tokener

# tokener `tokener search "<intent>" --json` indexes API commands only. Inspect an unfamiliar API command with `tokener commands show <path...> --json` before running it. Do not guess flags or body shape, and do not execute from search results. Prefer `-o json`. On error, read `error.code`, `error.message`, and `error.hint`. If `mutation` is not `read`, pass `--dry-run` first unless the user confirmed execution. Use `tokener commands --json` for the full API index and `references/catalog.md` for discovery and execution rules. ## Auth - `tokener auth login`: browser device login. Defaults to `console.tokener.dev`. Use `--hostname` or `$TOKENER_HOST` only for another host. `--no-browser` prints the URL and code. - `tokener auth login --with-token`: PAT on stdin (`tkr_pat_...`). - `tokener auth status -o json` and `tokener auth use <host>`: inspect or select the host. ## Agent - `tokener agent [<harness>]`: launch through the Tokener Gateway. Interactive terminals may omit the harness; scripts must pass one of: claude, codex, opencode, pi, dsh, kimi. - `tokener agent key login` and `tokener agent key status`: bind or inspect the local agent key. Status does not create or rotate a key. ## Keys - `tokener keys create`: `--name` is optional. Nested `limits` have no typed flags; set decimals with `--set-str`, for example `--set-str limits.maxBudgetUsd=100`. - `tokener keys replace-limits` replaces the entire limit set; omitted fields are cleared. - Treat `keys create` and `keys reveal` output as credentials. Do not write them to logs or shell history. ## Skill and update - `tokener skill install`: preview with `--dry-run` before `--yes`. - `tokener update`: do not pass `--yes` unless the user asked to replace the binary.