{"slug": "openai-cli-official-cli-for-the-openai-api", "title": "OpenAI CLI – Official CLI for the OpenAI API", "summary": "OpenAI released an official command-line interface for its REST API, installable via Homebrew with `brew install openai/tools/openai` or built from source with Go 1.26 or later. The CLI uses a resource-based command structure (`openai <resource> [subresource...] <command> [flags...]`), requires an `OPENAI_API_KEY` for standard endpoints and an `OPENAI_ADMIN_KEY` for admin endpoints, and prints readable text by default with `--format json` or `--format jsonl` available for scripts. The tool also adds help pages that work without an API key or network connection and shell Tab completion for Bash, zsh and fish, with existing colon commands such as `openai admin:organization:usage completions` continuing to work.", "body_md": "The official CLI for the [OpenAI REST API](https://platform.openai.com/docs).\n\n```\nbrew install openai/tools/openai\n```\n\nTo test or install the CLI locally, you need [Go](https://go.dev/doc/install) version 1.26 or later installed.\n\n```\ngo install 'github.com/openai/openai-cli/cmd/openai@latest'\n```\n\nOnce you have run `go install`, the binary is placed in your Go bin directory:\n\n- **Default location** :`$HOME/go/bin` (or`$GOPATH/bin` if GOPATH is set)\n- **Check your path** : Run`go env GOPATH` to see the base directory\n\nIf commands aren't found after installation, add the Go bin directory to your PATH:\n\n```\n# Add to your shell profile (.zshrc, .bashrc, etc.)\nexport PATH=\"$PATH:$(go env GOPATH)/bin\"\n```\n\nThe first eligible interactive `openai` run quietly saves image picker Tab\nshortcuts for future Bash, zsh, and fish sessions. Open a new terminal to use\nthem. See [shortcut setup and removal](https://github.com/openai/openai-cli/blob/main/docs/image-picker-shell-setup.md) for\nrequirements and opt-out. PowerShell keeps normal Tab completion; press Enter\nafter `openai images generate` to open the picker.\n\nAfter cloning the git repository for this project, you can use the\n`scripts/run` script to run the tool locally:\n\n```\n./scripts/run args...\n```\n\nThe CLI follows a resource-based command structure:\n\n```\nopenai <resource> [subresource...] <command> [flags...]\n```\n\nStandard API endpoints require an [API key](https://platform.openai.com/settings/organization/api-keys):\n\n```\nexport OPENAI_API_KEY=\"sk-...\"\n\nopenai responses create \\\n  --input \"Say this is a test\" \\\n  --model gpt-5.5\n```\n\nAdmin endpoints require an [admin API key](https://platform.openai.com/settings/organization/admin-keys):\n\n```\nexport OPENAI_ADMIN_KEY=\"sk-admin-...\"\n\nopenai admin organization usage completions \\\n  --start-time 1735689600 \\\n  --end-time 1735776000 \\\n  --bucket-width 1d\n```\n\nBrowse each group with `--help`, for example `openai admin --help` or\n`openai admin organization --help`. Existing colon commands such as\n`openai admin:organization:usage completions` continue to work.\n\nRun `openai` to browse command groups by task, with descriptions for each group.\nGroup help separates actions from nested command groups and lists every immediate command.\nHelp works without an API key or network connection:\n\n```\nopenai help setup                  # Enter your API key safely\nopenai images generate --help      # Example and every image option\nopenai help images generate        # The same complete image help\nopenai --help                      # Command groups and global options\n```\n\nAdd `--help` (or `-h`) to any command for its complete help page.\n`openai help COMMAND` shows the same page.\nCommand pages list global options. Use `openai --help` for their full descriptions.\nYou can place `--help` after valid command options.\nThe old `help --all` spelling prints migration guidance and the complete page.\nCommand behavior, defaults, and output formats remain unchanged.\nTab completion follows the same group order and supports help topics and file input paths.\nAfter upgrading, [reload shell completion](https://github.com/openai/openai-cli/blob/main/docs/shell-completion.md) to enable the new file-path behavior.\nOlder loaded completion scripts keep their previous behavior until refreshed.\n\nSuccessful JSON responses print readable text by default, including in pipes.\nUse `--format json` or `--format jsonl` in scripts that parse API data.\nSee [reading command results](https://github.com/openai/openai-cli/blob/main/docs/readable-output.md) for extraction, binary\noutput, and the scope of readable presentation.\n\nUpload a local file with an explicit purpose, inspect its metadata, then download its contents:\n\n```\nopenai files upload \"upload space.txt\" --purpose user_data\nopenai files get file-example\nopenai files download file-example --output \"downloaded copy.txt\"\nopenai files download file-example > copy.txt\n```\n\nReplace `file-example` with the returned file ID. Upload takes a plain path, without an added `@`.\n`create`, `retrieve`, `content`, and their existing flags remain available.\nSee [working with files](https://github.com/openai/openai-cli/blob/main/docs/files.md) for literal filenames, output formats, and script examples.\n\n`openai images generate --prompt \"A tiny orange robot\"` saves images to\n`~/Downloads/gpt-images/` and prints their paths, including in pipes. The CLI\nuses `gpt-image-2.5-sunburst` when saving without an explicit model or legacy\nresponse format. Use `--model` for another exact ID, `--name` for a filename,\nor `--output-dir` for an existing directory. Existing files are kept.\n`--format json` returns API data without saving or applying the CLI preset.\n`images edit` also saves new results while keeping source files.\n`images create-variation` is retired and no longer available. To create a\nvariation, use `images edit` with a GPT Image model and a prompt. See\n[image generation and saving](https://github.com/openai/openai-cli/blob/main/docs/image-generation-saving.md) for commands\nand defaults.\n\n`openai images preview \"path/to/image.png\"` redisplays a saved image without an\nAPI request. Use `openai images inline on` or `off` to remember whether future\nsaved images appear automatically. Per-command `--inline auto`, `on` or `off`\noverrides that setting. `on` also permits an image font in local Apple Terminal.\n\nErrors print actionable summaries to stderr by default. Use `--format-error json`\nfor original API error details, including unknown fields and SDK-reported stream\nerror events. For those events, extraction paths include the `error` envelope,\nfor example `--transform-error error.code`. Explicit `--format`\nvalues `json`, `jsonl`, `raw`, and `yaml` also apply to errors unless overridden\nby `--format-error`; an explicit `--format-error auto` or `text` restores summaries.\n`--transform-error` extracts error data independently of successful output.\nMalformed or empty error bodies receive a safe diagnostic; HTTP status is included\nonly when the SDK retains it. Summaries omit rejected values and request URLs;\nexplicit API error details can contain server-supplied sensitive data.\n\n| Environment variable | Required | Default value | \n|---|---|---|\n| `OPENAI_API_KEY` | no | `null` | \n| `OPENAI_ADMIN_KEY` | no | `null` | \n| `OPENAI_ORG_ID` | no | `null` | \n| `OPENAI_PROJECT_ID` | no | `null` | \n| `OPENAI_WEBHOOK_SECRET` | no | `null` | \n| `OPENAI_CUSTOM_HEADERS` | no | `null` | \n| `OPENAI_MTLS_CLIENT_CERT_FILE` | no | `null` | \n| `OPENAI_MTLS_CLIENT_KEY_FILE` | no | `null` | \n| `OPENAI_UNTRUSTED_STDIN` | no | `false` | \n\n- `--api-key` (can also be set with`OPENAI_API_KEY` env var)\n- `--admin-api-key` (can also be set with`OPENAI_ADMIN_KEY` env var)\n- `--organization` (can also be set with`OPENAI_ORG_ID` env var)\n- `--project` (can also be set with`OPENAI_PROJECT_ID` env var)\n- `--webhook-secret` (can also be set with`OPENAI_WEBHOOK_SECRET` env var)\n- `--mtls-client-cert-file` (can also be set with`OPENAI_MTLS_CLIENT_CERT_FILE` env var)\n- `--mtls-client-key-file` (can also be set with`OPENAI_MTLS_CLIENT_KEY_FILE` env var)\n- `--help` - Show command line usage\n- `--debug` - Enable debug logging. This includes HTTP request/response details and bodies; do not share debug logs if they may contain sensitive payloads.\n- `--version` ,`-v` - Show the CLI version\n- `--base-url` - Use a custom API backend URL. HTTPS is required except for`localhost` or literal loopback IP addresses such as`127.0.0.1` and`::1` .\nThis also applies to`OPENAI_BASE_URL` ; remote HTTP backends must enable HTTPS.\n- `--header` ,`-H` - Add a literal request header as`Name: Value` ; repeat for multiple headers\n- `--format` - Change the output format (`auto` ,`text` ,`explore` ,`json` ,`jsonl` ,`pretty` ,`raw` ,`yaml` );`auto` selects readable text unless extracting data\n- `--format-error` - Change the stderr error format (`auto` ,`text` ,`explore` ,`json` ,`jsonl` ,`pretty` ,`raw` ,`yaml` );`auto` selects readable summaries unless extracting error data\n- `--transform` - Transform the data output using[GJSON syntax](https://github.com/tidwall/gjson/blob/master/SYNTAX.md)\n- `--transform-error` - Transform the error output using[GJSON syntax](https://github.com/tidwall/gjson/blob/master/SYNTAX.md)\n\nUse `--header` or `-H` before or after a resource command:\n\n```\nopenai --header 'X-Trace-ID: example-123' models list \\\n  -H 'X-Client-Label: local,manual'\n```\n\nValues are literal: commas and colons are preserved, and `@` prefixes do not\nread files. Surrounding spaces and tabs are trimmed from values. `-H 'X-Example:'`\nsends an empty value. If a name is repeated, the last value wins regardless of\ncase, overriding default and endpoint-specific headers. Headers managed by the\nHTTP transport, such as `Host` and `Content-Length`, retain the transport's\nbehavior. Supplied header values are hidden in help and redacted in debug logs.\n\nFor credential-bearing headers, have a secret manager or trusted launcher set\n`OPENAI_CUSTOM_HEADERS` directly in the CLI's environment. This keeps credentials\nout of command arguments and avoids typing literal secrets into shell history.\nThe variable accepts one `Name: Value` entry per line. For example, with\nnon-sensitive values:\n\n```\nexport OPENAI_CUSTOM_HEADERS='X-Trace-ID: example-123\nX-Client-Label: local,manual'\nopenai models list\n```\n\n`--header` and endpoint-specific header flags override matching environment\nentries. Environment header values are also redacted in debug logs. Use\n`OPENAI_API_KEY` and `OPENAI_ADMIN_KEY` for standard API and admin authentication.\n\nMutual TLS is currently in beta. To opt in and activate a CA certificate for\nyour organization or project, follow the\n[OpenAI Mutual TLS Beta Program](https://help.openai.com/en/articles/10876024-openai-mutual-tls-beta-program)\ninstructions.\n\nTo authenticate API-key requests with a mutual TLS client certificate, provide the client certificate and private key as separate PEM files. If certificate chain support is enabled for your organization, the certificate file must contain the leaf certificate first, followed by any intermediate certificates. Otherwise, use a client certificate signed directly by an activated CA certificate.\n\n```\nexport OPENAI_MTLS_CLIENT_CERT_FILE=/run/secrets/openai/client-chain.pem\nexport OPENAI_MTLS_CLIENT_KEY_FILE=/run/secrets/openai/client.key\nexport OPENAI_BASE_URL=https://mtls.api.openai.com/v1\n\nopenai files list\n```\n\nBoth mTLS files must be configured together. Keep the private key in a\npermission-restricted file; do not put private-key contents directly in command\narguments or environment variables. The CLI does not automatically select an\nmTLS endpoint, so configure `OPENAI_BASE_URL` or `--base-url` explicitly. HTTP\nand SOCKS proxies remain supported, but HTTPS proxies are rejected to prevent\npresenting the client certificate during the proxy's own TLS handshake.\n\nFor JSON input values, `@myfile.ext` reads local file contents:\n\nBinary upload flags use plain paths. For example, use `files upload --file \"upload space.txt\" --purpose user_data`.\nHere, `--file \"@upload space.txt\"` names an actual file starting with `@`; it does not expand another file reference.\nSee [working with files](https://github.com/openai/openai-cli/blob/main/docs/files.md).\n\n```\nopenai <command> --arg @abe.jpg\n```\n\nFiles can also be passed inside JSON or YAML blobs:\n\n```\nopenai <command> --arg '{image: \"@abe.jpg\"}'\n# Equivalent:\nopenai <command> <<YAML\narg:\n  image: \"@abe.jpg\"\nYAML\n```\n\nWhen piping JSON or YAML from an untrusted source, enable untrusted-stdin mode:\n\n```\nuntrusted-producer | OPENAI_UNTRUSTED_STDIN=1 openai <command> --file ./upload.txt\n```\n\nIn this mode, values supplied through stdin are treated as literal data: `@`,\n`@file://`, and `@data://` references in request bodies, headers, and query\nparameters do not read local files. File-upload parameters must be provided\nexplicitly as command-line flags. Explicit flags retain their normal file\nbehavior and take precedence over values supplied through stdin. Leave\n`OPENAI_UNTRUSTED_STDIN` unset when using trusted heredocs or other trusted\npiped input that intentionally references local files.\n\nIf you need to pass a string literal that begins with an `@` sign, you can\nescape the `@` sign to avoid accidentally passing a file.\n\n```\nopenai <command> --username '\\@abe'\n```\n\nFor JSON endpoints, the CLI tool does filetype sniffing to determine whether the\nfile contents should be sent as a string literal (for plain text files) or as a\nbase64-encoded string literal (for binary files). If you need to explicitly send\nthe file as either plain text or base64-encoded data, you can use\n`@file://myfile.txt` (for string encoding) or `@data://myfile.dat` (for\nbase64-encoding). Note that absolute paths will begin with `@file://` or\n`@data://`, followed by a third `/` (for example, `@file:///tmp/file.txt`).\n\n```\nopenai <command> --arg @data://file.txt\n```\n\nYou can link the CLI against a different version of the OpenAI Go SDK\nfor development purposes using the `./scripts/link` script.\n\nTo link to a specific version from a repository (version can be a branch, git tag, or commit hash):\n\n```\n./scripts/link github.com/org/repo@version\n```\n\nTo link to a local copy of the SDK:\n\n```\n./scripts/link ../path/to/openai-go\n```\n\nIf you run the link script without any arguments, it will default to `../openai-go`.\n\nPlease share bug reports and feature requests through [GitHub issues](https://github.com/openai/openai-cli/issues).\nPull requests are limited to repository collaborators; we do not accept pull requests from non-collaborators.\nSee [CONTRIBUTING.md](https://github.com/openai/openai-cli/blob/main/CONTRIBUTING.md) for the contribution policy and development guide.\nFor security vulnerabilities, follow [SECURITY.md](https://github.com/openai/openai-cli/blob/main/SECURITY.md).\n\nCopyright 2026 OpenAI\n\nThis project is licensed under the [Apache License 2.0](https://github.com/openai/openai-cli/blob/main/LICENSE).", "url": "https://wpnews.pro/news/openai-cli-official-cli-for-the-openai-api", "canonical_source": "https://github.com/openai/openai-cli", "published_at": "2026-10-21 02:01:26+00:00", "updated_at": "2026-10-21 02:48:14.328325+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "artificial-intelligence"], "entities": ["OpenAI", "OpenAI CLI", "OpenAI REST API", "Go", "Homebrew"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openai-cli-official-cli-for-the-openai-api", "markdown": "https://wpnews.pro/news/openai-cli-official-cli-for-the-openai-api.md", "text": "https://wpnews.pro/news/openai-cli-official-cli-for-the-openai-api.txt", "jsonld": "https://wpnews.pro/news/openai-cli-official-cli-for-the-openai-api.jsonld"}}