> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# env zero CLI command reference

> Every env zero CLI command and flag, with authentication and stored context, the JSON output envelope, pagination, exit codes, and telemetry.

This page covers env zero CLI version 2.6.0. Run `env0 <command> --help` to print the flags of the version you have installed. To install the CLI and run a first deployment, see [env zero CLI](/guides/community-and-resources/support-and-help/env-zero-cli).

## Global flags and environment variables

Every command accepts these flags:

| Flag | Environment variable | Default | Description |
| :- | :- | :- | :- |
| `--api-key-id` | `ENV0_API_KEY_ID` | none | API key id |
| `--api-key-secret` | `ENV0_API_KEY_SECRET` | none | API key secret |
| `--api-url` | `ENV0_API_URL` | `https://api.env0.com` | env zero API host |
| `-o`, `--output` | none | `json` | Output format: `json`, `compact`, or `table` |

The CLI also reads these environment variables:

| Variable | Description |
| :- | :- |
| `ENV0_ORGANIZATION_ID` | Organization for commands that take `--organization` |
| `ENV0_PROJECT_ID` | Project for commands that take `--project` |
| `ENV0_CONFIG_HOME` | Directory for stored context. The CLI writes to an `env0` folder inside it. Defaults to your OS user config directory. |
| `ENV0_TELEMETRY_DISABLED`, `DO_NOT_TRACK` | Turn off [telemetry](#telemetry) |
| `ENV0_CLIENT` | Tag that telemetry reports instead of `cli`. Set it when you embed the CLI in another tool. |

Each value resolves in this order: flag, then environment variable, then stored context, then default. In CI and agents, set the environment variables so each run is explicit and does not depend on stored state.

## Sign-in and stored context

`env0 login` stores credentials and a default host, organization, and project, so later commands need no flags.

* **Browser sign-in.** With no API key set and a terminal attached, `login` opens a browser sign-in and asks you to confirm a short code. `--no-browser` prints the URL instead.
* **API key.** When `--api-key-id` and `--api-key-secret` (or `ENV0_API_KEY_ID` and `ENV0_API_KEY_SECRET`) are set, `login` validates and stores that key.
* **No key and no terminal.** `login` exits `3`. CI and agents should set the API key environment variables and skip `login`.

On a terminal, `login` then asks you to pick an organization and project. Without a terminal, it stores the `--organization` and `--project` you pass.

Credentials are stored in the OS keychain. If the keychain write fails, the CLI writes them to a plain-text file readable only by your user, prints a `warning:` line on stderr naming the file, and still exits `0`. `env0 logout` removes that file.

Credentials are scoped to the API host they were issued for. Signing in to a second host does not sign you out of the first, and a host you have not signed in to exits `3` even when another host is authenticated. The host, organization, and project are stored once, in `config.json`, so switching hosts means running `login` again.

Browser sign-in works out which env zero tenant to use from the API host. For a host outside `env0.com`, it exits `64` unless you pass `--tenant`. API keys work against any host.

## Output

Every command prints one JSON envelope, except `env0 skill show` (raw Markdown) and `env0 deployment logs --follow` (a [log stream](#deployment-logs)). Data goes to stdout and errors go to stderr:

```json theme={null}
{ "apiVersion": "0.1", "data": { } }
```

```json theme={null}
{ "apiVersion": "0.1", "error": { "type": "not_found", "message": "...", "hint": "...", "host": "https://api.env0.com" } }
```

* `-o json` prints indented JSON. `-o compact` prints the same JSON on one line, for `jq`. `-o table` prints aligned columns.
* On error, stdout is empty and the exit code is non-zero, so `env0 ... -o compact | jq .data` is safe.
* Arrays are always arrays. An empty result is `[]`, never `null` or a missing key.
* `error.host` names the host the CLI was pointed at. It is absent for `usage` errors and for failures before a host is chosen. Credentials and paths are removed from it.

### Pagination

`environment list`, `deployment list`, and `plan list` return at most 100 rows by default and add a `page` object next to `data`:

```json theme={null}
{ "apiVersion": "0.1", "data": [ ], "page": { "truncated": true, "nextOffset": 100 } }
```

`"truncated": true` means more rows exist. Pass `--all` to fetch every page. `--limit` accepts 1 to 100.

`organization list`, `project list`, and `template list` are not paginated. They return the whole collection and take no `--limit` or `--all`.

## Exit codes

| Code | `error.type` | Meaning |
| :- | :- | :- |
| `0` | none | Success |
| `1` | `unknown` | Unexpected error, or a `--wait` or `--follow` deployment that ended in a failed state |
| `2` | `user_input`, `conflict` | The backend rejected well-formed input, or the resource is in a conflicting state |
| `3` | `auth` | Missing credentials, or no permission for the operation or resource |
| `4` | `not_found` | The resource does not exist |
| `64` | `usage` | Wrong invocation: unknown command or flag, missing or conflicting arguments, `--limit` outside 1 to 100, or an unplaceable sign-in host |
| `75` | `transient` | Retry later. Also returned when `--wait` hits its `--timeout` before the deployment finishes. |

With `--wait` or `deployment logs --follow`, the exit code reflects the deployment's final status:

| Final status | Exit code |
| :- | :- |
| `SUCCESS`, `SKIPPED`, `WAITING_FOR_USER` | `0` |
| `FAILURE`, `INTERNAL_FAILURE`, `TIMEOUT`, `CANCELLED`, `ABORTED` | `1` |

The deployment is printed to stdout in both cases, including `failedCommand` and `errorMessage` when it failed. `WAITING_FOR_USER` means the deployment needs approval, not that it failed.

## context

```bash theme={null}
env0 context <environment-id> [--deployments <n>]
```

Returns an environment's state, recent deployments, and a failure summary in one call. Read `.data.summary` first, then `.data.deployments`, then [`deployment logs`](#deployment-logs) for the full error.

| Flag | Default | Description |
| :- | :- | :- |
| `--deployments` | `5` | Number of recent deployments to include, 1 to 100 |

The output has these keys:

* `environment`: the same object `environment get` returns.
* `deployments`: recent deployments, newest first.
* `summary`: drift status and the latest deployment's status and type. When that deployment failed (`FAILURE`, `INTERNAL_FAILURE`, or `TIMEOUT`), it also carries `failedCommand`, a truncated `errorMessage`, and `exitCode`. It carries `costEstimation` when the environment has one.
* `subEnvironments`: for a workflow environment, each sub-environment's alias, plus the revision and status of its latest deployment.

## Organizations

### organization list

```bash theme={null}
env0 organization list
```

Lists every organization you can access. `org` is an alias for `organization`.

### organization get

```bash theme={null}
env0 organization get <organization-id>
```

### organization use

```bash theme={null}
env0 organization use [<organization-id>]
```

Stores a default organization for later commands. Without an id on a terminal, it shows a picker.

## Projects

### project list

```bash theme={null}
env0 project list [--organization <organization-id>]
```

Lists every project in the organization.

### project get

```bash theme={null}
env0 project get <project-id>
```

### project create

```bash theme={null}
env0 project create --name <name> [--organization <organization-id>] [flags]
```

| Flag | Description |
| :- | :- |
| `--name` | Project name. Required. |
| `--organization` | Organization to create the project in |
| `--description` | Project description |
| `--parent` | Parent project id, to nest the new project under it |
| `--tag` | Project tag. Repeatable. |

The new project does not become your stored project. Pass its id (`.data.id`) as `--project` to later commands, or run `env0 project use <project-id>`. Requires permission to create projects in the organization.

### project archive

```bash theme={null}
env0 project archive <project-id>
```

Archives the project. `project get` and `project list` still return it with `isArchived: true`. The CLI cannot unarchive a project, and [archiving a project cannot be undone](/guides/admin-guide/projects#archive-a-project).

### project use

```bash theme={null}
env0 project use [<project-id>]
```

Stores a default project, and its organization, for later commands. Without an id on a terminal, it shows a picker of the stored organization's projects.

## Templates

### template list

```bash theme={null}
env0 template list (--organization <organization-id> | --project <project-id>)
```

Lists templates in exactly one scope. Passing both flags, or neither with no stored context, exits `64`.

### template get

```bash theme={null}
env0 template get <template-id>
```

### template create

```bash theme={null}
env0 template create --name <name> --repository <url> --type <type> [flags]
```

| Flag | Description |
| :- | :- |
| `--name` | Template name. Required. |
| `--repository` | Git repository URL. Required. A trailing `.git` is removed. |
| `--type` | IaC type, for example `terraform`, `opentofu`, `terragrunt`, or `workflow`. Required. |
| `--organization` | Organization to create the template in. Required unless stored. |
| `--project` | Project to assign the new template to. Defaults to the stored project. |
| `--path` | Path to the IaC code in the repository |
| `--revision` | Default branch or tag |
| `--iac-version` | IaC tool version. Terraform defaults to `RESOLVE_FROM_TERRAFORM_CODE`, OpenTofu to `latest`. |
| `--vcs-connection-id` | [VCS connection](#vcs-list) for a private repository |
| `--github-installation-id` | GitHub App installation id for a private repository |
| `--token-id` | VCS token id for a private repository |
| `--gitlab` | The repository is hosted on GitLab |

Requires permission to manage templates in the organization.

### template assign

```bash theme={null}
env0 template assign <template-id> --project <project-id>
```

Assigns a template to a project. `environment create --template` only deploys templates assigned to the target project.

### template delete

```bash theme={null}
env0 template delete <template-id>
```

Removes the template from `template list`. `template get` can still return the record.

## Environments

`env` is an alias for `environment`. Actions take an environment id, not a name.

### environment list

```bash theme={null}
env0 environment list [flags]
```

| Flag | Description |
| :- | :- |
| `--project` | Filter by project |
| `--organization` | Filter by organization |
| `--name` | Filter by exact name. Not a substring match. |
| `--tag` | Filter by `KEY` or `KEY=VALUE`. Repeatable. An environment must match every tag. |
| `--limit` | Maximum rows, 1 to 100 |
| `--all` | Fetch every page |

All filters are optional and combine. The list does not include workflow sub-environments. To see them, run [`context`](#context) on the workflow environment.

### environment get

```bash theme={null}
env0 environment get <environment-id>
```

The output always includes `tags`, as `{}` when the environment has none.

### environment create

```bash theme={null}
env0 environment create --name <name> --project <project-id> (--template <template-id> | --repository <url>) [flags]
```

Creates an environment and starts its first deployment. The output is that deployment. With `--wait`, its `environmentId` is the new environment's id.

| Flag | Description |
| :- | :- |
| `--name` | Environment name. Required. |
| `--project` | Project to create the environment in. Required unless stored. |
| `--template` | Template to deploy. Use this or `--repository`. |
| `--repository` | Git repository to deploy without a template. A trailing `.git` is removed. Requires `--type` and `--organization`. |
| `--type` | IaC type for `--repository`, for example `terraform`, `opentofu`, `terragrunt`, or `workflow` |
| `--organization` | Organization. Required with `--repository`. |
| `--path` | Path to the IaC code in the repository, with `--repository` |
| `--revision` | Branch or tag to deploy |
| `--iac-version` | IaC tool version, with `--repository`. Terraform defaults to `RESOLVE_FROM_TERRAFORM_CODE`, OpenTofu to `latest`. |
| `--vcs-connection-id` | [VCS connection](#vcs-list) for a private repository |
| `--github-installation-id` | GitHub App installation id for a private repository |
| `--token-id` | VCS token id for a private repository |
| `--gitlab` | The repository is hosted on GitLab |
| `--workspace-name` | Terraform workspace name. Set once at creation and cannot be changed. |
| `--var` | Environment variable as `KEY=VALUE`. Repeatable. |
| `--secret` | Sensitive environment variable as `KEY=VALUE`. Repeatable. |
| `--tf-var` | Terraform variable as `KEY=VALUE`. Repeatable. |
| `--requires-approval` | Require approval before each deployment, including the first |
| `--ttl` | Lifespan as a duration (`2h`) or RFC 3339 timestamp, after which env zero destroys the environment. The minimum is `1h`. See [environment ttl](#environment-ttl-set). |
| `--tag` | Tag as `KEY=VALUE`. Repeatable. Repeat a key to give it several values. |
| `--comment` | Deployment comment |
| `-f`, `--manifest` | Workflow manifest file, with `--template`. See [Deploy workflows with the CLI](/guides/community-and-resources/support-and-help/env-zero-cli/workflows). |
| `--wait` | Wait for the deployment to finish. See [Waiting for a deployment](#waiting-for-a-deployment). |
| `--quiet` | With `--wait`, do not stream logs to stderr |
| `--poll-interval` | How often `--wait` polls. Default `5s`. |
| `--timeout` | How long `--wait` waits. Default `1h`. |

A `--repository` environment gets a single-use template that needs no cleanup. When no [cloud credential](/guides/getting-started/connect-your-cloud-account) is assigned to the project, pass provider credentials as `--secret`, for example `--secret AWS_ACCESS_KEY_ID=...`. An assigned credential keeps keys out of your shell history and process list.

### environment deploy

```bash theme={null}
env0 environment deploy <environment-id> [flags]
```

Starts a deployment and prints it. A deployment started while another is running is queued, not rejected.

| Flag | Description |
| :- | :- |
| `--revision` | Branch or tag to deploy |
| `--target` | Resource target. Repeatable. |
| `--var`, `--secret`, `--tf-var` | Variables, as on `environment create`. Repeatable. |
| `--requires-approval` | Require approval for this deployment. `--requires-approval=false` skips it. Omit to keep the environment's setting. |
| `--comment` | Deployment comment |
| `-f`, `--manifest` | Workflow manifest file |
| `--node` | Deploy only this workflow sub-environment, by alias |
| `--run-from-here` | With `--node`, also deploy every sub-environment downstream of it |
| `--wait`, `--quiet`, `--poll-interval`, `--timeout` | As on `environment create` |
| `--pretty` | Print a readable summary and step headings instead of JSON. Cannot be combined with `-o`. |

`--manifest`, `--node`, and `--run-from-here` are covered in [Deploy workflows with the CLI](/guides/community-and-resources/support-and-help/env-zero-cli/workflows).

### environment destroy

```bash theme={null}
env0 environment destroy <environment-id> --yes [flags]
```

Destroys the environment's resources. This cannot be undone, so it requires `--yes` (or `--force`) and has no prompt. On an environment that requires approval, the destroy waits at `WAITING_FOR_USER` like any deployment.

| Flag | Description |
| :- | :- |
| `--yes`, `--force` | Confirm the destroy. Required. |
| `--skip-state-refresh` | Skip the state refresh during the destroy plan |
| `--checkout-updated-code` | Check out the latest revision before destroying |
| `--requires-approval` | Require approval for this destroy. `--requires-approval=false` skips it. |
| `--comment` | Destroy comment |
| `--node` | Destroy only this workflow sub-environment, by alias |
| `--wait`, `--quiet`, `--poll-interval`, `--timeout`, `--pretty` | As on `environment deploy` |

### environment archive

```bash theme={null}
env0 environment archive <environment-id>
```

Marks the environment inactive without running a deployment, so its cloud resources stay. Run `destroy` first to remove them. See [mark an environment as inactive](/guides/admin-guide/environments#mark-an-environment-as-inactive).

### environment tag list

```bash theme={null}
env0 environment tag list [<environment-id>] [--organization <organization-id>]
```

With an id, prints that environment's tags, for example `{"team": ["eng", "payments"]}`. Without one, prints every tag key and value used in the organization. `tags` is an alias for `tag`.

### environment tag set

```bash theme={null}
env0 environment tag set <environment-id> KEY=VALUE [KEY=VALUE...]
```

Replaces the whole value list of each key you name and leaves other keys alone. To keep an existing value, pass it again: `team=eng team=payments`. Prints the updated environment.

### environment tag remove

```bash theme={null}
env0 environment tag remove <environment-id> KEY [KEY...]
```

Removes each key with all of its values. Passing `KEY=VALUE` exits `64`.

Tag limits and permissions are listed in [Environment tags](/guides/admin-guide/environments/tags#limits). Tags are visible to anyone who can view the environment, so do not put secrets in them.

### environment ttl set

```bash theme={null}
env0 environment ttl set <environment-id> <duration|timestamp>
```

Replaces the environment's lifespan. A duration counts from now, not from the current end, so `ttl set <environment-id> 2h` can bring the end forward. The minimum is `1h`. Read the new end from `lifespanEndAt` in the output: env zero truncates it to the minute.

### environment ttl extend

```bash theme={null}
env0 environment ttl extend <environment-id> <duration>
```

Adds the duration to the current end, or to now if the end has passed. On an environment with no TTL, exits `2`. `extend` reads the current end and then writes a new one, so a TTL change someone makes in between is overwritten.

### environment ttl clear

```bash theme={null}
env0 environment ttl clear <environment-id>
```

Removes the TTL, so env zero never destroys the environment automatically. `lifespanEndAt` disappears from the output. For default and maximum TTLs, see [Configure policy TTL](/guides/policies-governance/policy-ttl).

### Waiting for a deployment

`--wait` polls the deployment until it reaches a final status, then exits with the [code for that status](#exit-codes). It retries `5xx` and `429` responses. A deployment that reaches `WAITING_FOR_USER` stops the wait with exit `0`. Approve it with [`deployment approve`](#deployment-approve).

While it waits, the deployment's step logs stream to stderr. Stdout still receives only the final deployment, so `--wait -o compact | jq` works. Logs keep their color on a terminal and lose it when redirected. Secrets are redacted before the logs reach the CLI.

## Deployments

### deployment list

```bash theme={null}
env0 deployment list --environment <environment-id> [--limit <n>] [--all]
```

Lists deployments, newest first. Paginated, see [Pagination](#pagination).

### deployment get

```bash theme={null}
env0 deployment get <deployment-id>
```

Includes a truncated `errorMessage`, `failedCommand`, and `exitCode` for a failed deployment.

### deployment logs

```bash theme={null}
env0 deployment logs <deployment-id> [--follow] [--poll-interval <duration>]
```

Without `--follow`, prints the deployment's captured `output` and full `errorMessage`, with color codes removed. Use it for the root cause of a failure.

With `--follow` (`-f`), streams the logs to stdout until the deployment finishes, then exits like `--wait`. The stream is text grouped by step. With `-o json` or `-o compact` it is newline-delimited JSON, one `{"step", "level", "message", "timestamp"}` object per line, with no envelope. `--poll-interval` defaults to `3s`.

### deployment approve

```bash theme={null}
env0 deployment approve <deployment-id>
```

Resumes a deployment at `WAITING_FOR_USER`. The status changes a few seconds later. Approving a deployment that has already moved on exits `2` and is harmless. Approval rights do not approve your own deployments automatically.

### deployment cancel

```bash theme={null}
env0 deployment cancel <deployment-id>
```

Cancels a `QUEUED` deployment, or rejects one at `WAITING_FOR_USER`.

### deployment abort

```bash theme={null}
env0 deployment abort <deployment-id>
```

Aborts an `IN_PROGRESS` deployment.

`approve`, `cancel`, and `abort` return right away and take no `--wait`. To follow a resumed deployment, poll `deployment get` until its status leaves `WAITING_FOR_USER`, then run `deployment logs <deployment-id> --follow`.

## Plans

### plan list

```bash theme={null}
env0 plan list --environment <environment-id> [--limit <n>] [--all]
```

Lists plan summaries across an environment's deployments. Paginated, see [Pagination](#pagination).

### plan get

```bash theme={null}
env0 plan get <deployment-id>
```

Returns the plan stored with a deployment. Check `planAvailable` first: most deployments, including those at `WAITING_FOR_USER`, store no plan. With no plan, `resourceChanges` and `outputChanges` are `[]`, the same as a plan with no changes.

* `resourceChanges[].action` shows `delete` and `recreate` only when a plan is stored.
* The deployment's `planSummary` counts can be higher than the entries in `resourceChanges`. Use `resourceChanges` for the actual resources.
* To see what drifted, run `plan get` on the latest deployment with `type` `driftDetection`. See [Drift detection](/guides/admin-guide/environments/drift-detection).

### Cost estimation

`environment get`, `context` (under `summary`), `plan get`, and `deployment get` include `costEstimation`: `totalMonthlyCost` and the deployment's `monthlyCostDiff`, as numbers with no currency. The `table` output assumes USD. The field is `null` when [cost estimation](/guides/policies-governance/cost-estimation) is off for the organization or the deployment produced no estimate.

## Variables

### variable list

```bash theme={null}
env0 variable list [--environment <environment-id>] [flags]
```

Lists the variables configured on a scope, with sensitive values masked. `var` is an alias for `variable`.

| Flag | Description |
| :- | :- |
| `--environment` | Environment whose variables to list. Its organization and project are used for the other scopes. |
| `--project` | Project scope |
| `--blueprint` | Template scope |
| `--organization` | Organization scope. Required unless set by `--environment` or stored. |

## VCS connections

### vcs list

```bash theme={null}
env0 vcs list [--organization <organization-id>] [--type <type>]
```

Lists the organization's VCS connections. Pass a connection's `id` as `--vcs-connection-id` to `template create` or `environment create` for a private repository. Its `accessScope`, for example `Organization:acme`, must cover the repository's owner. `--type` filters by provider, for example `GitHub` or `GitLab`.

## API keys

The CLI manages two kinds of [API key](/guides/admin-guide/user-role-and-team-management/api-keys):

| | `env0 api-key` | `env0 personal-api-key` |
| :- | :- | :- |
| Acts as | The organization | You |
| Permissions | The `--role` you grant | Yours |
| Requires organization settings permission | Yes, for `list`, `create`, and `revoke` | No |
| Keeps working after you leave | Yes | No |

Use an organization key for shared CI. Use a personal key on your own machine, or when actions must be attributed to you.

Both `create` commands print `apiKeySecret` once. No command returns it again. The returned `apiKeyId` and `apiKeySecret` are the values for `ENV0_API_KEY_ID` and `ENV0_API_KEY_SECRET`. Keys do not expire.

### api-key list

```bash theme={null}
env0 api-key list [--organization <organization-id>]
```

Lists the organization's keys without secrets, including `lastUsedAt`. Custom roles show as their id.

### api-key create

```bash theme={null}
env0 api-key create --name <name> --role <role> --yes [flags]
```

| Flag | Description |
| :- | :- |
| `--name` | Key name. Names are not unique. Required. |
| `--role` | Organization role: `Admin`, `User`, or a custom role id. Required, because env zero grants Admin when the role is omitted. |
| `--yes` | Confirm creating a long-lived credential. Required. |
| `--organization` | Organization to create the key in |
| `--project-role` | Project role as `PROJECT_ID=ROLE`, where `ROLE` is `Admin`, `Deployer`, `Planner`, `Viewer`, or a custom role id. Repeatable. |
| `--read-only` | Limit the key to read-only access |

No command shows a key's project roles after creation.

### api-key revoke

```bash theme={null}
env0 api-key revoke "<id>" --yes
```

Takes the `id` field from `api-key list`, which looks like `auth0|abc123`, not the `apiKeyId` field. Quote it, because `|` is a shell pipe. Revoking cannot be undone. The key leaves the list at once but can keep authenticating for a short time afterwards. `--force` is an alias for `--yes`.

### personal-api-key list

```bash theme={null}
env0 personal-api-key list
```

### personal-api-key create

```bash theme={null}
env0 personal-api-key create --name <name> --yes
```

Creates a key with your permissions. It stops working when your user account does.

### personal-api-key revoke

```bash theme={null}
env0 personal-api-key revoke "<id>" --yes
```

Takes the `id` field, not `apiKeyId`. Another user's key id exits `4`.

## Sign-in commands

### login

```bash theme={null}
env0 login [flags]
```

| Flag | Description |
| :- | :- |
| `--organization` | Organization to store when there is no terminal |
| `--project` | Project to store when there is no terminal |
| `--no-browser` | Print the sign-in URL instead of opening a browser |
| `--read-only` | With browser sign-in, request a session that cannot write |
| `--tenant` | `prod` or `dev`. Only for browser sign-in against a host outside `env0.com`. |

See [Sign-in and stored context](#sign-in-and-stored-context).

### status

```bash theme={null}
env0 status
```

Always exits `0`. Check `.data.authenticated`, not the exit code.

| Field | Description |
| :- | :- |
| `host` | API host in use |
| `authenticated` | Whether the credentials work against the host |
| `keyId` | Masked API key id |
| `credentialSource` | `oauth`, `stored`, `environment`, `flag`, or `none` |
| `credentialStorage` | `keychain` or `file` |
| `credentialFile` | Path of the credentials file, when `credentialStorage` is `file` |
| `readOnly` | `true` for a read-only session |
| `organizationId`, `organization` | Stored organization id and name |
| `projectId`, `project` | Stored project id and name |
| `telemetry`, `tracing` | `on` or `off` |
| `note` | Present when the API is unreachable or stored files cannot be read |

### logout

```bash theme={null}
env0 logout
```

Removes the current host's credentials. Keeps the stored host, organization, and project. Other hosts stay signed in.

## Agent skill

### skill install

```bash theme={null}
env0 skill install [--agent <agent>] [--global | --path <path>]
```

Writes a guide to the CLI into a coding agent's configuration.

| `--agent` | Project file |
| :- | :- |
| `claude` (default) | `.claude/skills/env0-cli/SKILL.md` |
| `cursor` | `.cursor/rules/env0-cli.mdc` |
| `codex` | `AGENTS.md` |
| `copilot` | `.github/copilot-instructions.md` |

`AGENTS.md` and the Copilot file are edited only between managed markers, so the rest of the file is kept. Running `install` again is safe. `--global` installs in your home directory, for `claude` and `codex`. `--path` writes to a file or directory you choose.

### skill show

```bash theme={null}
env0 skill show
```

Prints the guide as Markdown, not JSON. Ignores `-o`.

### skill uninstall

```bash theme={null}
env0 skill uninstall [--agent <agent>] [--global | --path <path>]
```

Deletes the Claude Code or Cursor file, or removes the managed block from a shared file.

## Other commands

| Command | Description |
| :- | :- |
| `env0 version` | Print the CLI version |
| `env0 completion <shell>` | Print a shell completion script for `bash`, `zsh`, `fish`, or `powershell` |

## Telemetry

The CLI sends anonymous usage events and request traces: the command, output format, detected agent or CI system, authentication method, error type, exit code, CLI version, and organization id. Events use a random per-install id. They never include credentials, arguments, output, resource names or ids, or file paths. Telemetry never blocks or fails a command.

To turn off both telemetry and tracing, set `ENV0_TELEMETRY_DISABLED=1` or `DO_NOT_TRACK=1`. `env0 status` shows whether each is on.

## Next steps

* [env zero CLI](/guides/community-and-resources/support-and-help/env-zero-cli) - Install the CLI, sign in, and run a first deployment.
* [Deploy workflows with the CLI](/guides/community-and-resources/support-and-help/env-zero-cli/workflows) - Deploy workflow sub-environments with per-sub-environment branches and variables.
* [CLI troubleshooting](/guides/community-and-resources/support-and-help/env-zero-cli/troubleshooting) - Fix common errors and unexpected results.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.