Command reference

Every command in the CLI (209 in total), generated from --help and privy schema. Locally, privy cli search "your task" finds the right one.

Global options

Option	Description
--app <id>	App to act on. Overrides a privy.json binding and the saved selection.
--account <id>	Account (workspace) for account-scoped commands.
--profile <name>	Saved login profile. Otherwise PRIVY_PROFILE, the project binding, then default.
--no-project	Ignore privy.json in the current directory.
--json	JSON output. Already the default.

organizations

• privy organizations list: List app-scoped user organizations, not dashboard accounts.
• privy organizations get: Inspect an app-scoped user organization by exact ID.
• privy organizations delete: Delete an empty app organization using a stored app credential and exact-name confirmation.
• privy organizations create: Create an app-scoped organization with a default quorum and optional wallet bindings.
• privy organizations update: Update app organization name or default quorum and verify.
• privy organizations wallets list: List wallets associated with an app organization.
• privy organizations wallets add: Bind an unbound wallet to an organization; this association is one-way.

users

• privy users export: Export users as a private CSV file; requires --output and never overwrites files.
• privy users get: Inspect one user by exact ID using the dashboard search endpoint.
• privy users import: Create/import up to 20 users with linked accounts; reports per-record outcomes. No retries.
• privy users create: Create/import up to 20 users with linked accounts; reports per-record outcomes. No retries.
• privy users update: Update or clear a user display name and verify it.
• privy users delete: Permanently delete a user from this app; inspect associated wallets before deletion.
• privy users freeze: Freeze user access and revoke sessions; verify frozen_at.
• privy users restore: Restore a frozen user’s ability to authenticate; does not restore old sessions.
• privy users revoke-sessions: Revoke a user’s sessions without freezing future login.
• privy users unlink: Unlink one existing login account and verify its removal; refuses the last linked account.
• privy users imports list: Inspect bulk user-import jobs and their status.
• privy users imports get: Inspect one bulk-import job by exact ID.
• privy users imports create: Submit a bulk user-import job. Inspect its status with users imports list.
• privy users metadata set: Replace a user’s entire custom metadata using a stored app API credential.
• privy users metadata update: Shallow-merge user custom metadata using a stored app API credential.
• privy users count: Read application user counts and limits.
• privy users list: List or search user summaries; --full retains complete user records. Cursor-paginated.

wallets

• privy wallets archive: Archive an unowned server wallet: prevents writes/signing and hides it from default lists. Not deletion; no CLI restore.
• privy wallets archive-status: Inspect wallet archive status using a stored app credential, including hidden archived wallets.
• privy wallets get: Inspect one wallet by exact ID, including ownership, policy and optional balances.
• privy wallets create: Provision a wallet and verify it; does not fund, sign or transact.
• privy wallets update: Update wallet name or unowned-wallet controls; arrays replace existing settings.
• privy wallets transactions: Read onchain transaction history for one wallet; does not submit transactions.
• privy wallets actions get: Inspect one existing wallet action and its status.
• privy wallets exports list: List wallet CSV export jobs (not private-key exports).
• privy wallets exports get: Inspect a wallet CSV export job by exact ID.
• privy wallets exports download: Download a ready wallet CSV privately; never print the signed storage URL.
• privy wallets exports create: Start a wallet CSV export job, not a private-key export.
• privy wallets list: List or search wallet summaries; --full or --include-balance true retains complete rows.

transactions

• privy transactions list: Inspect app transaction/action history, optionally scoped to one wallet.

key-quorums

• privy key-quorums get: Inspect a key quorum by exact ID, including public members and threshold.
• privy key-quorums create: Register public authorization keys or existing quorums with an explicit threshold.
• privy key-quorums list: List authorization key quorums, not private keys.

approvals

• privy approvals list: List approval metadata and dashboard review links; never signs or executes proposals.
• privy approvals get: Inspect remote intent status and obtain a human-review link.
• privy approvals open: Open a proposal in the normal browser for human review; no automatic approval.

webhooks

• privy webhooks list: List configured webhook endpoints and their subscriptions.
• privy webhooks get: Inspect one webhook endpoint by exact ID.
• privy webhooks status: Inspect webhook endpoint health and last successful delivery.
• privy webhooks create: Register an HTTPS receiver you control; does not automatically retrieve its signing key.
• privy webhooks delete: Delete an endpoint and its remote signing key; requires exact URL confirmation.
• privy webhooks enable: Re-enable an endpoint disabled by delivery failures; does not resend past events.
• privy webhooks test: Request a test notification to one explicitly confirmed receiver.
• privy webhooks resend: Replay a message to an endpoint where delivery was previously attempted; may duplicate business actions.
• privy webhooks signing-key save: Retrieve an endpoint signing key directly into OS credential storage; never print it.
• privy webhooks subscriptions get: Inspect app-wide subscriptions across all configured endpoints.
• privy webhooks subscriptions update: Replace subscriptions for ALL endpoints in this app.
• privy webhooks history list: Inspect webhook delivery attempts with bounded pagination.
• privy webhooks history get: Inspect a webhook message payload by ID.
• privy webhooks watchlist get: Read chain/assets monitored for funding webhooks.
• privy webhooks watchlist update: Replace the app funding-webhook asset watchlist, independently of subscriptions.
• privy webhooks chains: List supported webhook chain-event pipelines.

credentials

• privy credentials list: List app API credential IDs, creation dates and access modes; never reveal key material.
• privy credentials create: Generate an app API secret with an explicit env, Keychain, both or none storage choice.
• privy credentials delete: Revoke one app API credential by ID and clear its local stored value.

clients

• privy clients get: Inspect a frontend app client by exact internal ID.
• privy clients create: Create a separate web/mobile frontend configuration sharing this app’s users and wallets.
• privy clients update: Update client origins, identity and app-user session settings; supports read-only diff.
• privy clients delete: Delete a frontend client configuration; app users and wallets remain shared and are not deleted.
• privy clients domains configure: Configure an owned HTTP-only cookie domain; DNS setup remains explicit.
• privy clients domains verify: Ask Privy to refresh DNS verification once; never fabricate ownership.
• privy clients domains delete: Remove a cookie domain with explicit confirmation of session impact.
• privy clients domains get: Inspect one client’s custom cookie-domain state; app inheritance is configured separately.
• privy clients telegram get: Read explicit Telegram bot configuration metadata without the bot secret.
• privy clients telegram update: Configure an app Telegram bot or client override; does not silently enable app login.
• privy clients telegram delete: Remove a Telegram client override; falls back to app settings or disables Telegram for that client.
• privy clients list: List application clients and their public SDK IDs.

domains

• privy domains configure: Configure an owned HTTP-only cookie domain; DNS setup remains explicit.
• privy domains verify: Ask Privy to refresh DNS verification once; never fabricate ownership.
• privy domains delete: Remove a cookie domain with explicit confirmation of session impact.
• privy domains get: Inspect app HTTP-only cookie domain and DNS status; this is not the allowed-origin list.

config

• privy config embedded-wallets get: Read app-user wallet creation-on-login and recovery configuration.
• privy config embedded-wallets update: Configure EVM/SVM creation on login; preserve recovery settings and verify read-back.
• privy config sessions get: Read app-user session and token lifetimes; not the CLI administrator session.
• privy config sessions update: Update app-user session/token lifetimes and verify each changed field.
• privy config ip-allowlist get: Read this app’s server-API IP restrictions; not a restriction on running the CLI.
• privy config ip-allowlist update: Replace app-secret server-API IP restrictions; may block existing backend consumers.
• privy config smart-wallets get: Read safe metadata for smart-wallets. Complete enabled smart-wallet configuration or enabled:false. Does not deploy wallets, contact a bundler, sign, transact or provision/fund sponsorship.
• privy config smart-wallets update: Configure smart-wallets. Complete enabled smart-wallet configuration or enabled:false. Does not deploy wallets, contact a bundler, sign, transact or provision/fund sponsorship.
• privy config captcha get: Read customer-app CAPTCHA protection; no challenge solving or dashboard-auth changes.
• privy config captcha update: Configure customer-app CAPTCHA protection; no challenge solving or dashboard-auth changes.
• privy config android-key-hashes get: Read Android app signing-certificate SHA-256 fingerprints (public metadata, not signing keys).
• privy config android-key-hashes update: Replace Android signing-certificate fingerprints with diff and fresh set verification.
• privy config advanced get: Inspect account-merging, wallet export/recovery and custom-auth settings without exposing keys or changing ownership.
• privy config account-merging get: Read same-email customer-account merging across login methods; not dashboard team membership.
• privy config account-merging update: Configure future same-email login linking with explicit identity-impact acknowledgement.
• privy config redirects get: Inspect redirects. Full OAuth redirect URL/path allowlist. Must match existing allowed origins; no implicit origin widening. [] clears path restrictions.
• privy config redirects update: Configure redirects. Full OAuth redirect URL/path allowlist. Must match existing allowed origins; no implicit origin widening. [] clears path restrictions.
• privy config key-export get: Inspect key-export. Block all wallet-key exports for this app. This configures export permission; never retrieves a key.
• privy config key-export update: Configure key-export. Block all wallet-key exports for this app. This configures export permission; never retrieves a key.
• privy config client-key-export get: Inspect client-key-export. Allow client-side wallet-key export. Account feature and nonlegacy wallet mode required; no actual export.
• privy config client-key-export update: Configure client-key-export. Allow client-side wallet-key export. Account feature and nonlegacy wallet mode required; no actual export.
• privy config privy-home get: Inspect privy-home. Allow customer key export through Privy Home. Not a wallet recovery operation; requires a supported Privy login method.
• privy config privy-home update: Configure privy-home. Allow customer key export through Privy Home. Not a wallet recovery operation; requires a supported Privy login method.
• privy config verification-key get: Read app token-verification public-key fingerprint; no signing/private key.
• privy config verification-key rotate: Rotate this app’s token-signing/verification key ONCE; not app API-secret rotation.
• privy config custom-jwt get: Inspect custom-JWT verifier and app/account eligibility without tokens or credential-bearing URLs.
• privy config custom-jwt configure: Replace custom-JWT trust configuration; stdin-only, no automatic account activation. --enable-auth explicitly permits initial app enablement.
• privy config custom-jwt enable: Enable an existing custom-JWT verifier for this app; immediate authentication impact.
• privy config custom-jwt disable: Disable an existing custom-JWT verifier for this app; immediate authentication impact.
• privy config custom-jwt flush-cache: Invalidate the external JWKS cache once; next verification fetches the document, not this CLI.

integrations

• privy integrations coinbase get: Read safe metadata for coinbase. Coinbase Onramp own credentials. Does not enable a funding method, start onboarding, buy assets or transfer funds.
• privy integrations coinbase update: Configure coinbase. Coinbase Onramp own credentials. Does not enable a funding method, start onboarding, buy assets or transfer funds.
• privy integrations kraken get: Read safe metadata for kraken. Complete Kraken Embed configuration; requires explicit provider environment and credentials. No purchases or transfers.
• privy integrations kraken update: Configure kraken. Complete Kraken Embed configuration; requires explicit provider environment and credentials. No purchases or transfers.
• privy integrations blockaid get: Read safe metadata for blockaid. Production-app-only cross-app scanning configuration; also requires an enabled verified cookie domain or non-private ecosystem. No production conversion, billing change, domain, account approval or publishing is performed implicitly.
• privy integrations blockaid update: Configure blockaid. Production-app-only cross-app scanning configuration; also requires an enabled verified cookie domain or non-private ecosystem. No production conversion, billing change, domain, account approval or publishing is performed implicitly.
• privy integrations walletconnect get: Read the public WalletConnect/Reown project ID configured for this app.
• privy integrations walletconnect update: Set or clear the WalletConnect project ID; preview/diff, environment guard and fresh read-back.

global-wallet

• privy global-wallet config get: Read safe metadata for ecosystem. Cross-app permissions/signup/custom frontend URLs. Availability/publishing and logo are not writable here; no account approval request.
• privy global-wallet config update: Configure ecosystem. Cross-app permissions/signup/custom frontend URLs. Availability/publishing and logo are not writable here; no account approval request.
• privy global-wallet availability get: Inspect cross-app wallet availability and publishing blockers; no activation or approval request.
• privy global-wallet availability update: Make this app available/unavailable as a cross-app wallet provider, after explicit eligibility and access-impact checks.
• privy global-wallet providers list: List safe providers metadata from the selected app; protected counterparts omitted, first 20 by default. Summary rows by default; --full includes icon/date metadata.
• privy global-wallet providers enable: Enable a wallet-provider connection. Requires --allow-access-change; may grant/revoke cross-app access.
• privy global-wallet providers disable: Disable a wallet-provider connection. Requires --allow-access-change; may grant/revoke cross-app access.
• privy global-wallet providers request: Request a wallet-provider connection. Requires --allow-access-change; may grant/revoke cross-app access.
• privy global-wallet requesters list: List safe requesters metadata from the selected app; protected counterparts omitted, first 20 by default.
• privy global-wallet requesters accept: Accept a requesting app connection. Requires --allow-access-change; may grant/revoke cross-app access.
• privy global-wallet requesters reject: Reject a requesting app connection. Requires --allow-access-change; may grant/revoke cross-app access.
• privy global-wallet logo get: Read the Global wallet connection logo; distinct from login branding logo_url.
• privy global-wallet logo upload: Upload a local PNG/JPEG/WebP as the Global wallet logo (max 8 MiB; original bytes/metadata are sent to public image hosting).
• privy global-wallet logo status: Check a pending CLI upload without exposing its signed URL or re-uploading bytes.
• privy global-wallet logo finalize: Attach an already-complete pending upload; never repeat the file transfer; refuse observed intervening logo changes.

providers

• privy providers get: Read builtin OAuth configuration metadata without revealing credentials.
• privy providers update: Configure builtin OAuth credentials/options; does not silently enable login.
• privy providers delete: Remove editable own OAuth configuration; shared/default fallback is provider-specific.
• privy providers custom list: List custom OAuth provider metadata, never credentials.
• privy providers custom create: Create an enabled, immutable custom OAuth provider; deletion may become unavailable after signup.
• privy providers custom enable: Enable or disable an existing custom OAuth provider.
• privy providers custom delete: Delete an editable unused custom OAuth provider; refuse when deletion is unavailable.
• privy providers telegram get: Read explicit Telegram bot configuration metadata without the bot secret.
• privy providers telegram update: Configure an app Telegram bot or client override; does not silently enable app login.
• privy providers telegram delete: Remove app Telegram bot configuration; can affect clients inheriting it.

access

• privy access get: Read app-user access-control mode, separate from server IP restrictions.
• privy access update: Select allowlist, denylist, or unrestricted app-user access; may block existing users.
• privy access allowlist list: Read allowlist entries using the observed non-cursor list API.
• privy access allowlist add: Add explicit identities to the allowlist; verify all entries.
• privy access allowlist remove: Remove selected allowlist entries and verify absence.
• privy access allowlist clear: Clear allowlist entries in an explicit scope; can change app access.
• privy access denylist list: Read denylist entries using the observed non-cursor list API.
• privy access denylist add: Add explicit identities to the denylist; verify all entries.
• privy access denylist remove: Remove selected denylist entries and verify absence.
• privy access denylist clear: Clear denylist entries in an explicit scope; can change app access.

accounts

• privy accounts features custom-jwt get: Inspect the account-wide custom-JWT capability and free-development eligibility.
• privy accounts features custom-jwt update: Explicitly enable/disable the account JWT capability in a free, all-development workspace; does not configure app authentication.
• privy accounts billing status: Read account plan and payment-method presence only; no card details or billing mutation.
• privy accounts get: Read one account summary and whether protected apps prohibit mutations.
• privy accounts members list: List account members; identities omitted unless explicitly requested.
• privy accounts members update: Change an account-wide member role; forbidden for accounts containing protected apps.
• privy accounts members remove: Remove a dashboard member only after protected-account, last-admin and quorum dependency checks.
• privy accounts invitations list: List account invitations; identities omitted unless explicitly requested.
• privy accounts invitations create: Invite a dashboard member; can send email and grants account-wide access after acceptance.
• privy accounts invitations revoke: Revoke a pending dashboard invitation by exact email.
• privy accounts list: List accessible dashboard accounts.

analytics

• privy analytics overview: Read the app analytics overview JSON.
• privy analytics users: Read users metrics with an optional time-grain filter.
• privy analytics logins: Read logins metrics with an optional time-grain filter.
• privy analytics wallet-types: Read wallet-types metrics with an optional time-grain filter.
• privy analytics daily: Read daily reporting with optional bounded calendar dates.
• privy analytics transaction-volume: Read transaction-volume reporting with optional bounded calendar dates.
• privy analytics assets-in-wallets: Read assets-in-wallets reporting with optional bounded calendar dates.
• privy analytics wallet-balances: Read delayed analytics wallet balances, optionally filtered by wallet addresses.
• privy analytics freshness: Read data-through date and staleness for an observed analytics dataset.
• privy analytics revenue: Read actual Revenue/Earn balances and earnings JSON; does not activate Earn.
• privy analytics vaults: Read configured Earn vaults; does not create a vault or deposit funds.
• privy analytics sponsorship: Read account gas-sponsorship statistics; no balance refill or configuration change.
• privy analytics wallets: Read wallet-count and asset-balance summary for an app.

apps

• privy apps list: List applications across accessible accounts, excluding locally protected apps.
• privy apps get: Inspect an application configuration.
• privy apps config get: Read application configuration, optionally one field.
• privy apps config update: Update application configuration and verify changed fields by reading them back.
• privy apps create: Create a new application in an account.
• privy apps delete: Permanently delete a development app and its users; requires explicit app ID and exact name confirmation.
• privy apps use: Select an app by ID or unambiguous name.
• privy apps protect: Locally block an app; does not change it remotely.

policies

• privy policies list: List or search authorization policies.
• privy policies get: Read one policy, including its rules and owner.
• privy policies create: Create a policy with optional initial rules and owner; empty rules default to deny. Does not attach wallets.
• privy policies update: Rename an unowned policy and verify the change.
• privy policies delete: Delete an unused, unowned policy; requires exact current name confirmation.
• privy policies rules get: Inspect one rule within a policy.
• privy policies rules create: Add a rule to an unowned policy and verify it by reading the policy.
• privy policies rules update: Replace a rule definition in an unowned policy; all four fields are required.
• privy policies rules delete: Remove a rule from an unowned policy and verify its absence.

auth

• privy auth login: Renew and verify a saved session first; use browser/email login only for a new or explicitly replaced session.
• privy auth status: Inspect local session expiry; optionally check remote access WITHOUT refreshing or changing credentials.
• privy auth whoami: Verify remote access and show current identity and accounts.
• privy auth refresh: Attempt one session renewal, persist it and verify remote dashboard access.
• privy auth logout: Revoke this session and remove local credentials, not all user sessions.

project

• privy project show: Show effective app/profile selection and directory binding without contacting Privy.
• privy project init: Write privy.json for the selected profile/app; no remote resource is created.

secrets

• privy secrets list: List nonsecret resource references for the selected app; no network or secret reads.
• privy secrets status: Check whether an app resource secret is stored locally; never reveal its value.
• privy secrets forget: Remove a local resource secret only; does not revoke it at Privy.
• privy secrets run: Explicitly give one stored secret to a TRUSTED child through its environment; child output is not redacted.

doctor

• privy doctor: Check runtime, browser, profile and credential-store access (no remote API requests).

schema

• privy schema: Describe the actual API request, inputs and behavior of a command.

cli

• privy cli search: Search commands locally; no credentials, network or model required.

docs

• privy docs read: Read one bundled Markdown guide as JSON; use docs for exact topic names.
• privy docs search: Search bundled guide contents locally; returns up to five matches.
• privy docs path: Locate the bundled guide directory or one exact topic file.