raff) is a single static binary that wraps the Raff public API for terminal use. Same API key auth as the dashboard, same role-based scoping, same resources — just driven from the command line. It’s the right tool for one-off operations, scripted workflows, and CI/CD pipelines.
For declarative infrastructure (commit your VM and project definitions to git), use Terraform instead. CLI is imperative; Terraform is declarative.
What you can do with the CLI
| Resource | Commands |
|---|---|
| Configure | raff configure — set API key, base URL, default project |
| Virtual Machines | raff vm — full lifecycle: create, delete, power, reboot, hard-reboot, reinstall, factory-reset, rename, reset-password, resize, resize-disk, save-image, plus IP / firewall / VPC attach-detach, tags, notes, networks |
| Volumes | raff volume — list, get, create, delete, resize, attach, detach |
| Snapshots | raff snapshot — list, get, create, rename, restore, delete |
| Backups | raff backup — backups + recurring schedules with retention |
| VPCs | raff vpc — list, get, create, update, delete, cidr-suggestions |
| Public IPs | raff ip — list, get, reserve, release, change |
| Firewalls | raff security-group — list, templates, get, create, update, delete |
| SSH Keys | raff ssh-key — register, list, rename, delete |
| API Keys | raff api-key — create, regenerate, revoke |
| Projects | raff project — list, get, create, update, delete + members |
| Members | raff member — account-level membership |
| Roles & Permissions | raff role, raff permission — IAM |
| Invitations | raff invitation — send + cancel |
| Catalog / lookup | raff region, raff template, raff pricing — discovery for required IDs |
--output json for parseable output (default is human-readable tables). Every command honors the same auth precedence: CLI flag > env var > config file.
Quick start
Authentication and configuration
The CLI looks for credentials in this order:- CLI flags (
--api-key,--api-url,--project-id) - Environment variables (
RAFF_API_KEY,RAFF_API_URL,RAFF_PROJECT_ID) - Config file (
~/.raff/config.yaml)
raff configure walks you through writing the config file. Multiple profiles are supported with --profile <name> so you can keep prod, staging, and dev credentials side-by-side.
For CI/CD where there’s no interactive shell, set RAFF_API_KEY and RAFF_PROJECT_ID as secrets and skip the config file entirely. See Configure for the full setup walkthrough.
Output formats
curl you can do with raff <command> --output json.
Cross-cutting flags
| Flag | What it does |
|---|---|
--api-url <url> | Override the API base URL — defaults to production |
--api-key <key> | Override the API key for this command |
--project-id <uuid> | Override the default project for this command |
-o, --output <format> | table (default) or json |
--profile <name> | Use a named profile from your config file |
--help | Show help for any command (raff vm --help, raff vm create --help, etc.) |
What’s covered
The CLI tracks the public API surface — everything in the API Reference is available through the CLI. Admin-only endpoints (admin-service has its own internal tooling) are not exposed; this is by design. Customer-facing parity is full.Where to go next
Install the CLI
Build from source, install via go, or grab a release binary.
Configure
Set up API key, profiles, and defaults.
VM commands
The full set of VM commands with examples.
Volume commands
Block storage management.
Backup commands
Backups + recurring schedules.
Project commands
Create and manage projects.