@cryptoapis-io/cli

Command-line access to the Crypto APIs blockchain platform — 47 commands across 19 blockchains, plus a machine-readable manifest so AI agents can drive it without guessing.

npm i -g @cryptoapis-io/cli

Quick start

# 1. Generate a CLI token at https://app.cryptoapis.io/api-keys
#    ("Generate CLI token" — it is shown once), then store it:
cryptoapis auth token

# 2. Create an API key for the blockchain commands and start using it:
cryptoapis keys create "my-agent"
cryptoapis keys use <apiKeyId>

cryptoapis evm-address-latest get-balance \
  --blockchain ethereum --network mainnet \
  --address 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045

For AI agents

cryptoapis agent-prompt --json

Emits the complete command space — every command, its actions, its flags with types and accepted values, and its credit cost:

{
  "name": "evm-address-latest",
  "actions": ["get-balance", "get-next-nonce", "list-transactions"],
  "credits": { "get-balance": { "ethereum": 30, "base": 36 } },
  "flags": [
    { "name": "--blockchain", "type": "string", "required": true,
      "enum": ["ethereum", "binance-smart-chain", "polygon", "base"] }
  ],
  "example": "cryptoapis evm-address-latest get-balance --address <address> --blockchain ethereum --network mainnet --json"
}

Feeding this to a model before it writes commands removes the guesswork about flag names and accepted values.

Authentication

Two separate credentials, for two separate hosts:

Credential	Used for	Sourced from
API key	tool commands against rest.cryptoapis.io	--api-key → CRYPTOAPIS_API_KEY → config file
CLI token	keys and auth commands against the dashboard API	cryptoapis auth token → CRYPTOAPIS_TOKEN → config file

Credentials are stored in ~/.config/cryptoapis/config.json with 0600 permissions.

Signing in

The dashboard's login endpoint is protected by a reCAPTCHA, which is what keeps credential stuffing off the platform. Satisfying it from a terminal needs a browser step, so cryptoapis login is not yet wired up for production accounts — a browser-handoff sign-in (the CLI opens a page, you approve, the token comes back automatically) is on the roadmap. The command works today against non-production hosts.

In the meantime the CLI authenticates with a CLI token, generated in a browser session that has already passed reCAPTCHA and two-factor — the same credential the handoff flow will issue once it lands:

1. Open app.cryptoapis.io/api-keys and click Generate CLI token. It is displayed once — copy it before closing.
2. Run cryptoapis auth token and paste it (or pipe it in).

The token never expires. It is ended by revoking, not by waiting:

cryptoapis auth revoke        # kills every CLI token on the account

Revoking is account-wide — there is one counter per account, not per token — so it also invalidates tokens held by colleagues and CI jobs. It is deliberately callable with a CLI token, so a leaked credential can be killed from a script without reaching for a browser. Minting is not: a CLI token cannot mint another, which keeps the browser the only origin of credentials.

--api-key is accepted for convenience but appears in shell history and ps output; prefer the environment variable in anything automated. The CLI token and the password are never accepted as flags at all, for the same reason.

Commands

auth token            Store a CLI token minted in the dashboard
auth revoke           Revoke every CLI token for the account
login                 Password sign-in (non-production hosts for now)
logout                Clear the stored session
whoami                Show the account the stored credential belongs to
keys list             List your API keys
keys create <name>    Create a new API key
keys reveal <id>      Reveal a key's secret
keys use <id>         Reveal a key and save it for tool commands
list                  List every available command
agent-prompt --json   Machine-readable manifest
help                  Usage

Plus 47 blockchain commands — run cryptoapis list.

Conventions

• Result JSON on stdout, diagnostics on stderr — safe to pipe into jq
• Exit 0 success, 1 user or API error, 2 usage error
• camelCase schema fields become kebab-case flags: fromAddress → --from-address
• Arrays are comma-separated: --private-keys a,b

Signing is deliberately excluded

The signing tools (evm_sign, utxo_sign, svm_sign, tron_sign, xrp_sign, kaspa_sign) take private keys as input fields. Exposing them to argv would place keys in shell history, ps output and CI logs.

Sign locally instead with @cryptoapis-io/offline-signer, which keeps the key in your process:

prepare (this CLI)  →  sign (offline-signer)  →  broadcast (this CLI)

Environment variables

Variable	Purpose
CRYPTOAPIS_API_KEY	API key for tool commands
CRYPTOAPIS_TOKEN	CLI token for the dashboard commands
CRYPTOAPIS_TIMEOUT_MS	Request timeout (default 20000)
CRYPTOAPIS_DASHBOARD_URL	Override the dashboard API host

Verified

Both paths are exercised against live production, not just built against the backend's source.

Tool runner (rest.cryptoapis.io):

• EVM (ethereum, base) and UTXO (bitcoin) balance queries return real data
• Credit costs match what agent-prompt declares (ethereum 30, base 36)
• Invalid action/blockchain combinations are rejected before a request is spent
• API errors surface the upstream requestId for support
• stdout stays valid JSON even with --verbose

Dashboard commands (app.cryptoapis.io), with a real minted token:

• auth token stores the token at 0600; whoami identifies the account from the token's own claims
• keys list and keys reveal return real account data
• auth revoke revokes account-wide, clears the local token, and the revoked token is then refused
• a revoked token reports that it was revoked, rather than the server's literal not_in_required_state, which reads as though the account were misconfigured
• attempting to mint a CLI token with a CLI token is refused (403)
• cryptoapis login against production returns recaptcha_verification_failed, which is why the CLI-token flow above exists

License

MIT