This opens or prints a https://floom.dev/cli/authorize?code=... URL. Approve the code in the browser and the CLI receives a one-time Agent token, verifies it against the API, saves it to ~/.floom/config.json, and prints the MCP config snippet.

For a self-hosted instance that supports browser authorization:

floom setup --api-url http://localhost:3051

Manual token save remains available for automation and older hosts:

floom auth login --token=<agent_token> --api-url=http://localhost:3051

Other commands

floom auth <agent-token>     # save token non-interactively
floom auth login --token=... # validate token, then save config non-interactively
floom auth whoami            # print identity for current token
floom init --type custom     # scaffold the v0.1 app files: floom.yaml, app.py, schemas
floom deploy --dry-run       # validate the v0.1 app bundle without publishing
floom deploy                 # publish current floom.yaml as a live app
floom secrets set <slug> API_KEY --value-stdin # store encrypted app secrets
floom secrets list <slug>    # list app secret metadata only
floom run <slug> [json]      # run a Floom app by slug and wait for result
floom run <slug> --input k=v # pass repeatable key=value inputs
floom run <slug> --user-api-key $KEY # pass a BYOK key for gated launch apps
floom run <slug> --json      # print raw JSON
floom apps list [--json]     # list workspace apps
floom status [--json]        # list your v0.1 apps
floom account                # manage account context; app secrets use `floom secrets`
floom api GET /api/apps      # call raw API endpoints for advanced surfaces

v0.1 app shape

The launch v0.1 host accepts one Python file plus JSON Schema files, optional hashed requirements.txt, and encrypted app secrets:

mkdir my-floom-app && cd my-floom-app
npx @floomhq/cli@latest init --name "Meeting Notes" --slug meeting-notes-demo --description "Extract action items from notes." --type custom
npx @floomhq/cli@latest deploy --dry-run
npx @floomhq/cli@latest deploy
npx @floomhq/cli@latest run meeting-notes-demo '{"text":"Action: Sarah sends notes by Friday"}' --json

floom init --type custom writes:

floom.yaml
app.py
input.schema.json
output.schema.json

Dependency support requires exact pins with sha256 hashes:

dependencies:
  python: ./requirements.txt

Secrets are declared by name in floom.yaml and set after publish:

secrets:
  - GEMINI_API_KEY

printf '%s' "$GEMINI_API_KEY" | floom secrets set meeting-action-items GEMINI_API_KEY --value-stdin

The v0.1 creator publish path rejects multi-file Python apps, OpenAPI/FastAPI apps, TypeScript/Node apps, and stale manifest fields such as actions, visibility, and manifest_version.

floom run works without an Agent token for public apps that allow anonymous runs. Authenticated runs still use your saved Agent token when one is present.

Configuration

Variable	Default	Purpose
`FLOOM_API_URL`	`https://floom.dev`	API host
`FLOOM_CONFIG`	`~/.floom/config.json`	Config file location
`FLOOM_CLI_NO_BROWSER`	unset	Set to `1` to print login URLs without opening a browser
`FLOOM_USER_API_KEY`	unset	BYOK key forwarded as `X-User-Api-Key` for gated launch app runs

Agent-token management commands under floom account agent-tokens require a signed-in browser session on the server. Agent tokens are rejected for creating, listing, or revoking other Agent tokens; use the signed-in token page in a signed-in browser for that flow.

Command ownership

@floomhq/cli is the pure-Node CLI entrypoint. It requires Node.js 18 or newer and owns setup, auth, init, deploy, run, apps, status, secrets, account, api, and validate commands without shelling out to bash, curl, Python, or jq.

The npm package ships only the Node dist/ entrypoint plus this README. Legacy bash installers are not bundled in the launch package, so new users see one v0.1 surface.