belvedir login --email you@example.com. The session is stored at ~/.config/belvedir/credentials.json (.config\belvedir\credentials.json under your profile folder on Windows; set XDG_CONFIG_HOME to relocate it) and refreshes automatically. belvedir logout revokes that session on the server and deletes the file. The CLI runs anywhere Node 18 or newer does and has no dependencies. On a headless machine, copy the approve URL the terminal prints into a browser on any device; the link expires after 10 minutes, so re-run belvedir login if it timed out.
Reading your data
--json for raw output ready to pipe into jq, and list reads take -n <count> (default 20, max 200).
Acting
Write commands check the same authorization as their dashboard equivalents (project visibility, key ownership, org owner/admin roles). Destructive commands require a literal--yes. Browser-side flows (buying credits, connecting GitHub) print a URL and open it; the flow finishes on the web.
Projects and keys
API keys are minted in the dashboard (the API Keys page), where the raw key is shown once; there is nobelvedir keys create.
Training
The flags are explained on Optimization loops (--design, --autonomy, signals) and LoRA finetuning (methods, bases, auto-training).
Benchmarks and environments
The harness contract, presets, and attempts/grading are on Benchmarks; environment presets and synthesis on Environments; Modal tokens and the managed workspace on Run with Harbor.Routing
Tiers, task-group assignments, and the auto router are explained on Model routing.Organization and billing
Roles and billing live under Organization Settings in the dashboard.Login
Using with coding agents
If an AI coding agent will runbelvedir, sign in with belvedir login --readonly: the session is marked server-side and every write command (approving proposals, launching runs, changing members or routing) is rejected at the platform, even if something bypasses the CLI and calls the API directly or pastes the token into a browser. belvedir logout is the one write a read-only session can make. Prefer a member account with project exclusions over the org owner’s account for agent machines. Never approve a sign-in link you did not initiate: the approve page shows a verification code that must match the one your terminal printed.
Sending traces is not the CLI’s job; that is the belvedir SDK.