env zero CLI command reference

This page covers env zero CLI version 2.6.0. Run env0 <command> --help to print the flags of the version you have installed. To install the CLI and run a first deployment, see env zero CLI.

Global flags and environment variables

Every command accepts these flags:

Flag	Environment variable	Default	Description
`--api-key-id`	`ENV0_API_KEY_ID`	none	API key id
`--api-key-secret`	`ENV0_API_KEY_SECRET`	none	API key secret
`--api-url`	`ENV0_API_URL`	`https://api.env0.com`	env zero API host
`-o`, `--output`	none	`json`	Output format: `json`, `compact`, or `table`

The CLI also reads these environment variables:

Variable	Description
`ENV0_ORGANIZATION_ID`	Organization for commands that take `--organization`
`ENV0_PROJECT_ID`	Project for commands that take `--project`
`ENV0_CONFIG_HOME`	Directory for stored context. The CLI writes to an `env0` folder inside it. Defaults to your OS user config directory.
`ENV0_TELEMETRY_DISABLED`, `DO_NOT_TRACK`	Turn off telemetry
`ENV0_CLIENT`	Tag that telemetry reports instead of `cli`. Set it when you embed the CLI in another tool.

Each value resolves in this order: flag, then environment variable, then stored context, then default. In CI and agents, set the environment variables so each run is explicit and does not depend on stored state. env0 login stores credentials and a default host, organization, and project, so later commands need no flags.

Browser sign-in. With no API key set and a terminal attached, login opens a browser sign-in and asks you to confirm a short code. --no-browser prints the URL instead.
API key. When --api-key-id and --api-key-secret (or ENV0_API_KEY_ID and ENV0_API_KEY_SECRET) are set, login validates and stores that key.
No key and no terminal. login exits 3. CI and agents should set the API key environment variables and skip login.

On a terminal, login then asks you to pick an organization and project. Without a terminal, it stores the --organization and --project you pass. Credentials are stored in the OS keychain. If the keychain write fails, the CLI writes them to a plain-text file readable only by your user, prints a warning: line on stderr naming the file, and still exits 0. env0 logout removes that file. Credentials are scoped to the API host they were issued for. Signing in to a second host does not sign you out of the first, and a host you have not signed in to exits 3 even when another host is authenticated. The host, organization, and project are stored once, in config.json, so switching hosts means running login again. Browser sign-in works out which env zero tenant to use from the API host. For a host outside env0.com, it exits 64 unless you pass --tenant. API keys work against any host.

Output

Every command prints one JSON envelope, except env0 skill show (raw Markdown) and env0 deployment logs --follow (a log stream). Data goes to stdout and errors go to stderr:

{ "apiVersion": "0.1", "data": { } }

{ "apiVersion": "0.1", "error": { "type": "not_found", "message": "...", "hint": "...", "host": "https://api.env0.com" } }

-o json prints indented JSON. -o compact prints the same JSON on one line, for jq. -o table prints aligned columns.
On error, stdout is empty and the exit code is non-zero, so env0 ... -o compact | jq .data is safe.
Arrays are always arrays. An empty result is [], never null or a missing key.
error.host names the host the CLI was pointed at. It is absent for usage errors and for failures before a host is chosen. Credentials and paths are removed from it.

Pagination

environment list, deployment list, and plan list return at most 100 rows by default and add a page object next to data:

{ "apiVersion": "0.1", "data": [ ], "page": { "truncated": true, "nextOffset": 100 } }

"truncated": true means more rows exist. Pass --all to fetch every page. --limit accepts 1 to 100. organization list, project list, and template list are not paginated. They return the whole collection and take no --limit or --all.

Exit codes

Code	`error.type`	Meaning
`0`	none	Success
`1`	`unknown`	Unexpected error, or a `--wait` or `--follow` deployment that ended in a failed state
`2`	`user_input`, `conflict`	The backend rejected well-formed input, or the resource is in a conflicting state
`3`	`auth`	Missing credentials, or no permission for the operation or resource
`4`	`not_found`	The resource does not exist
`64`	`usage`	Wrong invocation: unknown command or flag, missing or conflicting arguments, `--limit` outside 1 to 100, or an unplaceable sign-in host
`75`	`transient`	Retry later. Also returned when `--wait` hits its `--timeout` before the deployment finishes.

With --wait or deployment logs --follow, the exit code reflects the deployment’s final status:

Final status	Exit code
`SUCCESS`, `SKIPPED`, `WAITING_FOR_USER`	`0`
`FAILURE`, `INTERNAL_FAILURE`, `TIMEOUT`, `CANCELLED`, `ABORTED`	`1`

The deployment is printed to stdout in both cases, including failedCommand and errorMessage when it failed. WAITING_FOR_USER means the deployment needs approval, not that it failed.

context

env0 context <environment-id> [--deployments <n>]

Returns an environment’s state, recent deployments, and a failure summary in one call. Read .data.summary first, then .data.deployments, then deployment logs for the full error.

Flag	Default	Description
`--deployments`	`5`	Number of recent deployments to include, 1 to 100

The output has these keys:

environment: the same object environment get returns.
deployments: recent deployments, newest first.
summary: drift status and the latest deployment’s status and type. When that deployment failed (FAILURE, INTERNAL_FAILURE, or TIMEOUT), it also carries failedCommand, a truncated errorMessage, and exitCode. It carries costEstimation when the environment has one.
subEnvironments: for a workflow environment, each sub-environment’s alias, plus the revision and status of its latest deployment.

Organizations

organization list

env0 organization list

Lists every organization you can access. org is an alias for organization.

organization get

env0 organization get <organization-id>

organization use

env0 organization use [<organization-id>]

Stores a default organization for later commands. Without an id on a terminal, it shows a picker.

Projects

project list

env0 project list [--organization <organization-id>]

Lists every project in the organization.

project get

env0 project get <project-id>

project create

env0 project create --name <name> [--organization <organization-id>] [flags]

Flag	Description
`--name`	Project name. Required.
`--organization`	Organization to create the project in
`--description`	Project description
`--parent`	Parent project id, to nest the new project under it
`--tag`	Project tag. Repeatable.

The new project does not become your stored project. Pass its id (.data.id) as --project to later commands, or run env0 project use <project-id>. Requires permission to create projects in the organization.

project archive

env0 project archive <project-id>

Archives the project. project get and project list still return it with isArchived: true. The CLI cannot unarchive a project, and archiving a project cannot be undone.

project use

env0 project use [<project-id>]

Stores a default project, and its organization, for later commands. Without an id on a terminal, it shows a picker of the stored organization’s projects.

Templates

template list

env0 template list (--organization <organization-id> | --project <project-id>)

Lists templates in exactly one scope. Passing both flags, or neither with no stored context, exits 64.

template get

env0 template get <template-id>

template create

env0 template create --name <name> --repository <url> --type <type> [flags]

Flag	Description
`--name`	Template name. Required.
`--repository`	Git repository URL. Required. A trailing `.git` is removed.
`--type`	IaC type, for example `terraform`, `opentofu`, `terragrunt`, or `workflow`. Required.
`--organization`	Organization to create the template in. Required unless stored.
`--project`	Project to assign the new template to. Defaults to the stored project.
`--path`	Path to the IaC code in the repository
`--revision`	Default branch or tag
`--iac-version`	IaC tool version. Terraform defaults to `RESOLVE_FROM_TERRAFORM_CODE`, OpenTofu to `latest`.
`--vcs-connection-id`	VCS connection for a private repository
`--github-installation-id`	GitHub App installation id for a private repository
`--token-id`	VCS token id for a private repository
`--gitlab`	The repository is hosted on GitLab

Requires permission to manage templates in the organization.

template assign

env0 template assign <template-id> --project <project-id>

Assigns a template to a project. environment create --template only deploys templates assigned to the target project.

template delete

env0 template delete <template-id>

Removes the template from template list. template get can still return the record.

Environments

env is an alias for environment. Actions take an environment id, not a name.

environment list

env0 environment list [flags]

Flag	Description
`--project`	Filter by project
`--organization`	Filter by organization
`--name`	Filter by exact name. Not a substring match.
`--tag`	Filter by `KEY` or `KEY=VALUE`. Repeatable. An environment must match every tag.
`--limit`	Maximum rows, 1 to 100
`--all`	Fetch every page

All filters are optional and combine. The list does not include workflow sub-environments. To see them, run context on the workflow environment.

environment get

env0 environment get <environment-id>

The output always includes tags, as {} when the environment has none.

environment create

env0 environment create --name <name> --project <project-id> (--template <template-id> | --repository <url>) [flags]

Creates an environment and starts its first deployment. The output is that deployment. With --wait, its environmentId is the new environment’s id.

Flag	Description
`--name`	Environment name. Required.
`--project`	Project to create the environment in. Required unless stored.
`--template`	Template to deploy. Use this or `--repository`.
`--repository`	Git repository to deploy without a template. A trailing `.git` is removed. Requires `--type` and `--organization`.
`--type`	IaC type for `--repository`, for example `terraform`, `opentofu`, `terragrunt`, or `workflow`
`--organization`	Organization. Required with `--repository`.
`--path`	Path to the IaC code in the repository, with `--repository`
`--revision`	Branch or tag to deploy
`--iac-version`	IaC tool version, with `--repository`. Terraform defaults to `RESOLVE_FROM_TERRAFORM_CODE`, OpenTofu to `latest`.
`--vcs-connection-id`	VCS connection for a private repository
`--github-installation-id`	GitHub App installation id for a private repository
`--token-id`	VCS token id for a private repository
`--gitlab`	The repository is hosted on GitLab
`--workspace-name`	Terraform workspace name. Set once at creation and cannot be changed.
`--var`	Environment variable as `KEY=VALUE`. Repeatable.
`--secret`	Sensitive environment variable as `KEY=VALUE`. Repeatable.
`--tf-var`	Terraform variable as `KEY=VALUE`. Repeatable.
`--requires-approval`	Require approval before each deployment, including the first
`--ttl`	Lifespan as a duration (`2h`) or RFC 3339 timestamp, after which env zero destroys the environment. The minimum is `1h`. See environment ttl.
`--tag`	Tag as `KEY=VALUE`. Repeatable. Repeat a key to give it several values.
`--comment`	Deployment comment
`-f`, `--manifest`	Workflow manifest file, with `--template`. See Deploy workflows with the CLI.
`--wait`	Wait for the deployment to finish. See Waiting for a deployment.
`--quiet`	With `--wait`, do not stream logs to stderr
`--poll-interval`	How often `--wait` polls. Default `5s`.
`--timeout`	How long `--wait` waits. Default `1h`.

A --repository environment gets a single-use template that needs no cleanup. When no cloud credential is assigned to the project, pass provider credentials as --secret, for example --secret AWS_ACCESS_KEY_ID=.... An assigned credential keeps keys out of your shell history and process list.

environment deploy

env0 environment deploy <environment-id> [flags]

Starts a deployment and prints it. A deployment started while another is running is queued, not rejected.

Flag	Description
`--revision`	Branch or tag to deploy
`--target`	Resource target. Repeatable.
`--var`, `--secret`, `--tf-var`	Variables, as on `environment create`. Repeatable.
`--requires-approval`	Require approval for this deployment. `--requires-approval=false` skips it. Omit to keep the environment’s setting.
`--comment`	Deployment comment
`-f`, `--manifest`	Workflow manifest file
`--node`	Deploy only this workflow sub-environment, by alias
`--run-from-here`	With `--node`, also deploy every sub-environment downstream of it
`--wait`, `--quiet`, `--poll-interval`, `--timeout`	As on `environment create`
`--pretty`	Print a readable summary and step headings instead of JSON. Cannot be combined with `-o`.

--manifest, --node, and --run-from-here are covered in Deploy workflows with the CLI.

environment destroy

env0 environment destroy <environment-id> --yes [flags]

Destroys the environment’s resources. This cannot be undone, so it requires --yes (or --force) and has no prompt. On an environment that requires approval, the destroy waits at WAITING_FOR_USER like any deployment.

Flag	Description
`--yes`, `--force`	Confirm the destroy. Required.
`--skip-state-refresh`	Skip the state refresh during the destroy plan
`--checkout-updated-code`	Check out the latest revision before destroying
`--requires-approval`	Require approval for this destroy. `--requires-approval=false` skips it.
`--comment`	Destroy comment
`--node`	Destroy only this workflow sub-environment, by alias
`--wait`, `--quiet`, `--poll-interval`, `--timeout`, `--pretty`	As on `environment deploy`

environment archive

env0 environment archive <environment-id>

Marks the environment inactive without running a deployment, so its cloud resources stay. Run destroy first to remove them. See mark an environment as inactive.

env0 environment tag list [<environment-id>] [--organization <organization-id>]

With an id, prints that environment’s tags, for example {"team": ["eng", "payments"]}. Without one, prints every tag key and value used in the organization. tags is an alias for tag.

environment tag set

env0 environment tag set <environment-id> KEY=VALUE [KEY=VALUE...]

Replaces the whole value list of each key you name and leaves other keys alone. To keep an existing value, pass it again: team=eng team=payments. Prints the updated environment.

environment tag remove

env0 environment tag remove <environment-id> KEY [KEY...]

Removes each key with all of its values. Passing KEY=VALUE exits 64. Tag limits and permissions are listed in Environment tags. Tags are visible to anyone who can view the environment, so do not put secrets in them.

environment ttl set

env0 environment ttl set <environment-id> <duration|timestamp>

Replaces the environment’s lifespan. A duration counts from now, not from the current end, so ttl set <environment-id> 2h can bring the end forward. The minimum is 1h. Read the new end from lifespanEndAt in the output: env zero truncates it to the minute.

environment ttl extend

env0 environment ttl extend <environment-id> <duration>

Adds the duration to the current end, or to now if the end has passed. On an environment with no TTL, exits 2. extend reads the current end and then writes a new one, so a TTL change someone makes in between is overwritten.

environment ttl clear

env0 environment ttl clear <environment-id>

Removes the TTL, so env zero never destroys the environment automatically. lifespanEndAt disappears from the output. For default and maximum TTLs, see Configure policy TTL.

Waiting for a deployment

--wait polls the deployment until it reaches a final status, then exits with the code for that status. It retries 5xx and 429 responses. A deployment that reaches WAITING_FOR_USER stops the wait with exit 0. Approve it with deployment approve. While it waits, the deployment’s step logs stream to stderr. Stdout still receives only the final deployment, so --wait -o compact | jq works. Logs keep their color on a terminal and lose it when redirected. Secrets are redacted before the logs reach the CLI.

Deployments

deployment list

env0 deployment list --environment <environment-id> [--limit <n>] [--all]

Lists deployments, newest first. Paginated, see Pagination.

deployment get

env0 deployment get <deployment-id>

Includes a truncated errorMessage, failedCommand, and exitCode for a failed deployment.

deployment logs

env0 deployment logs <deployment-id> [--follow] [--poll-interval <duration>]

Without --follow, prints the deployment’s captured output and full errorMessage, with color codes removed. Use it for the root cause of a failure. With --follow (-f), streams the logs to stdout until the deployment finishes, then exits like --wait. The stream is text grouped by step. With -o json or -o compact it is newline-delimited JSON, one {"step", "level", "message", "timestamp"} object per line, with no envelope. --poll-interval defaults to 3s.

deployment approve

env0 deployment approve <deployment-id>

Resumes a deployment at WAITING_FOR_USER. The status changes a few seconds later. Approving a deployment that has already moved on exits 2 and is harmless. Approval rights do not approve your own deployments automatically.

deployment cancel

env0 deployment cancel <deployment-id>

Cancels a QUEUED deployment, or rejects one at WAITING_FOR_USER.

deployment abort

env0 deployment abort <deployment-id>

Aborts an IN_PROGRESS deployment. approve, cancel, and abort return right away and take no --wait. To follow a resumed deployment, poll deployment get until its status leaves WAITING_FOR_USER, then run deployment logs <deployment-id> --follow.

Plans

plan list

env0 plan list --environment <environment-id> [--limit <n>] [--all]

Lists plan summaries across an environment’s deployments. Paginated, see Pagination.

plan get

env0 plan get <deployment-id>

Returns the plan stored with a deployment. Check planAvailable first: most deployments, including those at WAITING_FOR_USER, store no plan. With no plan, resourceChanges and outputChanges are [], the same as a plan with no changes.

resourceChanges[].action shows delete and recreate only when a plan is stored.
The deployment’s planSummary counts can be higher than the entries in resourceChanges. Use resourceChanges for the actual resources.
To see what drifted, run plan get on the latest deployment with type driftDetection. See Drift detection.

Cost estimation

environment get, context (under summary), plan get, and deployment get include costEstimation: totalMonthlyCost and the deployment’s monthlyCostDiff, as numbers with no currency. The table output assumes USD. The field is null when cost estimation is off for the organization or the deployment produced no estimate.

Variables

variable list

env0 variable list [--environment <environment-id>] [flags]

Lists the variables configured on a scope, with sensitive values masked. var is an alias for variable.

Flag	Description
`--environment`	Environment whose variables to list. Its organization and project are used for the other scopes.
`--project`	Project scope
`--blueprint`	Template scope
`--organization`	Organization scope. Required unless set by `--environment` or stored.

VCS connections

vcs list

env0 vcs list [--organization <organization-id>] [--type <type>]

Lists the organization’s VCS connections. Pass a connection’s id as --vcs-connection-id to template create or environment create for a private repository. Its accessScope, for example Organization:acme, must cover the repository’s owner. --type filters by provider, for example GitHub or GitLab.

API keys

The CLI manages two kinds of API key:

	`env0 api-key`	`env0 personal-api-key`
Acts as	The organization	You
Permissions	The `--role` you grant	Yours
Requires organization settings permission	Yes, for `list`, `create`, and `revoke`	No
Keeps working after you leave	Yes	No

Use an organization key for shared CI. Use a personal key on your own machine, or when actions must be attributed to you. Both create commands print apiKeySecret once. No command returns it again. The returned apiKeyId and apiKeySecret are the values for ENV0_API_KEY_ID and ENV0_API_KEY_SECRET. Keys do not expire.

api-key list

env0 api-key list [--organization <organization-id>]

Lists the organization’s keys without secrets, including lastUsedAt. Custom roles show as their id.

api-key create

env0 api-key create --name <name> --role <role> --yes [flags]

Flag	Description
`--name`	Key name. Names are not unique. Required.
`--role`	Organization role: `Admin`, `User`, or a custom role id. Required, because env zero grants Admin when the role is omitted.
`--yes`	Confirm creating a long-lived credential. Required.
`--organization`	Organization to create the key in
`--project-role`	Project role as `PROJECT_ID=ROLE`, where `ROLE` is `Admin`, `Deployer`, `Planner`, `Viewer`, or a custom role id. Repeatable.
`--read-only`	Limit the key to read-only access

No command shows a key’s project roles after creation.

api-key revoke

env0 api-key revoke "<id>" --yes

Takes the id field from api-key list, which looks like auth0|abc123, not the apiKeyId field. Quote it, because | is a shell pipe. Revoking cannot be undone. The key leaves the list at once but can keep authenticating for a short time afterwards. --force is an alias for --yes.

personal-api-key list

env0 personal-api-key list

personal-api-key create

env0 personal-api-key create --name <name> --yes

Creates a key with your permissions. It stops working when your user account does.

personal-api-key revoke

env0 personal-api-key revoke "<id>" --yes

Takes the id field, not apiKeyId. Another user’s key id exits 4.

env0 login [flags]

Flag	Description
`--organization`	Organization to store when there is no terminal
`--project`	Project to store when there is no terminal
`--no-browser`	Print the sign-in URL instead of opening a browser
`--read-only`	With browser sign-in, request a session that cannot write
`--tenant`	`prod` or `dev`. Only for browser sign-in against a host outside `env0.com`.

See Sign-in and stored context.

status

env0 status

Always exits 0. Check .data.authenticated, not the exit code.

Field	Description
`host`	API host in use
`authenticated`	Whether the credentials work against the host
`keyId`	Masked API key id
`credentialSource`	`oauth`, `stored`, `environment`, `flag`, or `none`
`credentialStorage`	`keychain` or `file`
`credentialFile`	Path of the credentials file, when `credentialStorage` is `file`
`readOnly`	`true` for a read-only session
`organizationId`, `organization`	Stored organization id and name
`projectId`, `project`	Stored project id and name
`telemetry`, `tracing`	`on` or `off`
`note`	Present when the API is unreachable or stored files cannot be read

logout

env0 logout

Removes the current host’s credentials. Keeps the stored host, organization, and project. Other hosts stay signed in.

Agent skill

skill install

env0 skill install [--agent <agent>] [--global | --path <path>]

Writes a guide to the CLI into a coding agent’s configuration.

`--agent`	Project file
`claude` (default)	`.claude/skills/env0-cli/SKILL.md`
`cursor`	`.cursor/rules/env0-cli.mdc`
`codex`	`AGENTS.md`
`copilot`	`.github/copilot-instructions.md`

AGENTS.md and the Copilot file are edited only between managed markers, so the rest of the file is kept. Running install again is safe. --global installs in your home directory, for claude and codex. --path writes to a file or directory you choose.

skill show

env0 skill show

Prints the guide as Markdown, not JSON. Ignores -o.

skill uninstall

env0 skill uninstall [--agent <agent>] [--global | --path <path>]

Deletes the Claude Code or Cursor file, or removes the managed block from a shared file.

Other commands

Command	Description
`env0 version`	Print the CLI version
`env0 completion <shell>`	Print a shell completion script for `bash`, `zsh`, `fish`, or `powershell`

Telemetry

The CLI sends anonymous usage events and request traces: the command, output format, detected agent or CI system, authentication method, error type, exit code, CLI version, and organization id. Events use a random per-install id. They never include credentials, arguments, output, resource names or ids, or file paths. Telemetry never blocks or fails a command. To turn off both telemetry and tracing, set ENV0_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1. env0 status shows whether each is on.

Next steps

env zero CLI - Install the CLI, sign in, and run a first deployment.
Deploy workflows with the CLI - Deploy workflow sub-environments with per-sub-environment branches and variables.
CLI troubleshooting - Fix common errors and unexpected results.

​Global flags and environment variables

​Sign-in and stored context

​Output

​Pagination

​Exit codes

​context

​Organizations

​organization list

​organization get

​organization use

​Projects

​project list

​project get

​project create

​project archive

​project use

​Templates

​template list

​template get

​template create

​template assign

​template delete

​Environments

​environment list

​environment get

​environment create

​environment deploy

​environment destroy

​environment archive

​environment tag list

​environment tag set

​environment tag remove

​environment ttl set

​environment ttl extend

​environment ttl clear

​Waiting for a deployment

​Deployments

​deployment list

​deployment get

​deployment logs

​deployment approve

​deployment cancel

​deployment abort

​Plans

​plan list

​plan get

​Cost estimation

​Variables

​variable list

​VCS connections

​vcs list

​API keys

​api-key list

​api-key create

​api-key revoke

​personal-api-key list

​personal-api-key create

​personal-api-key revoke

​Sign-in commands

​login

​status

​logout

​Agent skill

​skill install

​skill show

​skill uninstall

​Other commands

​Telemetry

​Next steps