oxid up <branch> [--repo <url> --git-token <pat>]

Registers the repository (idempotent) and deploys branch: clone → build → inject secrets → run → route. Without --repo, registers the current directory (how a locally-run daemon sees your checkout). With --repo https://… the daemon clones the URL itself — how you register against a containerized daemon. Scp-style git@host:org/repo.git is normalized server-side; --git-token is stored encrypted for private repos. If the host is at capacity, the deploy is queued and retried automatically.

oxid up feature-login
[+] Environment live at: http://127.0.0.1:41253/
# against a containerized daemon:
oxid up main --repo https://github.com/you/app.git
oxid up main --repo https://github.com/you/private.git --git-token ghp_xxx

oxid rollback <branch> [--to <sha>]

Redeploys a branch at a prior commit. Without --to, rolls back to the deploy immediately before the current live one.

oxid pause <branch> · oxid wake <branch>

Manual scale-to-zero. pause suspends the container and returns its RAM; wake brings it back. With Traefik configured, the first HTTP request also wakes the environment on its own.

oxid down <branch> [--force] [--purge-secrets]

Destroys a branch's environment permanently. Asks for confirmation unless --force. Branch secrets are kept by default so a recurring branch's config survives a later redeploy; --purge-secrets removes them too.

oxid rm-project [--force]

Deletes the project registered for the current directory — every environment, its secrets and the daemon's git cache for the repo.

oxid status [--sort key] [--filter text]

Environments for the current project: one row per branch, latest deploy wins.

oxid ps [--sort] [--filter]

Every registered project across the daemon. Same flags, applied to project names.

oxid logs <branch> [-f]

Container logs for a branch. One-shot snapshot by default; -f attaches to the daemon's SSE stream and prints lines as they're written — a real live tail, not polling. Ctrl+C detaches without touching the container.

oxid logs -f feature-login
listening on 0.0.0.0:3000 ...

oxid audit [branch] [filters]

The audit trail — every deploy, pause, wake and destroy, with operator and timing. With branch: the full history of that one environment. Without: the most recent events across every project.

oxid queue

Deploys waiting for host capacity, oldest first. Non-empty means admission control is doing its job, not that something is broken.

oxid env set|list|delete

Environment variables with three resolution scopes — global, project, branch — resolved Global → Project → Branch at container start. Values are encrypted at rest (AES-GCM) and never shown back by list: names and scopes only.

oxid env set DATABASE_URL=postgres://... --scope project
oxid env set STRIPE_API_KEY=sk_... --scope branch --branch feature-login
oxid env list --scope project
oxid env delete STRIPE_API_KEY --scope branch --branch feature-login

oxid configure [--pause-after d] [--destroy-after d] [--git-token t]

Changes the current project's lifetime policy and private-repo access. oxid.toml only ever seeds these at first registration — later changes go through here and take effect on the next GC sweep, no redeploy.

oxid context add|use|list|current|remove

Named daemon contexts, persisted at ~/.config/oxid/config.toml. Switch once, stop repeating --api/--token. Purely local — no daemon round-trip.

oxid context add staging --api https://oxid.internal:8080 --token eyJ...
oxid context use staging
oxid context list          # tokens masked to their last 4 chars
oxid context remove staging --force

oxid doctor

Health check: daemon reachability, version, latency, and whether the configured token authenticates. The first thing to run when anything feels off.

oxid backup <file> · oxid restore <file>

Consistent snapshot of the daemon's database + secret key as a .tar. Restore stages the upload and applies it on the daemon's next restart — the live database is never touched in place. Restoring requires OXID_ALLOW_RESTORE=1 on the daemon (see Daemon).

oxid rotate-key

Rotates the master encryption key, re-encrypting every secret under a fresh one with zero downtime. Requires the master OXID_API_TOKEN.

oxid token create|list|revoke

Named API tokens for handing out access without sharing the master credential. Repeatable --project <id> scopes a token to those projects only — every other project answers 404, and node-wide operations (stats, infra, backups, token management) are rejected. Unscoped tokens keep full access; audit events attribute actions to the token's name. create prints the raw token once — it is never retrievable again. Requires the master token.

oxid token create ci-bot --project 1 --project 3
oxid token list
oxid token revoke 3

oxid infra status · oxid infra setup

Inspect/bootstrap the Docker network + built-in Traefik container that real wake-on-request scale-to-zero needs. setup is idempotent — an already-satisfied step is left untouched, safe to re-run.

oxid completions <shell>

Prints a completion script to stdout, for zsh, bash, fish and friends.

oxid completions zsh > ~/.zfunc/_oxid