Commands

Command	What it does
login	Sign in, by browser approval or with a token
logout	Revoke this machine’s credential
whoami	Who you are signed in as, and which organization
list	The apps you can see
validate	Check a repository without creating anything
register	Add an app from a repository
env set	Set a variable or a secret
target add	Allow the page to call an origin
share	Change who can open it
cache clear	Clear cached API responses so the next load fetches fresh

Every command accepts --host URL to choose the instance, and --json or --no-json to choose the output. See Automation.

login

sbd login [--host URL] [--name NAME] [--no-browser]
sbd login --token TOKEN
sbd login --token -

Browser approval by default. --name labels the credential in your settings, which is worth setting when you sign in from more than one machine. --no-browser prints the URL instead of opening it. --token - reads a token from standard input.

logout

sbd logout [--all]

Revokes this machine’s credential. --all revokes every credential on your account, which is what to reach for if you think one has leaked.

whoami

sbd whoami

The account and the organization the credential writes to. Exits 2 if you are not signed in or the credential has been revoked.

list

sbd list [--query TEXT]

The apps you can see, filtered by --query.

validate

sbd validate --repo URL [--branch B] [--entry PATH]

Reads the repository the way Stackboard will and reports what it found, without creating anything. It answers field by field, so a wrong branch is reported as a wrong branch rather than as an unreadable repository.

register

sbd register --repo URL --name NAME [options]

Option
--branch B	Branch to follow. Defaults to the repository’s own default
--entry PATH	The document to serve. Defaults to index.html
--description TEXT	Shown in the catalog
--visibility MODE	private (Specific users), org (Internal, the default), or public (External). See Sharing
--owner user:ID or --owner group:ID	Who manages it. Defaults to you
--tag TAG	Repeatable, for catalog search
--env KEY=VALUE	A public variable, repeatable
--secret KEY=@ENV_VAR	A secret, read from your environment. Repeatable
--target NAME=ORIGIN	An origin the page may call, repeatable
--target-env NAME=KEY	Which secret that target attaches
--target-in NAME=header|query	Where the credential goes
--target-browser NAME	Call it from the viewer’s browser rather than through Stackboard
--latest or --pin COMMIT	Follow the branch, or pin a commit
--publish	Publish it to the catalog, or ask an admin to if your organization requires approval
--allow-duplicate	Register a repository that is already registered
--from-file FILE or -	Read all of the above from a file, or standard input

Registering does several things in order: it adds the app, publishes it if --publish was given, then adds its variables, targets and shares. If a later step is refused, the app still exists. See exit code 6.

env set

sbd env set APP --key KEY [--value V | --secret-from ENV_VAR]
                       [--public] [--description TEXT]

--secret-from names an environment variable to read the value from, which is how a secret is set without putting it on the command line. --public makes it a plain variable that is substituted into the page instead.

Danger

Never pass a secret with --value. Anything on a command line is visible in the process list, in your shell history, and in the transcript of whichever agent typed it. Use --secret-from and pass the value through the environment.

target add

sbd target add APP --name NAME --origin URL [--env-key KEY]
                          [--in header|query] [--header NAME]
                          [--prefix TEXT] [--browser]

Adds an origin the page may call. --env-key names the secret to attach, --header and --in say where it goes, and --prefix covers schemes like Bearer . --browser makes the viewer’s browser call the host directly rather than routing through Stackboard, which is how you reach a host that exists only on your own network. See How an app reaches a host.

share

sbd share APP [--visibility MODE] [--with user:ID|group:ID]

Changes who can open it. --visibility takes the same three modes register does, and --with adds a person or a group to the list.

cache clear

sbd cache clear APP [--target NAME]

Clears the cached responses for one target, or for every target on the app when --target is left out. The next time someone opens the app, it fetches fresh data and caches it again. Nothing is fetched by the command itself.

Only an app’s owners can clear its cache. A target name the app doesn’t have exits 4. To run this on a schedule, see Refreshing cached data.