failing silently. There is no delete: by
design, the API is non-destructive, and
detach only unlinks a join record, leaving both sides intact.
Flags map 1:1 to the API's fields and filters:
kyo pipelines list
kyo deals list --pipeline_id <uuid> --limit 20
kyo deals create --name "Acme Corp" --pipeline_id <uuid> --value 5000
kyo deals update <id> --pipeline_stage_id <uuid>
kyo people create --name "Jane Doe" --email jane@acme.com
kyo tasks list --completed false
kyo comments add --entity_type deal --entity_id <id> --content "Followed up"
kyo expenses create --name "Figma" --date 2026-08-01 --amount 45 --type software
kyo leave-requests list --status pending
kyo deal-people detach --deal_id <uuid> --person_id <uuid>Reads and writes are bounded by the scopes you granted at sign-in and by your own permissions in the workspace — a command can't reach a feature you can't open in the app.
Output & scripting
All output is JSON, so it composes with jq and friends:
kyo deals list | jq '.data[].name'
List responses are { "data": […], "next_cursor": "…" } — pass
--cursor (and --limit, max 200) to page through, exactly like the
REST API.
Enrichment
kyo enrich acme.com
Looks up firmographics for a domain. This spends workspace credits and needs the
enrich:write scope, which is not in the default grant — opt in with
kyo login --scope "… enrich:write".
Configuration
Defaults work out of the box; override them with environment variables for dev or self-hosted workspaces:
| Variable | Purpose | Default |
|---|---|---|
KYO_APP_URL | Where the OAuth consent page lives | https://app.trykyo.com |
KYO_API_BASE | The API base (token, revoke, and REST endpoints) | Kyo's public API base |
KYO_ANON_KEY | The public apikey value | Kyo's published anon key |
Credentials & security
- Tokens are stored in
~/.kyo/credentials.jsonwith0600permissions. - Access tokens auto-refresh about 2 minutes before expiry, rotating the refresh token each time.
- The CLI is a public PKCE client — there is no client secret on disk.
- Revoke access any time with
kyo logout, or from Settings → API in the Kyo app.