Skip to main content
The CLI ships as @theplato/tiro-cli on npm and runs on Node.js 20+. macOS, Linux, and Windows.

​
1. Install

Verify the install:
System requirements: Node.js 20 or later. The shipped binary is ESM-only; Node 18 will error on import.

​
2. Sign in

This starts an OAuth Authorization Code + PKCE sign-in in your default browser. The CLI opens a one-shot local server on http://127.0.0.1:<random-port>/callback to receive the redirect. After you sign in, the JWT is kept in your operating system’s credential store.
  • macOS — Keychain
  • Linux — Secret Service (requires gnome-keyring or kwallet)
  • Windows — Credential Manager
Confirm:
Only the start of the token is shown. The full bearer token never leaves the keychain.
The CLI acts as the signed-in user. Its reach is therefore the same as the notes you see in the app, including notes in your own private folders. A system API key is different: it reads only notes in folders shared with all members (What notes a system API key reads). If your automation has to work with notes in private folders, use the CLI or an account API key.

​
3. Sign out

Clears the keychain entry. Your next tiro auth login starts a new OAuth session with Tiro’s fixed public client.

​
4. Connect Tiro MCP to your agent (optional)

If you use Claude Code (or any MCP-compatible client), the CLI ships a one-line installer for the hosted Tiro MCP at https://mcp.tiro.ooo/mcp:
Pipe the output straight to your shell, or copy the command into your MCP client’s config. Run tiro mcp info --json for a structured view (transport, URL, docs link). The CLI handles read-heavy flows (browse, save to disk); MCP handles interactive tool calls inside an agent loop. See AGENTS.md bundled with the package for the full agent contract.

​
Headless, CI, and agent environments

Some environments can’t open a browser (CI, SSH, sandboxed agents, Docker). For those, set TIRO_TOKEN directly. Any value here overrides the keychain.
In GitHub Actions:
Putting your full bearer token in a CI secret is equivalent to a 180-day Personal Access Token. Rotate by running tiro auth logout && tiro auth login on a trusted machine and copying the new token into the secret store.

​
Configuration overrides

Per-call overrides:

​
Update the CLI

→ Continue to Quickstart for hands-on examples.