Docs
⌘K

CLI: Accounts, projects and access

Sign in, pick the organization and project commands act on, manage team members, roles, app users, auth settings and API keys with sov.

Updated Oct 16, 2026
sov login
sov orgs
sov projects <org-id>
sov scope pick
sov whoami

sov context

Context and identity commands

sov context whoami

Print the authenticated user, active scope, and accessible orgs/projects.

sov context whoami [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov context list

List organisations and projects you can use with the CLI.

sov context list [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov context orgs

List organisations visible to the authenticated user.

sov context orgs [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov context projects

List projects under an organisation.

sov context projects [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextoptional
Organisation ID (auto-picked when only one org)
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov context pick

Interactively pick default org/project scope by index.

sov context pick [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov context context

Show access roles the current user has on a specific resource.

sov context context [OPTIONS] RESOURCE_ID

Arguments and options

RESOURCE_IDtextrequired
Node ID of the resource (ORG / PROJECT / ENV)
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov scope

Manage default org/project/env scope

sov scope show

Show currently configured default scope.

sov scope show [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov scope set

Persist default scope for future CLI calls.

sov scope set [OPTIONS] ORG_ID PROJECT_ID

Arguments and options

ORG_IDtextrequired
Organization UUID
PROJECT_IDtextrequired
Project UUID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov scope clear

Clear default scope for the active profile.

sov scope clear [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov scope list

List organisations and projects available to your account.

sov scope list [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov scope pick

Pick default org/project interactively by index.

sov scope pick [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov org

Organisation management

sov org create

Create a new organisation (or PROJECT/ENV) node in the identity graph.

sov org create [OPTIONS] NAME

Example: sov org create "Acme Corp" sov org create "Payments" --type PROJECT --metadata '{"env": "prod"}'

Arguments and options

NAMEtextrequired
Human-readable organisation name
--type / -ttextoptionaldefault ORG
Node type: ORG | PROJECT | ENV
--metadata / -mtextoptional
Extra metadata as a JSON string, e.g. '{"industry": "fintech"}'
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov org member-add

Add a user as a member of an organisation (creates a MEMBER_OF edge).

sov org member-add [OPTIONS] ORG_ID USER_ID

Example: sov org member-add <org_id> <user_id> sov org member-add <org_id> <user_id> --role ADMIN

Arguments and options

ORG_IDtextrequired
UUID of the ORG/PROJECT node
USER_IDtextrequired
UUID of the USER node to add
--role / -rtextoptionaldefault MEMBER
Role to assign: ADMIN | MEMBER | VIEWER (default: MEMBER)
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam

Organisations, members, and project settings

sov iam orgs

List organisations visible to the authenticated user.

sov iam orgs [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam org

Fetch one organisation by ID.

sov iam org [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextrequired
Organisation node ID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam projects

List child projects under an organisation.

sov iam projects [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextoptional
Parent organisation ID (defaults to scoped org)
--relationtextoptionaldefault OWNS
Edge relation filter
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam members

List organisation members.

sov iam members [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextoptional
Organisation ID (defaults to scoped org)
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam member-add

Add a member to an organisation.

sov iam member-add [OPTIONS] ORG_ID USER_ID

Arguments and options

ORG_IDtextrequired
Organisation ID
USER_IDtextrequired
User node ID
--roletextoptionaldefault MEMBER
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam settings-get

Fetch project settings for the linked scope.

sov iam settings-get [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam settings-set

Update project settings (keys you pass are merged; the rest stay as they are).

sov iam settings-set [OPTIONS] SETTINGS_JSON

Example: sov iam settings-set '{"apiRateLimitPerUserPerMinute": 120}'

Arguments and options

SETTINGS_JSONtextrequired
JSON object of project settings
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam org-update

Update organisation name and/or admin settings.

sov iam org-update [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextrequired
Organisation node ID
--nametextoptional
--settingstextoptional
JSON settings object
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam org-delete

Delete an organisation (async teardown).

sov iam org-delete [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextrequired
Organisation node ID
--yes / -yflagoptional
Skip confirmation
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam org-set-plan

Set an organisation billing plan.

sov iam org-set-plan [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextrequired
Organisation node ID
--plantextrequired
free | pro | ultra | team | enterprise
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam member-remove

Remove a member from an organisation.

sov iam member-remove [OPTIONS] ORG_ID USER_ID

Arguments and options

ORG_IDtextrequired
Organisation ID
USER_IDtextrequired
User node ID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam member-update

Update a member's organisation role.

sov iam member-update [OPTIONS] ORG_ID USER_ID

Arguments and options

ORG_IDtextrequired
Organisation ID
USER_IDtextrequired
User node ID
--roletextrequired
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam invite-create

Create or refresh an organisation invite.

sov iam invite-create [OPTIONS] ORG_ID

Arguments and options

ORG_IDtextrequired
Organisation ID
--emailtextrequired
--roletextrequired
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam invite-accept

Accept an organisation invite.

sov iam invite-accept [OPTIONS] TOKEN

Arguments and options

TOKENtextrequired
Invite token
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam edge-create

Create a directed edge in the identity graph.

sov iam edge-create [OPTIONS]

Arguments and options

--sourcetextrequired
--targettextrequired
--relationtextrequired
OWNS | MEMBER_OF | HAS_ENV
--roletextoptional
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam roles-catalog

Fetch the project roles catalog.

sov iam roles-catalog [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam project-ref

Fetch the public project ref slug.

sov iam project-ref [OPTIONS] PROJECT_ID

Arguments and options

PROJECT_IDtextrequired
Project node ID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam roles-matrix get

Fetch the project role permission matrix.

sov iam roles-matrix get [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov iam roles-matrix set

Replace the project role permission matrix.

sov iam roles-matrix set [OPTIONS] MATRIX_JSON

Arguments and options

MATRIX_JSONtextrequired
JSON role matrix object
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth

Authentication commands

sov auth login

Authenticate with Sovaria.

sov auth login [OPTIONS]

By default opens a browser (PKCE flow). Pass --email to use password login (prompt or SOVARIA_PASSWORD).

Arguments and options

--email / -etextoptional
Email (skips PKCE, uses password)
--pick-scope / --no-pick-scopeflagoptional
After login, list orgs/projects and pick default scope (default: on in a TTY)
--insecure-callbackflagoptional
Allow SOVARIA_CLI_CALLBACK_HOST to bind a non-loopback interface
--file-storageflagoptional
Store tokens in ~/.sovaria/credentials.toml instead of the OS keyring
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth logout

Revoke the session for one profile, then clear that profile's local credentials.

sov auth logout [OPTIONS]

Arguments and options

--forceflagoptional
Clear local tokens even if server revoke fails
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth mfa-verify

Complete MFA after login when the gateway returned mfa_required=true.

sov auth mfa-verify [OPTIONS]

Arguments and options

--code / -ctextrequired
6-digit TOTP or backup code
--methodtextoptionaldefault totp
Verification method: totp or phone
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth sessions

List active login sessions for the current user.

sov auth sessions [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth sessions-revoke

Revoke one active session.

sov auth sessions-revoke [OPTIONS] SESSION_ID

Arguments and options

SESSION_IDtextrequired
Session id (refresh token JTI)
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth sessions-revoke-others

Revoke all sessions except the current one.

sov auth sessions-revoke-others [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth mfa-status

Show MFA enrollment status for the current user.

sov auth mfa-status [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth mfa-enroll

Start TOTP MFA enrollment (shows secret, URI, and backup codes once).

sov auth mfa-enroll [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth mfa-disable

Disable MFA (requires current TOTP code).

sov auth mfa-disable [OPTIONS]

Arguments and options

--code / -ctextrequired
Current TOTP code to confirm disable
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth project-login

Authenticate against the strict project login lane.

sov auth project-login [OPTIONS]

Arguments and options

--email / -etextrequired
--file-storageflagoptional
Store tokens in ~/.sovaria/credentials.toml instead of the OS keyring
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth verify-email send

Send a verification email to the authenticated user.

sov auth verify-email send [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth verify-email confirm

Confirm an email address using a verification token.

sov auth verify-email confirm [OPTIONS]

Read the token from stdin or SOVARIA_VERIFY_EMAIL_TOKEN (never a CLI flag).

  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth sessions-config get

Fetch the authenticated user's session policy.

sov auth sessions-config get [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth sessions-config set

Update the authenticated user's session policy.

sov auth sessions-config set [OPTIONS] CONFIG_JSON

Arguments and options

CONFIG_JSONtextrequired
JSON session policy patch
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth providers-config get

Fetch auth provider runtime configuration.

sov auth providers-config get [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth providers-config set

Update auth provider toggles and external database link configuration.

sov auth providers-config set [OPTIONS] CONFIG_JSON

Arguments and options

CONFIG_JSONtextrequired
JSON provider config patch
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth event-hooks list

List auth event hooks for the active project.

sov auth event-hooks list [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth event-hooks create

Create an auth event hook subscription.

sov auth event-hooks create [OPTIONS]

Arguments and options

--nametextrequired
--urltextrequired
--eventtextrequired
Repeat for each event type
--secrettextoptional
--enabled / --disabledflagoptional
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth event-hooks delete

Delete an auth event hook.

sov auth event-hooks delete [OPTIONS] HOOK_ID

Arguments and options

HOOK_IDtextrequired
Auth event hook ID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth github-state get

Fetch GitHub OAuth connection state.

sov auth github-state get [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth github-state disconnect

Disconnect GitHub OAuth broker state.

sov auth github-state disconnect [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth passkeys list

List passkeys registered for the current user.

sov auth passkeys list [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth passkeys revoke

Revoke a registered passkey.

sov auth passkeys revoke [OPTIONS] PASSKEY_ID

Arguments and options

PASSKEY_IDtextrequired
Passkey UUID
--yes / -yflagoptional
Skip confirmation prompt
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth passkeys register-hint

Explain how to register a passkey (browser WebAuthn required).

sov auth passkeys register-hint

sov auth oidc list

List OIDC providers configured for the linked project.

sov auth oidc list [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth oidc create

Register an OIDC provider for the linked project.

sov auth oidc create [OPTIONS] CONFIG

Arguments and options

CONFIGtextrequired
JSON provider config or path starting with @file.json
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth oidc example

Print a starter OIDC provider config (Google-style example).

sov auth oidc example [OPTIONS]

Arguments and options

--savepathoptional
Write example JSON to this path

sov auth oidc delete

Remove an OIDC provider.

sov auth oidc delete [OPTIONS] PROVIDER_ID

Arguments and options

PROVIDER_IDtextrequired
Provider UUID
--yes / -yflagoptional
Skip confirmation prompt
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth oidc login-url

Get the OIDC authorization URL to start SSO in a browser.

sov auth oidc login-url [OPTIONS] PROVIDER_ID

Arguments and options

PROVIDER_IDtextrequired
Provider UUID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth-product

Product auth admin commands

sov auth-product users

One page of app users (newest first).

sov auth-product users [OPTIONS]

Search and status filter on the server.

Arguments and options

--search / -stextoptional
Part of an email, or an exact user id
--statustextoptional
active or banned
--limitint rangeoptionaldefault 50
--cursortextoptional
next_cursor from the previous page
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth-product ban

Toggle a product user's active state in scope.

sov auth-product ban [OPTIONS] USER_ID

Arguments and options

USER_IDtextrequired
Product user id to ban/unban
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth-product delete

Delete a product user credential in scope.

sov auth-product delete [OPTIONS] USER_ID

Arguments and options

USER_IDtextrequired
Product user id to delete
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth-product roles

Show a product user's app roles in scope.

sov auth-product roles [OPTIONS] USER_ID

Arguments and options

USER_IDtextrequired
Product user id
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth-product roles-set

Replace a product user's app roles in scope.

sov auth-product roles-set [OPTIONS] USER_ID ROLES

Arguments and options

USER_IDtextrequired
Product user id
ROLEStextrequired
Roles to assign
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov auth-product create

Create a product user in the current project scope.

sov auth-product create [OPTIONS]

Arguments and options

--emailtextrequired
--nametextoptional
Display name (defaults to email local-part)
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov keys

Project API keys

sov keys list

List API keys for the current project.

sov keys list [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov keys create

Create a new project API key.

sov keys create [OPTIONS]

The secret is shown once.

Arguments and options

--nametextrequired
Human-readable key name
--roletextoptionaldefault service_role
Key role label
--metadatatextoptional
JSON object
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov keys ensure-defaults

Bootstrap default anon + service_role keys if missing.

sov keys ensure-defaults [OPTIONS]
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov keys revoke

Revoke an API key.

sov keys revoke [OPTIONS] KEY_ID

Arguments and options

KEY_IDtextrequired
API key ID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov project

Project scaffold commands

sov project init-config

Create a template sovaria.config.json file.

sov project init-config [OPTIONS] NAME

Arguments and options

NAMEtextoptional
Project name used in the generated config
--output / -otextoptionaldefault sovaria.config.json
Path to write the template config JSON
--forceflagoptional
Overwrite existing config file if present

sov project create

Create a project from sovaria.config.json.

sov project create [OPTIONS]

Arguments and options

--config / -ctextoptionaldefault sovaria.config.json
Path to sovaria project config JSON
--dirtextoptionaldefault .
Parent directory where the project folder will be created
--forceflagoptional
Allow scaffold to overwrite existing files when possible

sov project status

Show local sovaria.config.json linkage and resolved scope.

sov project status

sov project use

Set default scope for CLI commands (profile only, no config file write).

sov project use [OPTIONS] ORG_ID PROJECT_ID

Arguments and options

ORG_IDtextrequired
Organisation node ID
PROJECT_IDtextrequired
Project node ID
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

sov project export

Export the full project data plane (Postgres dump + migration metadata).

sov project export [OPTIONS]

Bundle includes postgres.sql.gz (all schemas), manifest.json, storage-metadata.json, and RESTORE.md. Vault object bytes are not included — use sov storage download.

Arguments and options

--output / -opathoptionaldefault sovaria-export.tar.gz
Local path for the export bundle (.tar.gz)
--listflagoptional
List recent exports instead of creating one
  • Also takes --profile, --org, --project and --env to act on another account, organization, project or environment.

Related

CLI referenceConnect your app
Something unclear or missing on this page?Tell us