> ## Documentation Index
> Fetch the complete documentation index at: https://docs.milkstraw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MilkStraw CLI

> Authentication, onboarding, and manage integration from the terminal.

The MilkStraw CLI (`@milkstraw/cli`) is a developer-friendly alternative to the web-based [Quickstart](/quickstart). Use it to start or maintain your MilkStraw integration without leaving your terminal.

<Note>
  **Prerequisites**

  * An active [MilkStraw AI](https://app.milkstraw.ai) account
  * The [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#getting-started-install-instructions) installed and configured
  * AWS credentials with access to your AWS Organization management account
</Note>

## Configure AWS credentials

Set up credentials using one of:

```bash theme={null}
aws configure      # Access key + secret
aws configure sso  # SSO login (recommended)
```

Verify your credentials are working:

```bash theme={null}
aws sts get-caller-identity
```

## Quick start

Run `setup` to authenticate, setup and deploy the MilkStraw cross role through CloudFormation stacks into your AWS organization:

```bash theme={null}
npx @milkstraw/cli setup
```

## Commands

| Command              | Description                                |
| -------------------- | ------------------------------------------ |
| `milkstraw login`    | Interactive browser login                  |
| `milkstraw logout`   | Revoke token and clear local auth          |
| `milkstraw setup`    | Complete onboarding and deploy stacks      |
| `milkstraw status`   | Check deployment status                    |
| `milkstraw update`   | Update deployed stacks to latest templates |
| `milkstraw org list` | List accessible organizations              |

## Global options

| Option                 | Description                               |
| ---------------------- | ----------------------------------------- |
| `--org <id>`           | Specify organization ID                   |
| `--aws-profile <name>` | Override the AWS named profile            |
| `--json`               | Output as JSON                            |
| `--quiet`              | Output data only                          |
| `--markdown`           | Output as Markdown                        |
| `--verbose`            | Enable verbose output                     |
| `--agent`              | Agent-safe mode (no prompts, no spinners) |

## Environment variables

| Variable                | Description              |
| ----------------------- | ------------------------ |
| `MILKSTRAW_ORG`         | Default organization ID  |
| `MILKSTRAW_AWS_PROFILE` | Default AWS profile name |

## AWS credential resolution

The CLI uses the AWS SDK for JavaScript v3 credential provider chain.

Without `--aws-profile`, credentials are resolved in this order:

1. Environment variables: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`
2. SSO token cache at `~/.aws/sso/cache`
3. Shared credentials file at `~/.aws/credentials` (default profile)
4. Shared config file at `~/.aws/config`
5. ECS container or EC2 instance metadata

With `--aws-profile <name>` (or `MILKSTRAW_AWS_PROFILE`), the SDK skips environment variables and uses the named profile from `~/.aws/config` and `~/.aws/credentials`.

## Authentication

Tokens are stored at `~/.config/milkstraw-cli/token`. Login uses the OAuth device code flow via your browser.

Run `milkstraw logout` at any time to revoke the token and clear local auth.