CLI

The CLI manages organizations, apps, credentials, API keys and audiences. It does not send notifications: sending uses a secret key against the public API, from your backend. The mobile SDKs register devices and report opens; they do not send notifications.

Install

npm install -g @exostack/carillon-cli

Node 20 or later. No telemetry and no update checks.

carillon login
carillon use        # pick the organization and app the other commands work in
carillon whoami

carillon login opens a browser and prints the URL as a fallback, for a machine with no browser to open. Approve the code in the dashboard and the terminal continues.

┌  Approve this sign-in in your browser
│
│  https://app.carillon.dev/device?user_code=ABCD-EFGH
│
│  Code: ABCD-EFGH
│
└  Waiting for browser approval

Codes live ten minutes. The token is stored in ~/.config/carillon/credentials.json with mode 0600.

For CI, where no browser exists:

carillon login --email you@company.com --password "$CARILLON_PASSWORD"

Context

carillon use picks the organization and app every other command works in, and writes them to ~/.config/carillon/config.json. With exactly one organization and one app it selects them for you.

The commands

carillon login                        sign in through the browser (--email/--password for scripts)
carillon logout                       sign out and forget the stored token
carillon whoami                       who is signed in, and the current context

carillon use                          pick organization and app, interactively

carillon org list
carillon org create <name>
carillon org invite <email> [--role admin|member]

carillon app list
carillon app create <name>

carillon credential list
carillon credential upload            APNs .p8 or FCM service account JSON, guided

carillon key list
carillon key create [--type secret|mobile] [--name <label>]
carillon key revoke <id>

carillon audience list                audiences is accepted as an alias
carillon audience create              pick the filters one at a time, counting as you go
carillon audience preview [--json '<definition>']
carillon audience delete <name-or-id> [--yes]

--json on a listing command prints machine-readable output. On audience preview it takes a value, the definition itself, and skips the interactive builder.

carillon audience preview --json '{"filters":[{"field":"platform","value":"ios"},{"field":"last_active","within_days":30}]}'

Creating keys

carillon key create --type secret --name backend-production

Copy this secret key now. It cannot be retrieved later.

  carillon_sk_live_…

Store it in your server secret storage. If lost, revoke this key
and create another.

A mobile key prints the same way and stays readable afterwards in carillon key list.

Uploading a credential

carillon credential upload

Guided. For APNs it asks for the .p8 file, the 10-character Key ID (pre-filled from an AuthKey_XXX.p8 filename), the Team ID and the Bundle ID. For FCM it asks for the service account JSON and reads the project id out of it.

Pointing at another environment

CARILLON_API_URL=http://localhost:28080 CARILLON_AUTH_URL=http://localhost:28081 carillon whoami

Two hosts, because the public API and sign-in answer on different ones. The environment wins over the stored config.

MCP server · Authentication · Target an audience

On this page