1
Run it
There is nothing to install for a one-off:
npx @trylath/cli fetches and runs it. Installed, the binary is lath.With no arguments it prints the whole command list — every operation, with the sentence describing what it does.2
Store a key
lath init writes the key to ~/.lath/config.json with mode 600, so it is not passed on every command and does not land in your shell history.LATH_API_KEY overrides the file, which is what CI should use — an empty value counts as unset, because a template that exports LATH_API_KEY="" is more common than one that unsets it. LATH_BASE_URL and LATH_CONFIG_DIR override the rest.Without a key you get no_key and the fix, not a stack trace.--key and --base-url belong to lath init and are not global flags. Passing --key to any other command is accepted and then ignored — it is stripped out rather than used to authenticate — so a one-off call under a different key wants the environment variable in front of it, not a flag after it.There is no live or test switch, because the environment is the key: a lath_live_ key acts on live and a lath_test_ key on test. Switching environments means running lath init again, or exporting the other key for one command.There is no lath login either. A key is the only way in. The device-code operations do exist, but they sign your users in on a device without a browser; they are not how the CLI authenticates itself.3
Call an operation
The shape is
lath <product> <name...> with one flag per field. --json takes the whole input at once, which is easier to generate and easier to paste from the reference.A field the registry declares as an array is repeatable: pass the flag more than once.Anything not retry-safe takes --idempotency-key, and the CLI tells you which those are.4
Ask the CLI instead of the docs
--help on any command prints that operation’s fields with their types, which are required, and any enum values — plus the three facts you need before calling it: whether it reads or writes, whether retrying is safe, and the permission the key must have.This is generated from the registry, so it is never out of date with the API in the way a written page can be.5
Errors, and exit codes
A refusal prints the code and message on stderr, then the fix on its own line after an arrow. The exit code is 1, so a CI step fails rather than continuing quietly. Below is a machine with no stored key and nothing in
LATH_API_KEY.The code is the same string the REST and MCP surfaces return, so a script can branch on it without parsing prose.6
An MCP server for a local agent
lath mcp runs an MCP server over stdio, which is how you attach a local agent that does not speak HTTP MCP — it uses the key the CLI already has, so there is no second credential to configure.The hosted endpoint is the other option and needs no install: POST https://platform.trylath.com/mcp.