cpctl CLI

The cpctl CLI is the command-line interface for Compute Portal. It lets you deploy GPU workloads, manage services, databases, and infrastructure entirely from a terminal — scriptable, agent-friendly, and designed for full CI/CD integration.

Installation

bash

# Linux / macOS (recommended)
curl -fsSL https://install.computeportal.io | sh

# Install a specific version
CP_VERSION=v0.3.0 curl -fsSL https://install.computeportal.io | sh

# Install to a custom directory (no sudo)
CP_INSTALL_DIR=~/.local/bin curl -fsSL https://install.computeportal.io | sh

After installation verify it works:

bash

cpctl version

Authentication

The recommended method for CI/CD and agents:

bash

cpctl login --token <api-token>

Get your API token from computeportal.io/user/orders after purchasing a subscription.

You can also set the token via environment variable — useful in containers and CI pipelines:

bash

export CP_API_TOKEN=<api-token>

Run cpctl login without flags for instructions on getting your token.

Logout

bash

cpctl logout           # revokes token locally and server-side

Show current user

bash

cpctl whoami

email             alice@example.com
user_id           usr_abc123
org               example-org
plan              pro
token_expires_at  2027-01-01T00:00:00Z

Global Flags

These flags apply to every command:

Flag	Description
`--region <region>`	Pin all API calls to a specific region (`eu-west`, `us-east`, `ap-south`)
`--json`	Output results as machine-readable JSON
`--yes`, `-y`	Skip all confirmation prompts

Project Setup

Initialize a project

Creates a cp.json in the current directory via interactive prompts:

bash

cpctl init

Initialising Compute Portal project...

Project name: my-inference-api
Docker image: myorg/inference:latest
Region (eu-west / us-east / ap-south) [eu-west]: eu-west
Replicas [1]: 2

Generated cp.json:

json

{
  "project": "my-inference-api",
  "image": "myorg/inference:latest",
  "region": "eu-west",
  "replicas": 2
}

For non-interactive use (CI/CD), pass flags directly:

bash

cpctl init --name my-app --image nginx:latest --region eu-west --replicas 2

Flag	Description
`--name <name>`	Project/service name
`--image <image>`	Docker image
`--region <region>`	Region (`eu-west`, `us-east`, `ap-south`)
`--replicas <n>`	Initial replica count (default: `1`)
`--output`, `-o`	Output format (`json`)

Link a directory to a service

bash

cpctl link my-inference-api
# Linked to service my-inference-api (wrote .cp-link)

This writes a .cp-link file so subsequent commands (deploy, logs, env) know which service to target.

Link two services together

Wire two services so each can reach the other by URL — useful for frontend/backend pairs:

bash

cpctl link tfx-frontend tfx-backend

✓ Linked tfx-frontend ↔ tfx-backend

  Injected into tfx-frontend:
    TFX_BACKEND_URL=https://backend.talentfinderx.work
    BACKEND_URL=https://backend.talentfinderx.work

  Redeploy both services:
    cpctl redeploy tfx-frontend
    cpctl redeploy tfx-backend

By default the link is bidirectional — FRONTEND_URL is also injected into the target. Use --one-way to skip the reverse injection:

bash

cpctl link frontend backend --one-way

Flag	Description
`--one-way`	Only inject target URL into source, not bidirectionally

Unlink

bash

cpctl unlink
# Unlinked (removed .cp-link)

Open a service in the browser

bash

cpctl open                   # reads service from .cp-link
cpctl open my-inference-api  # explicit service name

List all services

bash

cpctl list

NAME               IMAGE                         STATUS   REGION    URL
my-inference-api   myorg/inference:latest        running  eu-west   https://my-inference-api.cpctl.app
postgres-db        postgres:16                   running  eu-west   —

Deploy

Deploy a Docker image or GitHub repo to CP hardware.

bash

# Deploy from Docker image
cpctl deploy --image nginx:latest

# Deploy with GPU
cpctl deploy --image myorg/inference:latest --gpu rtx4090

# Deploy with multiple GPUs
cpctl deploy --image myorg/trainer:latest --gpu rtx5090 --gpu-count 4

# Deploy from a GitHub repo (no Dockerfile needed — CP builds it)
cpctl deploy --repo https://github.com/org/repo

# Deploy from cp.json in the current directory
cpctl deploy

Private GitHub repos

For private repos, CP automatically fetches a short-lived installation token via your connected GitHub account — no PAT required:

bash

cpctl deploy --repo https://github.com/your-org/private-repo
# → Private GitHub repo detected — fetching installation token...

Connect GitHub at computeportal.io/user/compute?tab=cli. For private registry images, store credentials via cpctl github pat.

Deploy flags

Flag	Description
`--image <image>`	Docker image to deploy (e.g. `nginx:latest`)
`--repo <url>`	GitHub repo URL to build and deploy
`--branch <branch>`	Git branch (default: repo default branch)
`--name <name>`	Service name (default: derived from image or repo)
`--env <environment>`	Target environment (default: `production`)
`--region <region>`	Region to deploy to (`eu-west`, `us-east`, `ap-south`)
`--gpu <type>`	GPU to attach (`rtx4090`, `rtx5090`)
`--gpu-count <n>`	Number of GPUs (default: `1`)
`--node <id>`	Pin to a specific node ID
`--subpath <dir>`	Subdirectory within the repo to build (e.g. `backend`)
`--port <n>`	Container port the service listens on (auto-detected from image `EXPOSE` if not set)
`--env-var KEY=VALUE`	Set env vars at deploy time — may be repeated; also passed as build args
`--wait`	Wait for the service to reach `running` before exiting
`--timeout <s>`	Seconds to wait when `--wait` is set (default: `300`)
`--no-probe`	Disable readiness probe (use for workers or batch services that don't serve HTTP)
`--init-image <image>`	Init container image — runs to completion before the main container starts
`--init-command <cmd>`	Shell command for the init container
`--init-env KEY=VALUE`	Env var for the init container — may be repeated
`--mount-configmap <name>:<path>`	Mount a config map at a path inside the container — may be repeated (e.g. `my-config:/etc/config`)
`--pay-token <token>`	Machine payment token from `cpctl pay authorize`

When --image and --repo are both absent, cpctl deploy reads cp.json from the current directory.

--no-probe flag

By default every service gets a TCP readiness probe on its container port. This keeps worker services (RabbitMQ consumers, job runners, etc.) stuck in starting forever because they don't bind an HTTP listener. Pass --no-probe to skip the probe entirely:

bash

cpctl deploy --image myorg/worker:latest --name my-worker --no-probe

The same effect can be achieved declaratively via health_check: type: none in cp.yaml.

Deploy output

Deploying myorg/inference:latest...
✓ Deployed my-inference-api

service   my-inference-api
url       https://my-inference-api.cpctl.app
status    running
port      8080 (from image EXPOSE)

.env.example scanning

After a successful deploy, CP scans the local directory for a .env.example file. If any keys are missing from the deploy request, it prints a ready-to-copy cpctl env set command:

⚠ .env.example found — 2 variable(s) may be required:
  DATABASE_URL=<value>
  SECRET_KEY=<value>

Set them with:
  cpctl env set my-inference-api \
    DATABASE_URL=<value> \
    SECRET_KEY=<value>

To set all missing keys in one step after deploying:

bash

cpctl env set my-inference-api --from-example

Service Lifecycle

The most common lifecycle commands are available at the top level:

bash

cpctl stop <name>               # stop a running service
cpctl start <name>              # start a stopped service
cpctl delete <name> --force     # permanently delete a service

The full cpctl machine subcommand offers additional operations:

bash

cpctl machine list              # list all services with REPLICAS column
cpctl machine status <name>     # show health and resources
cpctl machine start <name>      # start a stopped service
cpctl machine stop <name>       # stop a running service
cpctl machine restart <name>    # restart a service
cpctl machine destroy <name>    # permanently destroy a service (alias: cpctl delete)

machine status

bash

cpctl machine status my-inference-api

name      my-inference-api
id        svc_abc123
image     myorg/inference:latest
status    running
region    eu-west
node      node-eu1-001
cpu       4.00
memory    16g
url       https://my-inference-api.cpctl.app
gpu       rtx4090
replicas  2 / 2

reason and message appear when the service is not healthy (e.g. a failing readiness probe).

machine destroy

bash

cpctl machine destroy my-inference-api --force

--force is required to confirm the destructive operation.

Logs

Stream or tail logs from any service:

bash

cpctl logs <name>               # last 100 lines
cpctl logs <name> --tail 500    # last 500 lines
cpctl logs <name> --follow      # stream in real time
cpctl logs <name> -f            # shorthand for --follow
cpctl logs <name> --build       # stream build logs (Kaniko/Nixpacks output)

Flag	Default	Description
`--tail <n>`	`100`	Number of recent log lines
`--follow`, `-f`	`false`	Stream logs in real time
`--build`	`false`	Stream build logs instead of runtime logs
`--since <duration>`	—	Show logs from the last N duration (e.g. `5m`, `1h`, `30s`)

Status

Check platform health or the status of a specific service:

bash

# Platform-wide health
cpctl status

# Per-service status
cpctl status <name>

# Always show K8s events (auto-shown on failure)
cpctl status <name> --events

Example output for a healthy service:

name      my-inference-api
status    running
image     myorg/inference:latest
region    eu-west
node      node-eu1-001
url       https://my-inference-api.cpctl.app
port      8080
cpu       1
memory    1Gi
gpu       
replicas  1 / 1

When a service has failed, reason and message are shown and K8s events are automatically printed:

name     my-inference-api
status   failed
reason   ImagePullBackOff
message  Back-off pulling image "myorg/inference:latest": ErrImagePull
...

Events:
┌─────────────────────┬─────────┬─────────┬──────────────────────────────┬───────┐
│ TIME                │ TYPE    │ REASON  │ MESSAGE                      │ COUNT │
├─────────────────────┼─────────┼─────────┼──────────────────────────────┼───────┤
│ 2026-08-10T08:45:34 │ Warning │ Failed  │ Error: ImagePullBackOff      │ x12   │
└─────────────────────┴─────────┴─────────┴──────────────────────────────┴───────┘

Status values:

Status	Meaning
`running`	All replicas ready
`starting`	Pods are being scheduled or initialising
`stopped`	Scaled to zero replicas
`failed`	Pod cannot start (e.g. image pull error, bad config)
`crashed`	Container started but exited unexpectedly (CrashLoopBackOff / OOMKilled)

Flag	Description
`--events`	Always show the K8s events table

Scale

Manual scaling

Adjust replicas or resource limits:

bash

cpctl scale <name> --replicas 3           # set replica count
cpctl scale <name> --cpu 4               # set CPU limit in vCPUs
cpctl scale <name> --ram 16g             # set memory limit
cpctl scale <name> --replicas 2 --ram 8g  # combine flags

Autoscaling (HPA)

Enable CPU/memory-triggered horizontal pod autoscaling:

bash

# Enable HPA: scale between 2 and 10 replicas at 70% CPU
cpctl scale <name> --min 2 --max 10 --cpu-threshold 70

# Add memory threshold
cpctl scale <name> --min 2 --max 10 --cpu-threshold 70 --memory-threshold 80

# Disable autoscaling
cpctl scale <name> --autoscale

Flag	Default	Description
`--replicas <n>`	`1`	Number of replicas (manual scaling)
`--cpu <n>`	—	CPU limit in vCPUs (e.g. `2`, `0.5`)
`--ram <size>`	—	Memory limit (e.g. `4g`, `512m`, `4Gi`)
`--min <n>`	`1`	Minimum replicas for autoscaling (HPA)
`--max <n>`	—	Maximum replicas — required to enable HPA
`--cpu-threshold <pct>`	—	CPU utilisation % to trigger scale-up (e.g. `70`)
`--memory-threshold <pct>`	—	Memory utilisation % to trigger scale-up (e.g. `80`)
`--autoscale`	—	Disable autoscaling (boolean flag — no value needed)

Exec & SSH

exec — run a command inside a container

bash

cpctl exec <name> -- <command> [args...]

cpctl exec my-api -- sh                   # open shell
cpctl exec my-api -- python manage.py migrate
cpctl exec my-api -- /bin/bash

ssh — open a shell in a container

bash

cpctl ssh <name>

Alias for cpctl exec <name> -- sh. Opens an interactive shell inside the running container. Type exit or press Ctrl-D to close.

Requires only your API token — no SSH key or cluster access needed.

Processes

List all running services and their per-node resource usage across the cluster:

bash

cpctl ps

Environment Variables

Set variables

bash

cpctl env set <service> KEY=VALUE [KEY=VALUE ...]

# Single variable
cpctl env set my-api DATABASE_URL=postgres://...

# Multiple variables
cpctl env set my-api DEBUG=false LOG_LEVEL=info

# Import from .env file
cpctl env set my-api --file .env

# Import from .env.example — skips keys already set on the service
cpctl env set my-api --from-example

Reference another service's URL

Use the reference syntax ${{SERVICE_NAME.URL}} in a value and CP resolves it to the live Ingress URL at set-time:

bash

cpctl env set my-frontend BACKEND_URL='${{my-backend.URL}}'
# → BACKEND_URL=https://my-backend.cpctl.app

This is equivalent to running cpctl link but for a single variable.

Auto-injected variables

Every deployed service automatically receives SERVICE_URL set to its public HTTPS URL. You don't need to set this manually.

List variables

bash

cpctl env list <service>

KEY            VALUE
SERVICE_URL    https://my-api.cpctl.app
DATABASE_URL   postgres://user:pass@host/db
LOG_LEVEL      info
DEBUG          false

Values longer than 40 characters are masked for safety.

Remove variables

bash

cpctl env unset <service> KEY [KEY ...]

cpctl env unset my-api DEBUG
cpctl env unset my-api DEBUG LOG_LEVEL

variable (alias)

cpctl variable is an alias for cpctl env:

bash

cpctl variable list <service>
cpctl variable set <service> KEY=VALUE
cpctl variable delete <service> KEY

Environments

Environments let you isolate deployments (e.g. production, staging, pr-123).

bash

cpctl environment list             # list all environments
cpctl environment create <name>    # create a new environment
cpctl environment delete <name>    # delete an environment (--force to confirm)
cpctl environment switch <name>    # set active environment in .cp-link

Switch environment

bash

cpctl environment switch staging
# Switched to environment staging (updated .cp-link)

The active environment is stored in .cp-link and used automatically by deploy and env commands.

Deployment History

Inspect past deployments for a service:

bash

cpctl deployment list <service>           # list all deployments
cpctl deployment status <service> <id>    # show a specific deployment

bash

cpctl deployment list my-inference-api

ID            STATUS     IMAGE                         DEPLOYED AT
dep_abc123    success    myorg/inference:v2.1.0        2026-07-01T12:00:00Z
dep_xyz789    success    myorg/inference:v2.0.0        2026-06-28T09:15:00Z
dep_def456    failed     myorg/inference:v1.9.0        2026-06-20T18:30:00Z

Redeploy

Re-trigger the current deployment:

bash

cpctl redeploy <service>

Rollback

Roll back to a previous deployment:

bash

cpctl rollback <service>              # roll back to previous
cpctl rollback <service> <dep-id>    # roll back to a specific deployment ID

Custom Domains

Attach your own domain to a service:

bash

cpctl domain add <service> <domain>        # attach a domain
cpctl domain list <service>                # list attached domains
cpctl domain status <service> <domain>     # check DNS and TLS status
cpctl domain remove <service> <domain>     # detach a domain

domain add

Before running this, add a CNAME record at your DNS provider:

Name	Type	Target	Proxy
`api`	`CNAME`	`cpctl.app`	DNS only

Then attach the domain:

bash

cpctl domain add my-api api.example.com

✓ Domain api.example.com attached to my-api

domain   api.example.com
service  my-api
status   active
tls      provisioning

TLS is provisioned automatically via Let's Encrypt within a minute or two.

If DNS hasn't propagated yet, use --skip-dns to bypass the CNAME check:

bash

cpctl domain add my-api api.example.com --skip-dns

The domain can also be passed as a flag instead of a positional argument:

bash

cpctl domain add my-api --hostname api.example.com

domain status

bash

cpctl domain status my-api api.example.com

status        active
tls           yes
cert_verified yes

Volumes

Attach persistent storage volumes to a service:

bash

cpctl volume list <service>                         # list attached volumes
cpctl volume add <service> <mount-path>             # attach a new volume
cpctl volume delete <service> <name> --force        # delete a volume
cpctl volume browse <service>                       # open interactive shell to browse files
cpctl volume download <service> <remote> [local]    # download file from container
cpctl volume upload <service> <local> <remote>      # upload file to container

bash

# Attach a volume mounted at /data
cpctl volume add my-api /data

# List volumes
cpctl volume list my-api

NAME         MOUNT   SIZE   CREATED_AT
vol_abc123   /data   10GB   2026-07-01T10:00:00Z

volume browse

Opens an interactive shell inside the container — useful for inspecting or editing files on a mounted volume without using cpctl exec:

bash

cpctl volume browse my-api

volume download / upload

Transfer individual files between your machine and a running container:

bash

cpctl volume download my-api /app/data/export.csv ./export.csv
cpctl volume upload my-api ./seed.sql /app/data/seed.sql

Databases

Create a database

bash

cpctl db create postgres               # PostgreSQL
cpctl db create redis                  # Redis
cpctl db create mysql                  # MySQL
cpctl db create mongo                  # MongoDB

With options:

bash

cpctl db create postgres \
  --name my-postgres \
  --region eu-west \
  --size 50

Flag	Description
`--name <name>`	Database name (default: `<type>-db`)
`--region <region>`	Region (default: account default)
`--size <gb>`	Storage size in GB (default: `10`)

List databases

bash

cpctl db list

Get connection URL

bash

cpctl db url <name>

Prints the full connection URL to stdout — useful for piping into your app's config.

Attach a database to a service

Wire a database to a service — CP injects three env vars using the K8s-internal connection string (no public network hop):

bash

cpctl db attach <database> <service>

✓ Attached my-postgres → my-app

  Injected into my-app:
    DATABASE_URL=postgres://admin:secret@db-my-postgres.compute-portal.svc.cluster.local:5432/my-postgres
    POSTGRES_URL=postgres://admin:secret@db-my-postgres.compute-portal.svc.cluster.local:5432/my-postgres
    MY_POSTGRES_URL=postgres://admin:secret@db-my-postgres.compute-portal.svc.cluster.local:5432/my-postgres

  Redeploy the service:
    cpctl redeploy my-app

The connection string uses the cluster-internal DNS name (db-<name>.<namespace>.svc.cluster.local), so traffic stays entirely within the cluster — faster and free.

Key	Description
`DATABASE_URL`	Generic key — works with most ORMs out of the box
`<ENGINE>_URL`	Engine-specific key (e.g. `POSTGRES_URL`, `REDIS_URL`)
`<DB_NAME>_URL`	Named key derived from the database name

Destroy a database

bash

cpctl db destroy <name> --force

Interactive database shell

bash

cpctl connect <database-name>

Automatically selects the right client:

Database type	Client used
`postgres`	`psql`
`mysql`	`mysql`
`redis`	`redis-cli`
`mongo`	`mongosh`

The client must be installed locally.

Object Storage

CP provides S3-compatible object storage backed by MinIO, isolated per user. The endpoint is s3-cli.computeportal.io.

bash

cpctl bucket create <name>               # create a bucket
cpctl bucket list                        # list all buckets
cpctl bucket credentials <name>          # show access key, secret, endpoint
cpctl bucket delete <name> --force       # delete a bucket, even if non-empty
cpctl bucket delete <name> --yes         # skip confirmation prompt

bucket create

bash

cpctl bucket create my-uploads

✓ Bucket created

name        my-uploads
endpoint    https://s3-cli.computeportal.io
region      us-east-1

Use --inject <service> to automatically inject bucket credentials as env vars into a running service:

bash

cpctl bucket create my-uploads --inject my-api
# Injects: BUCKET_NAME, BUCKET_ENDPOINT, BUCKET_ACCESS_KEY, BUCKET_SECRET_KEY

bucket credentials

bash

cpctl bucket credentials my-uploads

bucket      my-uploads
endpoint    https://s3-cli.computeportal.io
access_key  AKIAIOSFODNN7EXAMPLE
secret_key  wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
region      us-east-1

Use these credentials with any S3-compatible SDK or tool (AWS SDK, s3cmd, rclone, etc.).

Service Cloning

Clone a service

Duplicate an existing service under a new name — useful for promoting staging to production or creating parallel environments:

bash

cpctl service clone <source> <target>

By default, environment variables are copied too. Use --no-env to skip:

bash

cpctl service clone my-api my-api-staging --no-env

Copy env vars between services

bash

cpctl env copy <source> <target>

Copies all env vars from source to target. Does not redeploy either service — run cpctl redeploy <target> after.

Preview Environments

PR preview environments automatically deploy a temporary copy of a service for every GitHub pull request and destroy it when the PR closes.

bash

cpctl preview enable <service>    # enable PR previews for a service
cpctl preview disable <service>   # disable PR previews
cpctl preview list <service>      # list active preview deployments

preview enable

bash

cpctl preview enable my-api

✓ PR preview environments enabled for my-api

Each new pull request will deploy to:
  https://my-api-pr-<number>.cpctl.app

Requires a connected GitHub account. Previews are auto-destroyed on PR close/merge.

Infrastructure as Code

Manage multi-service infrastructure declaratively via cp.yaml.

bash

cpctl iac init                                  # generate cp.yaml from live services
cpctl iac up                                    # apply cp.yaml (interactive confirm)
cpctl iac up --dry-run                          # show plan without applying
cpctl iac up --yes                              # apply without confirm prompt
cpctl iac up --file environments/prod/cp.yaml  # target a specific file
cpctl iac down                                  # destroy all resources in cp.yaml

iac init

Snapshots live services and databases into a cp.yaml file:

bash

cpctl iac init --file environments/production/cp.yaml

By default env var values are included. Pass --no-secrets to omit values (keys are preserved):

bash

cpctl iac init --no-secrets --file cp.yaml

In scaffold mode (--scaffold), generates a cp.yaml from flags without calling the API — useful for bootstrapping a new project from scratch:

bash

cpctl iac init --scaffold \
  --name my-api \
  --image myorg/api:latest \
  --replicas 2

Scaffold flag	Description
`--scaffold`	Generate from flags instead of snapshotting live state
`--name <name>`	Service name
`--image <image>`	Docker image
`--replicas <n>`	Replica count (default: `1`)
`--db <type>`	Add a managed database (`postgres`, `redis`, `mysql`, `mongo`)

iac up

Compares cp.yaml against live state and applies the diff:

bash

cpctl iac up --dry-run --file cp.yaml

Plan (3 changes):

Databases:
  + create  storefront-db    postgres  50 GiB

Services:
  + create  storefront-api   myorg/storefront-api:v1.2.0   1 replica
  ~ update  storefront-web   image: v1.1.0 → v1.2.0
  - remove  storefront-old

bash

cpctl iac up --yes --file cp.yaml

Env diff semantics: iac up merges env vars — keys set outside cp.yaml (e.g. secrets added via cpctl env set) are preserved. Only keys defined in cp.yaml are written.

cp.yaml schema

yaml

version: "1"

databases:
  - name: storefront-db
    engine: postgres
    size_gb: 50

services:
  - name: storefront-api
    image: myorg/storefront-api:v1.2.0
    replicas: 3
    env:
      LOG_LEVEL: info
      FEATURE_FLAGS: "new-checkout"

  - name: storefront-worker
    image: myorg/storefront-worker:v1.2.0
    replicas: 2
    health_check:
      type: none           # worker — no HTTP listener, skip readiness probe

  - name: storefront-web
    image: myorg/storefront-web:v1.2.0
    autoscaling:
      min: 2
      max: 10
      cpu: 65              # scale up at 65% CPU

health_check block:

`type`	Behaviour
`none`	No readiness probe — safe for workers and batch jobs
`tcp`	TCP socket probe on the container port (default when omitted)
`exec`	Run a command inside the container to determine readiness

yaml

# exec probe example
health_check:
  type: exec
  command: ["redis-cli", "ping"]

iac flags

Flag	Description
`--file`, `-f`	Path to `cp.yaml` (default: `cp.yaml` in current directory)
`--dry-run`	Show plan without making any changes
`--yes`	Apply without interactive confirmation
`--no-secrets`	(init only) Omit env var values from generated file

Webhooks & Hooks

Deploy Hooks (inbound)

Deploy hooks are HTTP endpoints that trigger a redeployment when called — useful for CI/CD webhooks from external systems:

bash

cpctl deploy-hook create <service>          # create a hook URL
cpctl deploy-hook list <service>            # list hooks
cpctl deploy-hook delete <service> <id>     # delete a hook

bash

cpctl deploy-hook create my-api

✓ Deploy hook created

hook_id    hook_abc123
url        https://api.computeportal.io/v1/services/my-api/hooks/hook_abc123/trigger
secret     whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

POST to the URL (with the secret in X-Hook-Secret) to trigger a redeployment.

Outbound Webhooks

Subscribe to CP events and receive HTTP POST notifications at your own URL:

bash

cpctl webhook create <url> [--events <events>]    # register
cpctl webhook list                                # list all webhooks
cpctl webhook delete <id>                         # delete

bash

cpctl webhook create https://hooks.example.com/cp \
  --events deploy.succeeded,deploy.failed,service.crashed

Payloads are HMAC-signed with X-CP-Signature. Available events: deploy.succeeded, deploy.failed, service.crashed, service.stopped.

Firewall

Restrict inbound traffic to a service with IP-based rules:

bash

cpctl firewall add <service> --deny <cidr>      # block an IP or range
cpctl firewall add <service> --allow <cidr>     # restrict to specific IP/range
cpctl firewall list <service>                   # list active rules
cpctl firewall remove <service> <rule-id>       # remove a single rule
cpctl firewall off <service>                    # remove all rules

bash

# Block a known bad actor
cpctl firewall add my-api --deny 198.51.100.0/24

# Allow only your office IP (blocks all others)
cpctl firewall add my-api --allow 203.0.113.42/32

Rules are applied at the Ingress layer — traffic never reaches the container.

Config Maps

Store one or more configuration files in the platform and mount them into services at deploy time. Useful for large or binary configs that don't belong in environment variables (Cardano topology files, nginx configs, ML model configs, etc.).

bash

cpctl configmap create <name> --from-file <path>    # create from file(s)
cpctl configmap list                                 # list all config maps
cpctl configmap delete <name>                        # delete a config map

configmap create

Upload one or more files and create a named config map:

bash

# Single file
cpctl configmap create my-config --from-file ./config.json

# Multiple files
cpctl configmap create my-config \
  --from-file ./config.json \
  --from-file ./settings.yaml

Uploading config.json (2 KB)...
✓ Config map "my-config" created

name   my-config
keys   config.json, settings.yaml

Files are uploaded directly to S3 via presigned URLs, then committed to the platform as a Kubernetes ConfigMap. The key for each file is its filename.

Mount the config map into a service at deploy time:

bash

cpctl deploy --image myapp:latest --mount-configmap my-config:/etc/config

Flag	Description
`--from-file <path>`	File to include — may be repeated; key is the filename

configmap list

bash

cpctl configmap list

my-config                       keys: config.json, settings.yaml
cardano-topology                keys: topology.json

configmap delete

bash

cpctl configmap delete my-config
# ✓ Config map "my-config" deleted

TCP Expose

Expose a service port directly to the internet over raw TCP — required when the protocol is not HTTP/HTTPS (e.g. a Cardano node relay, Postgres for external clients, MQTT broker).

Traffic enters at tcp.cpctl.app:<port> and is forwarded to the service pod via a NodePort.

bash

cpctl expose <service> --port <port>    # expose a port
cpctl expose list <service>             # list exposed ports
cpctl expose delete <service> <port>    # remove an exposed port

expose

bash

cpctl expose cardano-relay --port 3001

✓ Exposed cardano-relay at tcp.cpctl.app:3001
  Point your client at: tcp.cpctl.app:3001

--port must be in the range 1024–49151. Each user may have up to 5 active TCP exposes.

Flag	Description
`--port <n>`	Public TCP port to expose (1024–49151, required)

expose list

bash

cpctl expose list cardano-relay

HOST             PORT   NODE PORT   CREATED AT
tcp.cpctl.app    3001   30283       2026-09-05T08:00:00Z

expose delete

bash

cpctl expose delete cardano-relay 3001
# ✓ Removed TCP expose port 3001 from cardano-relay

TCP Proxy

Expose non-HTTP ports externally (e.g. Postgres, Redis, MQTT):

bash

cpctl tcp-proxy create <service> --port <n>    # create proxy
cpctl tcp-proxy list <service>                 # list proxies
cpctl tcp-proxy delete <service> <port>        # delete proxy

bash

cpctl tcp-proxy create my-postgres --port 5432

✓ TCP proxy created

service   my-postgres
port      5432
host      tcp-eu1.cpctl.app
external  tcp-eu1.cpctl.app:32541

Connect with any Postgres client: psql -h tcp-eu1.cpctl.app -p 32541 -U admin.

Static Outbound IP

Pin a service to a stable egress IP — required for IP allowlisting with third-party services:

bash

cpctl static-ip enable <service>     # enable and assign a static IP
cpctl static-ip show <service>       # print the assigned IP
cpctl static-ip disable <service>    # release the static IP

bash

cpctl static-ip enable my-api
cpctl static-ip show my-api
# static_ip  203.0.113.55

Agent Account Invitations

Issue single-use tokens that provision new CP accounts — designed for AI agents and automated clients that need their own authentication:

bash

cpctl invite create --label <label> [--ttl <hours>]    # issue a token
cpctl invite list                                       # list active tokens
cpctl invite revoke <id>                               # revoke a token

bash

cpctl invite create --label "my-agent-prod" --ttl 48

✓ Invitation token created

id          inv_abc123
label       my-agent-prod
token       cpinv_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
expires_at  2026-08-30T12:00:00Z
redeem_url  https://api.computeportal.io/v1/users/redeem

The token is redeemed via POST /v1/users/redeem — a public, rate-limited endpoint that creates a new account and returns an API token. Tokens are single-use and expire after --ttl hours (default: 24).

Quota

Show your current compute quota usage for the active plan:

bash

cpctl quota

┌──────────────────┬──────────┬──────────┬─────┐
│ RESOURCE         │ USED     │ LIMIT    │ PCT │
├──────────────────┼──────────┼──────────┼─────┤
│ CPU              │ 3.50     │ 10.00    │ 35% │
│ Memory           │ 7.0 GiB  │ 20.0 GiB │ 35% │
└──────────────────┴──────────┴──────────┴─────┘

Metrics

View resource metrics for a service:

bash

cpctl metrics <service>

cpu_usage       12%
memory_usage    4.2 / 16.0 GB
network_rx      0.4 MB/s
network_tx      1.2 MB/s
replicas        2

GPU (CP Exclusive)

CP's GPU commands give you direct control over bare-metal GPU inventory — an exclusive capability beyond standard PaaS platforms.

List GPU inventory

bash

cpctl gpu list                          # all available GPU nodes
cpctl gpu list --region eu-west        # filter by region
cpctl gpu list --type rtx4090          # filter by GPU type

NODE             GPU       AVAIL/TOTAL  REGION    UTIL   VRAM              TEMP
node-eu1-001     rtx5090   4 / 4       eu-west   0%     0.0 / 24.0 GB     45°C
node-eu1-002     rtx4090   2 / 8       eu-west   18%    12.4 / 64.0 GB    67°C
node-us1-001     rtx5090   0 / 4       us-east   100%   24.0 / 24.0 GB    82°C

GPU status for a service

bash

cpctl gpu status my-inference-api

service      my-inference-api
gpu_type     rtx5090
node         node-eu1-001
utilization  34.2%
vram         8.3 / 24.0 GB
temperature  58°C
power        220W

Reserve GPU capacity

Pre-reserve GPUs for guaranteed capacity at a fixed rate:

bash

cpctl gpu reserve --type rtx5090 --count 2 --duration 24h --region eu-west

Flag	Description
`--type <gpu>`	GPU type: `rtx4090`, `rtx5090` (required)
`--count <n>`	Number of GPUs (default: `1`)
`--duration <d>`	Duration: `1h`, `4h`, `24h`, `7d`, etc. (default: `1h`)
`--region <region>`	Region (default: account default)

One-shot GPU jobs

Run a script on a GPU and exit — billed per second, ideal for training runs:

bash

cpctl gpu run \
  --image pytorch/pytorch:2.3-cuda12.1 \
  --script "python train.py --epochs 10" \
  --gpu rtx5090 \
  --gpu-count 1

Logs stream in real time and billing stops when the job exits.

Flag	Description
`--image <image>`	Docker image to run (required)
`--script <cmd>`	Command to run inside the container
`--gpu <type>`	GPU type (default: `rtx4090`)
`--gpu-count <n>`	Number of GPUs (default: `1`)
`--region <region>`	Region

Nodes

bash

cpctl node list                            # list all bare-metal nodes
cpctl node list --region eu-west          # filter by region
cpctl node list --gpu rtx4090             # filter by GPU type
cpctl node inspect <node-id>              # show hardware specs and status
cpctl node reserve <node-id> --duration 24h   # reserve an entire node
cpctl node release <node-id>              # release a reserved node

node reserve

Reserve a full node for dedicated use — no other tenants, predictable performance:

bash

cpctl node reserve node-eu1-001 --duration 24h

Flag	Default	Description
`--duration <d>`	`1h`	Reservation duration (e.g. `4h`, `24h`, `7d`)

Regions & Data Residency

bash

cpctl region list                    # list regions with compliance certifications
cpctl region verify <service>        # confirm physical data residency of a service
cpctl policy set --region eu-west    # set org-wide data residency policy

region verify

Confirms that a service's data is physically located in the declared region — useful for compliance audits:

bash

cpctl region verify my-api

policy set

Enforce that all new services are placed in a specific region:

bash

cpctl policy set --region eu-west --enforce strict

Flag	Default	Description
`--region <region>`	—	Region ID (required)
`--enforce <level>`	`strict`	`strict` (block deploys to other regions) or `warn`

API Keys

Create scoped API keys with optional monthly spend caps — useful for giving agents or CI pipelines limited access without exposing your main token.

bash

cpctl apikey create --label <name>             # create a key (displayed once)
cpctl apikey list                              # list all keys with spend status
cpctl apikey revoke <id>                       # revoke a key immediately

apikey create

bash

cpctl apikey create --label "my-agent-prod" --limit 50

✓ API key created

id     ak_abc123
label  my-agent-prod
limit  $50.00 / month
key    cp_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Store this key securely — it will not be shown again.

Give it to your agent:
  cpctl login --token cp_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Or set as environment variable:
  export CP_API_TOKEN=cp_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Flag	Description
`--label <name>`	Human-readable name for this key (required)
`--limit <usd>`	Monthly spend cap in USD (default: `0` = unlimited)
`--expires <date>`	Expiry date in `YYYY-MM-DD` format (optional)

apikey list

ID           PREFIX     LABEL              SPENT / LIMIT        STATUS   LAST USED
ak_abc123    cp_key_    my-agent-prod      $12.40 / $50.00      active   2026-09-10T08:00:00Z
ak_def456    cp_key_    CI deploy bot      unlimited            active   2026-09-09T14:30:00Z

apikey revoke

bash

cpctl apikey revoke ak_abc123
# ✓ API key revoked — all requests using it will now return 401

GitHub Integration

Store a GitHub PAT for pulling private ghcr.io images:

bash

cpctl github pat <token>

This stores the token server-side so CP can pull private container images on your behalf. For private GitHub repos used with --repo, CP fetches a short-lived installation token automatically (see Private GitHub repos).

Infrastructure

Billing

bash

cpctl billing balance                                                # current balance, burn rate, and alert threshold
cpctl billing topup init --network Base --token USDC --amount 50    # get a crypto deposit address
cpctl billing topup verify --payment-id <id> --tx <txid>            # confirm crypto payment
cpctl billing usage                                                  # current billing cycle usage
cpctl billing usage --breakdown                                      # group by service, sorted by cost
cpctl billing alert --threshold 5                                    # notify when balance drops below $5
cpctl billing history                                                # past invoices

Balance & Top-up

cpctl billing manages your prepaid balance. Usage is deducted automatically as services run.

billing balance

bash

cpctl billing balance

balance          $42.50 USD
credit           $10.00 USD
status           active
burn_rate        $0.0125 / hour
alert_threshold  $5.00 USD

billing topup

Crypto top-ups use USDC or USDT only — no native tokens. Payment is done out-of-band: send funds from your own wallet, then submit the transaction ID to confirm.

Supported networks and tokens:

Network	USDC	USDT
Base	✓	✓
Ethereum	✓	✓
Solana	✓	✓
Tron	—	✓
Cardano	—	✓

Step 1 — get a deposit address:

bash

cpctl billing topup init --network Base --token USDC --amount 50

✓ Deposit address ready
  payment_id       topup_a1b2c3d4e5f6g7h8
  network          Base
  token            USDC
  amount           50.00 USDC
  deposit_address  0x1a2b3c4d5e6f...
  expires_at       2026-07-27T17:00:00Z

Send exactly 50.00 USDC to the address above from your wallet.
Do not send a different token or amount — it will not be credited.

Once sent, confirm with:
  cpctl billing topup verify --payment-id topup_a1b2c3d4e5f6g7h8 --tx <transaction-id>

The deposit address is valid for 30 minutes.

Step 2 — submit your transaction ID:

bash

cpctl billing topup verify --payment-id topup_a1b2c3d4e5f6g7h8 --tx <transaction-id>

✓ Payment verified — balance credited
  tx_id        5xSol1ExampleTxHash123...
  credited     $50.00 USD
  new_balance  $92.50 USD

billing usage

bash

cpctl billing usage                          # today
cpctl billing usage --period month           # this calendar month
cpctl billing usage --period 2026-06         # specific month
cpctl billing usage --service my-api         # filter by service
cpctl billing usage --breakdown              # group by service, sorted by cost

billing alert

bash

cpctl billing alert --threshold 5.00
# Alert set: notify when balance < $5.00 USD

cpctl billing alert --threshold 5.00 --currency USD

Flag	Default	Description
`--threshold <amount>`	—	Alert when balance drops below this amount (required)
`--currency <code>`	`USD`	Currency for the threshold

billing history

bash

cpctl billing history

ID        PERIOD   AMOUNT    STATUS  PAID AT
inv_001   2026-06  $49.99    paid    2026-07-01T00:00:00Z
inv_002   2026-07  $21.50    open    —

Machine Payments

cpctl pay enables per-call, agent-native payments for ComputePortal API operations. AI agents and automated clients can pay for individual API calls using a linked Stripe card — no human checkout, no pre-loaded balance required.

pay setup

Link a card. Details are entered securely in your browser via Stripe — raw card numbers never touch the CP server.

bash

cpctl pay setup --method card --limit 1.00

This opens a Stripe-hosted checkout page. Enter your card there, then return to the terminal. The CLI polls until the card is saved.

→ Spend limit: $1.00 per call

Open this URL in your browser to enter your card details:

  https://checkout.stripe.com/c/pay/...

Waiting for card setup to complete...

✓ Card linked
  cardholder   CHOI YOON IL
  method       card
  last4        6880
  exp          05/2029
  spend_limit  $1.00 per call
  currency     USD

pay status

bash

cpctl pay status

  last4        6880
  type         card
  spend_limit  $1.00 per call
  currency     USD
  active       yes

pay authorize

Generate a short-lived payment token for a specific API call. The card is charged immediately when you run this command.

bash

cpctl pay authorize <service> <amount> [--action deploy]

bash

cpctl pay authorize my-api 0.10

✓ Payment authorized
  token       mpp_tok_xxxxxxxxxxxxxxxxxxxx...
  service     my-api
  amount      $0.10 USD
  action      deploy
  expires_at  2026-07-27T12:05:00Z
  charged     yes — card charged
  stripe_pi   pi_3Rxxxxxxxxxxxxxxxxxxxxxxxx

Use this token with your next deploy:
  cpctl deploy --image <image> --name my-api --pay-token mpp_tok_xxxxxxxxxxxxxxxxxxxx...

The token expires in 5 minutes. Pass it via --pay-token:

bash

cpctl deploy --image nginx:latest --name my-api --pay-token mpp_tok_...

pay history

bash

cpctl pay history [--limit 20]

ID                  SERVICE   ACTION   AMOUNT   STATUS    STRIPE PI                        CHARGED AT
pay_xxxxxxxxxxxx    my-web    deploy   $0.50    settled   pi_3Rxxxxxxxxxxxxxxxxxxxxxxxx    2026-07-27T07:01:10Z

Flags

Flag	Default	Description
`--method`	—	`card` (required for setup)
`--limit`	`1.00`	Per-call spend limit in USD
`--action`	`deploy`	Action being authorized: `deploy`, `start`, `domain-add`

Sandboxes

Sandboxes are ephemeral GPU environments for short-lived experiments, fine-tuning runs, and interactive sessions:

bash

cpctl sandbox create               # create a sandbox
cpctl sandbox list                 # list active sandboxes
cpctl sandbox exec <id> -- <cmd>   # run a command inside a sandbox
cpctl sandbox status <id>          # show sandbox health and resources
cpctl sandbox destroy <id>         # destroy a sandbox

sandbox create

bash

cpctl sandbox create \
  --image pytorch/pytorch:2.3-cuda12.1 \
  --gpu rtx4090 \
  --gpu-count 1 \
  --timeout 2h

Flag	Default	Description
`--image <image>`	—	Docker image to run (required)
`--gpu <type>`	`rtx4090`	GPU type: `rtx4090`, `rtx5090`
`--gpu-count <n>`	`1`	Number of GPUs
`--region <region>`	—	Region to place the sandbox in
`--timeout <d>`	`1h`	Maximum runtime before auto-destroy

sandbox exec

bash

cpctl sandbox exec <id> -- python /workspace/train.py
cpctl sandbox exec <id> -- bash

Utility

Open documentation

bash

cpctl docs

Opens docs.computeportal.io in your default browser.

Upgrade the CLI

bash

cpctl upgrade

Fetches the latest binary from the CP API and atomically replaces the running binary.

current   v0.3.0
latest    v0.3.1
Downloading https://install.computeportal.io/releases/v0.3.1/cpctl-darwin-arm64...
✓ Upgraded to v0.3.1

Uninstall the CLI

Remove cpctl from your machine:

bash

cpctl uninstall

Also remove credentials and config (~/.cp):

bash

cpctl uninstall --purge

Skip the confirmation prompt:

bash

cpctl uninstall --purge --yes

Tip: run cpctl logout first to revoke your API token server-side before uninstalling.

You can also uninstall without the CLI using the uninstall script:

bash

curl -fsSL https://install.computeportal.io/uninstall.sh | sh

# With --purge to also remove ~/.cp
curl -fsSL https://install.computeportal.io/uninstall.sh | sh -s -- --purge

Flag	Description
`--purge`	Also remove `~/.cp` (credentials and config)
`--yes`	Skip confirmation prompt

Version

bash

cpctl version
# cpctl version v0.3.0

Configuration Files

cp.json

The project configuration file, created by cpctl init:

json

{
  "project": "my-inference-api",
  "image": "myorg/inference:latest",
  "region": "eu-west",
  "replicas": 2,
  "resources": {
    "cpu": 4,
    "memory": "16g",
    "gpu": "rtx5090"
  },
  "env": {
    "LOG_LEVEL": "info"
  },
  "domains": ["api.example.com"]
}

When cpctl deploy is run without --image or --repo, it reads cp.json automatically.

.cp-link

Written by cpctl link and cpctl environment switch. Stores the linked service and active environment:

json

{
  "service": "my-inference-api",
  "environment": "production"
}

Add .cp-link to .gitignore if different team members link different environments.

Environment Variables

Variable	Description
`CP_API_TOKEN`	API token — takes precedence over stored credentials
`CP_API_URL`	Override the API base URL (for self-hosted or regional endpoints)

CI/CD Integration

GitHub Actions

yaml

- name: Deploy to Compute Portal
  env:
    CP_API_TOKEN: ${{ secrets.CP_API_TOKEN }}
  run: |
    cpctl login --token "$CP_API_TOKEN"
    cpctl deploy --image ${{ env.IMAGE_TAG }} --region eu-west --wait

IaC deploy workflow

yaml

- name: Install cpctl
  run: curl -fsSL https://install.computeportal.io | sh

- name: Apply infrastructure
  env:
    CP_API_TOKEN: ${{ secrets.CP_API_TOKEN }}
  run: |
    cpctl login --token "$CP_API_TOKEN"
    cpctl iac up --dry-run --file environments/production/cp.yaml
    cpctl iac up --yes --file environments/production/cp.yaml

Docker build + deploy

bash

docker build -t myorg/inference:$SHA .
docker push myorg/inference:$SHA
cpctl deploy --image myorg/inference:$SHA --wait

Blue-green with rollback

bash

cpctl deploy --image myorg/inference:v2.0.0

# Verify
cpctl status my-inference-api

# Roll back if needed
cpctl rollback my-inference-api

Complete Command Reference

Command	Description
`cpctl login`	Authenticate with Compute Portal
`cpctl logout`	Log out and revoke credentials
`cpctl whoami`	Show current authenticated user
`cpctl init`	Interactively create `cp.json`
`cpctl link <service>`	Link directory to a service
`cpctl link <svc-a> <svc-b>`	Wire two services together (injects each other's URLs)
`cpctl unlink`	Remove `.cp-link`
`cpctl open [service]`	Open service URL in browser
`cpctl list`	List all services
`cpctl deploy`	Deploy a service (image, repo, or cp.json)
`cpctl redeploy <service>`	Re-trigger current deployment
`cpctl rollback <service> [id]`	Roll back to a previous deployment
`cpctl machine list`	List services with replica counts
`cpctl machine start <name>`	Start a service
`cpctl machine stop <name>`	Stop a service
`cpctl machine restart <name>`	Restart a service
`cpctl machine destroy <name>`	Permanently destroy a service
`cpctl machine status <name>`	Show service health
`cpctl logs <name>`	Stream service logs (`--follow`, `--build`)
`cpctl status [name]`	Show platform health or per-service status
`cpctl scale <name>`	Scale replicas, resources, or HPA
`cpctl exec <name> -- <cmd>`	Run command inside container
`cpctl ssh <name>`	Open interactive shell in container
`cpctl ps`	List running services across all nodes
`cpctl env set <service>`	Set environment variables
`cpctl env list <service>`	List environment variables
`cpctl env unset <service>`	Remove environment variables
`cpctl env copy <src> <dst>`	Copy env vars between services
`cpctl variable`	Alias for `cpctl env`
`cpctl environment list`	List environments
`cpctl environment create`	Create an environment
`cpctl environment delete`	Delete an environment
`cpctl environment switch`	Switch active environment
`cpctl deployment list <service>`	List deployment history
`cpctl deployment status <service> <id>`	Show deployment details
`cpctl domain add <service> <domain>`	Attach custom domain
`cpctl domain list <service>`	List domains
`cpctl domain status <service> <domain>`	Check domain/TLS status
`cpctl domain remove <service> <domain>`	Remove domain
`cpctl volume list [service]`	List volumes
`cpctl volume add <service> <path>`	Attach a volume
`cpctl volume delete <service> <name>`	Delete a volume
`cpctl volume browse <service>`	Open interactive shell to browse volumes
`cpctl volume download <service> <remote> [local]`	Download file from container
`cpctl volume upload <service> <local> <remote>`	Upload file to container
`cpctl db create <type>`	Create a managed database
`cpctl db list`	List databases
`cpctl db url <name>`	Print connection URL
`cpctl db attach <database> <service>`	Inject DATABASE_URL into a service
`cpctl db destroy <name>`	Destroy a database
`cpctl connect <name>`	Open interactive database shell
`cpctl bucket create <name>`	Create an S3 bucket
`cpctl bucket list`	List S3 buckets
`cpctl bucket credentials <name>`	Show bucket credentials
`cpctl bucket delete <name>`	Delete an S3 bucket
`cpctl service clone <src> <dst>`	Clone a service
`cpctl preview enable <service>`	Enable PR preview environments
`cpctl preview disable <service>`	Disable PR previews
`cpctl preview list <service>`	List active preview deployments
`cpctl iac init`	Generate `cp.yaml` from live services
`cpctl iac up`	Apply `cp.yaml` (supports `--dry-run`, `--yes`, `--file`)
`cpctl iac down`	Destroy resources defined in `cp.yaml`
`cpctl deploy-hook create <service>`	Create an inbound deploy hook
`cpctl deploy-hook list <service>`	List deploy hooks
`cpctl deploy-hook delete <service> <id>`	Delete a deploy hook
`cpctl webhook create <url>`	Register an outbound webhook
`cpctl webhook list`	List outbound webhooks
`cpctl webhook delete <id>`	Delete an outbound webhook
`cpctl firewall add <service>`	Add firewall rule (`--deny` or `--allow`)
`cpctl firewall list <service>`	List firewall rules
`cpctl firewall remove <service> <id>`	Remove a firewall rule
`cpctl firewall off <service>`	Remove all firewall rules
`cpctl configmap create <name>`	Create a config map from file(s) (`--from-file` required)
`cpctl configmap list`	List config maps
`cpctl configmap delete <name>`	Delete a config map
`cpctl expose <service> --port <n>`	Expose a service port over raw TCP at `tcp.cpctl.app:<port>`
`cpctl expose list <service>`	List exposed TCP ports
`cpctl expose delete <service> <port>`	Remove a TCP expose
`cpctl tcp-proxy create <service>`	Create a TCP proxy (`--port` required)
`cpctl tcp-proxy list <service>`	List TCP proxies
`cpctl tcp-proxy delete <service> <port>`	Delete a TCP proxy
`cpctl static-ip enable <service>`	Enable static outbound IP
`cpctl static-ip show <service>`	Show static IP
`cpctl static-ip disable <service>`	Release static IP
`cpctl invite create`	Issue single-use agent invitation token
`cpctl invite list`	List active invitation tokens
`cpctl invite revoke <id>`	Revoke a pending invitation
`cpctl quota`	Show compute quota usage
`cpctl metrics <service>`	View service metrics
`cpctl gpu list`	List GPU inventory
`cpctl gpu status <service>`	Show GPU utilization
`cpctl gpu reserve`	Reserve GPU capacity
`cpctl gpu run`	Run a one-shot GPU job
`cpctl node list`	List bare-metal nodes
`cpctl node inspect <id>`	Show node hardware specs
`cpctl node reserve <id>`	Reserve a node for dedicated use
`cpctl node release <id>`	Release a reserved node
`cpctl region list`	List regions with compliance certs
`cpctl region verify <service>`	Confirm data residency
`cpctl policy set`	Set org-wide data residency policy
`cpctl github pat <token>`	Store GitHub PAT for private images
`cpctl apikey create`	Create a scoped API key (`--label` required, `--limit`, `--expires`)
`cpctl apikey list`	List all API keys with spend status
`cpctl apikey revoke <id>`	Revoke an API key immediately
`cpctl billing balance`	Show current balance and burn rate
`cpctl billing topup init`	Get a deposit address for crypto top-up
`cpctl billing topup verify`	Submit transaction ID to confirm top-up
`cpctl billing usage`	Show itemized spend
`cpctl billing alert`	Set a low-balance alert threshold
`cpctl billing history`	Show invoice history
`cpctl pay setup`	Link a card for per-call machine payments
`cpctl pay status`	Show linked payment method
`cpctl pay authorize <service> <amount>`	Pre-authorize a per-call charge
`cpctl pay history`	List per-call payment charges
`cpctl sandbox create`	Create an ephemeral GPU sandbox
`cpctl sandbox list`	List sandboxes
`cpctl sandbox exec <id> -- <cmd>`	Run command inside a sandbox
`cpctl sandbox status <id>`	Show sandbox health
`cpctl sandbox destroy <id>`	Destroy a sandbox
`cpctl docs`	Open documentation in browser
`cpctl upgrade`	Upgrade the CLI
`cpctl uninstall`	Remove cpctl binary (`--purge` to also remove `~/.cp`)
`cpctl version`	Print CLI version

cpctl CLI ​

Installation ​

Authentication ​

Login with API token ​

Logout ​

Show current user ​

Global Flags ​

Project Setup ​

Initialize a project ​

Link a directory to a service ​

Link two services together ​

Unlink ​

Open a service in the browser ​

List all services ​

Deploy ​

Private GitHub repos ​

Deploy flags ​

--no-probe flag ​

Deploy output ​

.env.example scanning ​

Service Lifecycle ​

machine status ​

machine destroy ​

Logs ​

Status ​

Scale ​

Manual scaling ​

Autoscaling (HPA) ​

Exec & SSH ​

exec — run a command inside a container ​

ssh — open a shell in a container ​

Processes ​

Environment Variables ​

Set variables ​

Reference another service's URL ​

Auto-injected variables ​

List variables ​

Remove variables ​

variable (alias) ​

Environments ​

Switch environment ​

Deployment History ​

Redeploy ​

Rollback ​

Custom Domains ​

domain add ​

domain status ​

Volumes ​

volume browse ​

volume download / upload ​

Databases ​

Create a database ​

List databases ​

Get connection URL ​

Attach a database to a service ​

Destroy a database ​

Interactive database shell ​

Object Storage ​

bucket create ​

bucket credentials ​

Service Cloning ​

Clone a service ​

Copy env vars between services ​

Preview Environments ​

preview enable ​

Infrastructure as Code ​

iac init ​

iac up ​

cp.yaml schema ​

iac flags ​

Webhooks & Hooks ​

Deploy Hooks (inbound) ​

Outbound Webhooks ​

Firewall ​

Config Maps ​

configmap create ​

configmap list ​

configmap delete ​

TCP Expose ​

expose ​

cpctl CLI

Installation

Authentication

Login with API token

Logout

Show current user

Global Flags

Project Setup

Initialize a project

Link a directory to a service

Link two services together

Unlink

Open a service in the browser

List all services

Deploy

Private GitHub repos

Deploy flags

--no-probe flag

Deploy output

.env.example scanning

Service Lifecycle

machine status

machine destroy

Logs

Status

Scale

Manual scaling

Autoscaling (HPA)

Exec & SSH

exec — run a command inside a container

ssh — open a shell in a container

Processes

Environment Variables

Set variables

Reference another service's URL

Auto-injected variables

List variables

Remove variables

variable (alias)

Environments

Switch environment

Deployment History

Redeploy

Rollback

Custom Domains

domain add

domain status

Volumes

volume browse

volume download / upload

Databases

Create a database

List databases

Get connection URL

Attach a database to a service

Destroy a database

Interactive database shell

Object Storage

bucket create

bucket credentials

Service Cloning

Clone a service

Copy env vars between services

Preview Environments

preview enable

Infrastructure as Code

iac init

iac up

cp.yaml schema

iac flags

Webhooks & Hooks

Deploy Hooks (inbound)

Outbound Webhooks

Firewall

Config Maps

configmap create

configmap list

configmap delete

TCP Expose

expose