Sign-in and premium actions
Sign in to the CLI to control hubs with your own permissions, including licensed hub features.
Many commands work without signing in. Sign in when you want to:
- Control hubs through Connect (
--cloud, or--computerfor another computer). - Run premium actions, such as DFU on every port or a target charge level, with your own permissions.
- List computers and organisations, or upload a support bundle as yourself.
Signing in
cambrionix-cli login
The CLI opens Connect in your browser. Sign in, choose the organisation and the access to give the
CLI, then approve. The CLI waits on a local address (127.0.0.1, ports 43480–43484) for Connect to
return you, then stores your sign-in for the active profile. Tokens refresh automatically, and
you stay signed in until you run cambrionix-cli logout or remove the CLI under your Connect
integrations.
Over SSH, forward the port the CLI prints, then open the link on your own computer:
ssh -L 43480:127.0.0.1:43480 build-07
For automation, set CAMBRIONIX_TOKEN to a Connect access token instead of signing in.
CLI sign-in uses the same OAuth integration as the MCP server, which must be enabled for your organisation. If sign-in reports that it isn't enabled, contact support@cambrionix.com.
cambrionix-cli whoami shows the organisation you're signed in to and which premium actions your
permissions allow. Sessions are per organisation: cambrionix-cli org use <id> signs in again so
you can choose another one.
Which credentials local commands use
The Hub API on a computer only accepts requests carrying a token that Connect issued for it. For each local request, the CLI requests a short-lived token limited to that request: read, write or admin access, plus one premium feature for one hub when needed.
--identity | Token comes from |
|---|---|
auto (default) | Your sign-in if you're signed in, otherwise this computer's enrollment |
user | Your sign-in only |
computer | This computer's enrollment only |
What a computer's enrollment allows depends on the roles of the groups its services belong to. Your sign-in always works within your own role.
Premium actions
Premium actions need two things: a role that grants the permission, and a hub licence (or a subscription that covers the hub) that includes the feature. If the licence is missing, the CLI exits with code 4 and says so.
| Command | Feature | Permission |
|---|---|---|
ports dfu <hub> <port|all> | Hub DFU | Organization.Hub.DFU.Write |
ports reboot-device <hub> <port|all> | Hub DFU | Organization.Hub.DFU.Write |
ports charge <hub> <percent> | Configure Target Charge Levels | Organization.Hub.Write |
ports power-limit <hub> <port|all> <watts> | Power Profile Management | Organization.Hub.PowerDelivery.Write |
hubs power show|save|revert <hub> | Power Profile Management | Organization.Hub.PowerDelivery.Write |
ports schedule set|clear … | Schedule Port Mode Change | Organization.Hub.Schedule.Write |
Power delivery and DFU also depend on the hub model.
cambrionix-cli ports dfu HUB-1234 all --yes # every Apple device on the hub into DFU
cambrionix-cli ports charge HUB-1234 80 --then off # charge every port to 80%, then switch off
cambrionix-cli ports power-limit HUB-1234 3 15 # limit port 3 to 15 W
Through Connect
Add --cloud to run a hub command through Connect instead of the local Hub API. It works from any
computer, as long as the hub's own computer is online. Commands about a computer's services, such as
devices list or usb endpoints, need --computer <id or name>.
cambrionix-cli ports mode HUB-1234 all charge --cloud
cambrionix-cli devices list --computer build-07
Hub firmware updates always go through Connect, which picks the latest firmware for the hub:
cambrionix-cli hubs firmware update HUB-1234 --yes