--- title: 'CLI commands' sidebarTitle: 'Commands' description: 'Every tamery command and its flags.' keywords: ['reference', 'options', 'arguments', 'usage', 'login', 'add', 'remove'] --- `tamery --help` (`-h`) lists the commands, and `--help` after a command, such as `tamery bridge --help`, shows its options and subcommands. `tamery --version` (`-v`) prints the version. ## tamery login ```bash tamery login ``` Opens the browser to sign this computer in to your Tamery account, and prints the link too. The link expires after 5 minutes. Confirm only if you started signing in yourself. After you confirm in the browser, the CLI saves the session encrypted with a key in the system keychain. If the keychain is locked, it may open its own unlock dialog, and the CLI waits until you answer it. If the computer is already signed in, it prints the account. To switch accounts, run `tamery logout` first. Signing in to a different account removes the secrets and paired browsers saved for the old one. ## tamery whoami ```bash tamery whoami ``` Prints the account this computer is signed in to, or says it isn't signed in and exits with code 1. ## tamery bridge ```bash tamery bridge ``` Lets the web app run your connections on this computer until you press **Ctrl+C**. If the computer isn't signed in yet, it signs in first, as `tamery login` does. [Tamery CLI](/cli/overview#run-the-bridge) walks through pairing. It prints the account, the address it listens on and a link to connect a browser. When a browser clicks **Connect**, it asks you whether to allow it. It also reports requests it refused because of a wrong host or origin. | Flag | Use | | --- | --- | | `--port ` | Listen on another port. The default is `26380`. | | `--public-url ` | The HTTPS address a tunnel or reverse proxy on this computer serves the bridge at. See [Reach a bridge on another computer](/cli/remote). | If the port is taken, usually by another bridge, it says so and exits. Stop the other one or pass `--port`. ## tamery bridge approve ```bash tamery bridge approve ``` Answers for a bridge that runs without a terminal to ask in, such as a service, a container or a detached session. When `tamery bridge` runs in a terminal you can see, the question appears there instead. 1. Keep the bridge running. 2. On the same computer, run `tamery bridge approve`. It waits for a browser. 3. In the web app, click **Connect** in **Settings → Bridge**. 4. Answer the question in the `approve` terminal. The order of steps 2 and 3 doesn't matter, as long as you answer within 2 minutes of clicking **Connect**. At most 3 requests wait at a time; more are declined. ## tamery bridge unpair-all ```bash tamery bridge unpair-all ``` Disconnects every paired browser, also from a bridge that is already running. Each one needs to be allowed again. Saved secrets stay. ## tamery connection list ```bash tamery connection list ``` Prints every connection in your workspaces with its id, name, engine and label, newest first. The other `tamery connection` commands take either the id or the name. When two connections share a name, pass the id. ## tamery connection create ```bash tamery connection create --name "Orders" --label prod ``` Asks for the connection string, tests it and saves the connection in your default workspace. The string is never a flag, so the password stays out of your shell history. To pass it from a script, pipe it in: ```bash echo "$DATABASE_URL" | tamery connection create --name "Orders" ``` | Flag | Use | | --- | --- | | `--name ` | The connection's name. Without it, the name is the host and the database the string names, such as `db.example.com:5432/orders`, or the file name for SQLite. | | `--label ` | The label it is grouped under, such as `prod` or `staging`. | | `--sync ` | What syncs to your other devices: **Full**, **No password** or **Metadata only**. The default is `full`. See [Security](/connections/security). | The engine comes from the string's scheme, such as `postgres://`, `mysql://` or `mongodb://`. The CLI keeps the whole string on this computer too, so `tamery bridge` runs the connection without asking for its secrets or file access. When the string opens a file or uses this computer's SSH keys or credentials, such as a SQLite or DuckDB file, a certificate file, an SSH tunnel or a MongoDB login with AWS, OIDC or Kerberos, the CLI asks you to allow that before it connects. A piped string can't be allowed, so add such a connection in a terminal. `tamery connection update --connection-string` asks the same way. ## tamery connection update ```bash tamery connection update Orders --name "Orders replica" --label staging ``` Changes a connection for everyone in its workspace. Pass at least one flag: | Flag | Use | | --- | --- | | `--name ` | Rename it. | | `--label ` | Change its label. `--label ""` removes it. | | `--connection-string` | Ask for a new connection string, or read it from stdin, and test it before saving. | ## tamery connection delete ```bash tamery connection delete Orders ``` Asks for confirmation, then deletes the connection for everyone in its workspace and forgets its secrets on this computer. Pass `--yes` to skip the question, which a script without a terminal has to do. Only editors of the workspace can delete its connections. ## tamery query ```bash tamery query Orders "SELECT status, count(*) FROM orders GROUP BY status" ``` Runs one statement on a connection, from this computer, and prints the rows. The connection is its id or name, as in `tamery connection list`. Write the statement in the connection's own SQL dialect, or as a mongosh call on MongoDB, such as `db.orders.find({ status: "paid" })`. Without the statement, it reads it from stdin: ```bash tamery query Orders < report.sql ``` By default only one read-only statement runs, such as `SELECT`, `SHOW`, `EXPLAIN`, or a MongoDB `find` or `aggregate`. PostgreSQL, MySQL, Oracle, ClickHouse, SQLite and MongoDB also run it in a read-only transaction, which is then rolled back. A function with side effects can still act, so only a read-only database login guarantees no writes. A DuckDB query reads only its own file, never other files or URLs. | Flag | Use | | --- | --- | | `--write` | Run statements that change data or schema. They commit right away. | | `--format ` | Print a table, JSON or CSV. JSON lists each result's `columns`, `rows` (one array per row, in column order), `affectedRows` and `truncated`. The default is `table`. | | `--max-rows ` | Stop after this many rows. The default is `1000`. When rows were left out, the table says so, JSON sets `truncated`, and CSV writes a note to stderr. | | `--database ` | Run in another database on the same server. | It finds the connection string the way `tamery bridge` does. For a **No password** or **Metadata only** connection that this computer doesn't have the secrets of yet, it asks for the connection string once and keeps it with the bridge's secrets. When a connection opens a file or signs in with this computer's keys or credentials, and nobody allowed that here yet, it asks you first. Without a terminal, such as in a script, it fails instead, so run the query once in a terminal. ## tamery update ```bash tamery update ``` Installs the latest version the way you installed the CLI: with the install script, npm, pnpm or Bun. It shows that tool's output, then asks you to restart `tamery bridge` if it is running. When you already have the latest version, it says so and installs nothing. On a release candidate, it also installs a newer release candidate. It ignores `TAMERY_VERSION`: to install a specific version, run the install script with it. If the update fails, for example because npm needs permissions you don't have, it says why. Fix that and run `tamery update` again. On Windows, a `tamery bridge` that is still running can hold the file the update replaces: stop it and try again. If you installed with the script but run `tamery` from another folder, the update goes to `~/.tamery/bin` and the command says so. Delete the other copy, or replace it with the new one. ## tamery logout ```bash tamery logout ``` Signs the CLI out of your account and deletes what it stored on this computer: the session, the saved secrets, their key in the keychain, and every pairing. The next `tamery bridge` signs in again, so this is also how you switch accounts.