CLI
The Kyo CLI puts your whole workspace in the terminal — list, create, and update anything in the CRM with scriptable JSON output. It signs in through your browser with OAuth (no API keys to manage) and includes the MCP server for AI agents.
Install
npm install -g kyo-cli
# or run without installing:
npx kyo-cli <command>Requires Node.js 18 or newer. The installed command is kyo.
Sign in
kyo login
This opens your browser to Kyo's consent screen and captures the redirect on a local
loopback port (RFC 8252) — the standard OAuth 2.0 + PKCE
flow, with no client secret on disk. The default grant is full read/write on your
workspace, except metered enrichment. Grant less (or opt in to enrichment) with
--scope:
kyo login --scope "deals:read deals:write tasks:read"kyo whoami shows the connection and granted scopes; kyo logout revokes it.
Commands
| Command | What it does |
|---|---|
kyo login [--scope "…"] | Sign in via browser OAuth |
kyo logout | Revoke the tokens and delete local credentials |
kyo whoami | Show the connection and granted scopes |
kyo <resource> <verb> | list, get, create, update on any resource |
kyo enrich <domain> | Look up firmographics for a domain (metered) |
kyo mcp | Run the local MCP server (stdio) |
Working with resources
Resources: deals, people, companies,
tasks, deal-tasks, pipelines, stages,
spaces, projects, labels, comments.
Verbs: list, get, and (where writable) create,
update. There is no delete — by design, the
API is non-destructive.
Flags map 1:1 to the API's fields and filters:
kyo pipelines list
kyo deals list --pipeline_id <uuid> --limit 20
kyo deals create --name "Acme Corp" --pipeline_id <uuid> --value 5000
kyo deals update <id> --pipeline_stage_id <uuid>
kyo people create --name "Jane Doe" --email jane@acme.com
kyo tasks list --completed false
kyo comments add --entity_type deal --entity_id <id> --content "Followed up"Output & scripting
All output is JSON, so it composes with jq and friends:
kyo deals list | jq '.data[].name'
List responses are { "data": […], "next_cursor": "…" } — pass
--cursor (and --limit, max 200) to page through, exactly like the
REST API.
Enrichment
kyo enrich acme.com
Looks up firmographics for a domain. This spends workspace credits and needs the
enrich:write scope, which is not in the default grant — opt in with
kyo login --scope "… enrich:write".
Configuration
Defaults work out of the box; override them with environment variables for dev or self-hosted workspaces:
| Variable | Purpose | Default |
|---|---|---|
KYO_APP_URL | Where the OAuth consent page lives | https://app.trykyo.com |
KYO_API_BASE | The API base (token, revoke, and REST endpoints) | Kyo's public API base |
KYO_ANON_KEY | The public apikey value | Kyo's published anon key |
Credentials & security
- Tokens are stored in
~/.kyo/credentials.jsonwith0600permissions. - Access tokens auto-refresh about 2 minutes before expiry, rotating the refresh token each time.
- The CLI is a public PKCE client — there is no client secret on disk.
- Revoke access any time with
kyo logout, or from Settings → API in the Kyo app.