Sign-in and permissions
A write command exits 3 with valid credentials
The key or user is missing the permission for that operation. A403 maps to exit 3 (auth), and error.message names the missing permission. Deploying needs deploy permission on the project. Creating projects and managing templates need organization-level permissions. All api-key commands, including list, need the Edit Organization Settings permission. Check the role behind the credential.
A get command exits 3 instead of 4
For ids outside your access, the API answers403 rather than 404. Treat exit 3 on a get as “missing or not permitted”.
login exits 3 in CI
Browser sign-in needs a terminal. SetENV0_API_KEY_ID and ENV0_API_KEY_SECRET instead. Other commands read them directly, so CI does not need login.
Commands exit 3 after changing —api-url
Credentials are stored per host. Runenv0 login against the new host, or pass an API key for it.
login exits 64 against a custom host
Browser sign-in cannot tell which env zero tenant serves the host. Pass--tenant prod, or sign in with an API key.
stderr shows “could not save credentials to the OS keychain”
The CLI stored your credentials in a plain-text file instead, readable only by your user. The warning names the file, andenv0 status shows it as credentialFile. env0 logout removes it.
A revoked key still works
A revoked key can keep authenticating for a short time. Treat a revoke as the first step in containing a leaked key, not an immediate cut-off.Create and deploy
environment create exits 2 with correct arguments
Organization plan and quota limits, such as a cap on environments, are reported asuser_input (exit 2). Read error.message instead of re-checking the flags.
”You have no access to that repository”
The VCS connection does not cover the repository:- The connection’s
accessScopeinenv0 vcs list, for exampleOrganization:acme, must match the repository’s owner. - For a GitHub App connection, the repository must be in the App’s selected repositories. Check this in GitHub.
The deployment came back QUEUED
Another deployment is running on the environment. Yours runs after it. Drop it withenv0 deployment cancel <deployment-id>.
The plan succeeds and the apply fails with a cloud 403
The cloud identity behind the deployment lacks an IAM permission, for examplestorage.buckets.create. A plan on a new environment often succeeds without cloud access because there is no state to read. Grant the role in your cloud provider, then run env0 environment deploy <environment-id> again.
The next command does not use the project you created
project create does not change your stored project. Pass --project <project-id>, or run env0 project use <project-id>.
Waiting and approvals
—wait exits 0 but nothing was applied
The deployment is atWAITING_FOR_USER, which counts as success for --wait. Approve it with env0 deployment approve <deployment-id>, or cancel it with env0 deployment cancel <deployment-id>. Passing --yes to destroy does not skip approval.
deployment approve exits 2 with “environment is not WAITING_FOR_USER”
The deployment already moved on. The error is harmless; do not retry.—wait exits 75
The wait hit--timeout, default 1h. The deployment may still be running. Run env0 deployment logs <deployment-id> --follow to keep watching, or raise --timeout.
Logs do not appear on stdout
With--wait, logs stream to stderr so stdout holds only the final deployment. Redirect with 2>&1, or stream on stdout with env0 deployment logs <deployment-id> --follow.
Lists and output
A list has exactly 100 rows
environment list, deployment list, and plan list stop at 100 rows by default. If .page.truncated is true, pass --all.
environment list —name returns nothing
--name matches the exact name, not a substring. Add --project so a same-named environment in another project is not picked.
Workflow sub-environments are missing from environment list
environment list does not include them. Run env0 context <workflow-environment-id> and read .data.subEnvironments.
plan get returns no resource changes
Check.data.planAvailable. When it is false, no plan was stored for that deployment, and the arrays are empty for that reason. Most deployments, including those waiting for approval, do not store a plan.
planSummary counts more resources than resourceChanges
planSummary counts expanded and internal items that resourceChanges does not list. Use resourceChanges or the deployment’s resourceCount.
costEstimation is null
Cost estimation is off for the organization, or the deployment produced no estimate. It is not an error.TTL and tags
—ttl or ttl set exits 2 with “Min lifespan is 1h”
The shortest lifespan env zero accepts is one hour, and a timestamp must be in the future.ttl set shortened the lifespan
ttl set counts a duration from now, not from the current end. To add time, run env0 environment ttl extend <environment-id> <duration>.
ttl extend exits 2
The environment has no TTL. Give it one withenv0 environment ttl set <environment-id> <duration>.
tag set removed a value
tag set replaces each named key’s whole value list. Pass every value you want to keep, for example team=eng team=payments. Run env0 environment tag list <environment-id> first to see the current values.
Workflows
Manifest and--node errors are covered in Deploy workflows with the CLI.
Next steps
- Command reference - Every CLI command and flag.
- Contact support - Get help from the env zero team.