The terminal is the fastest dashboard.

Install

npm i -g @tillstack/cli      # or: pnpm add -g @tillstack/cli

tilldev login             # sign in once
tilldev config set org my-team
tilldev config set project prj_1a2b3c   # optional default

The tillpulse command is installed as an alias of tilldev — same binary, so tillpulse issues and tilldev pulse issues are equivalent.

Account & config

Your token, org, and a default project live at ~/.tilldev/config.json (file mode 0600). Set a default org and project and every command below drops the flags.

A session renews itself: the access token lasts an hour and the CLI swaps it using the stored refresh token, which lasts 30 days from its last use. Parallel commands share one renewal, so running several at once does not sign you out. Approve a sign-in at tilldev.dev/device; the page shows the computer name and IP that asked, and only a code you just started should be approved.

TillPulse — observability

Everything under tilldev pulse …. Set a default project with tilldev config set project <id> to omit --project.

TillAuth — authentication

Workspace

Team, API keys, company sign-in and approvals are org-level — they span every product you’ve enabled (see Company sign-in). Sensitive actions (revealing a secret, running a command with secrets, minting tokens) wait for your passkey, your paired phone or a confirmed authenticator code; see Approvals.

MCP servers

Give AI tools their API keys without writing them into a config file. See MCP servers.

SSH agent

Use an SSH key that stays in the vault, for ssh, git and AI sessions. See SSH agent.

Make ML-DSA, SLH-DSA, ML-KEM, X-Wing and hybrid ML-DSA-65 + Ed25519 keys in the vault. See Post-quantum keys.

Encrypted delivery and host keys

Get pulls and leases encrypted to a post-quantum key, and bind a token to one host. See Encrypted delivery.

Workload identities

Let CI jobs, cloud workloads and servers read secrets with the identity they already have, instead of a stored token. See Workload identity.

What encrypts your secrets

Check the suites behind your workspace's secrets and rotate its data key. See Cryptography for every product.

Sealed secrets

Seal a secret nobody should read; releasing it takes two owners. See Sealed secrets.

Spend anomalies

Notice an agent behaving unlike itself, and route it to your on-call. See Spend anomalies.

Plant decoys that alert on first use. See Canaries.

Find vault values where they shouldn't be, and rotate the ones that leak. See Leaked values.

Ask for a value

Get a value from a person without it passing through a chat or your terminal. See Secret requests.

Presigned calls

Let a machine make one privileged call without holding the credential. See Presigned calls.

Global flags & environment

These work on any command:

In CI

Skip the interactive login: mint a scoped key once with tilldev keys create ci --scopes read,ingest, store it as a secret, and export it. The CLI reads TILLDEV_TOKEN automatically — a common step is uploading source maps right after a build. An API key can’t approve anything, so actions that need a person’s approval answer 403. To read secrets in CI, use a workload identity, which needs no stored secret, or a TillSecrets service token:

export TILLDEV_TOKEN="${{ secrets.TILLDEV_TOKEN }}"

tilldev pulse releases create prj_1a2b3c "$GIT_SHA" --commit "$GIT_SHA"
tilldev pulse sourcemaps upload prj_1a2b3c --release "$GIT_SHA" --file ./dist/main.js.map