CLI Quickstart

Install the Tork CLI, authenticate, wire up your project, and send your first governed request — all from the terminal.

npx @torknetwork/cli

brew install torkjacobs/tap/tork

The package is published as @torknetwork/cli on npm. Both methods give you the same tork binary.

tork login

? Paste your Tork API key: ****************************
✔ Key verified against https://tork.network
✔ Logged in as acme-corp (starter plan)
Credentials saved to ~/.tork/credentials.json

The key is entered at a masked prompt so it never appears in your terminal or shell history. You can also pass it directly:

tork login --key tork_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

In CI, set the TORK_API_KEY environment variable and every command authenticates without a login step:

# CI environments: skip the prompt entirely
export TORK_API_KEY=tork_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
tork test

tork init

✔ Detected stack: Next.js 15 + TypeScript
✔ Installed tork-governance
✔ Created tork.config.json
Your project is ready to be governed.

tork init inspects your project, detects the framework and language, installs the matching Tork SDK, and writes a tork.config.json you can commit:

{
  "apiUrl": "https://tork.network",
  "policy": "default",
  "pii": {
    "profile": "universal",
    "action": "redact"
  }
}

tork test

→ POST https://tork.network/api/v1/govern
  Synthetic PII payload: "Contact jane@example.com, SSN 123-45-6789"

✔ Decision:  redact
✔ Receipt:   rcpt_9f2e01ab (signed, verifiable)
✔ Latency:   87 ms

Governance is live. Every request now returns a signed receipt.

The test sends a synthetic PII payload through https://tork.network/api/v1/govern and reports the governance decision, the signed compliance receipt, and round-trip latency. If this passes, your integration is governed end to end.

tork doctor

Running 8 diagnostic checks...

✔ 1/8 Credentials file present
✔ 2/8 API key valid
✔ 3/8 https://tork.network reachable
✔ 4/8 /api/v1/govern responding
✔ 5/8 tork.config.json valid
✔ 6/8 SDK installed and version current
✔ 7/8 Receipt signature verification
✔ 8/8 Clock skew within tolerance

8/8 checks passed.

Use the --json flag for machine-readable output. The exit code makes it a natural CI gate: 0 when all checks pass, 1 when any check fails.

# Machine-readable output for CI pipelines
tork doctor --json

# Exit codes: 0 = all checks passed, 1 = one or more checks failed
tork doctor --json || echo "governance preflight failed"

tork whoami

key:      tork_****x9Qf (config file)
org:      acme-corp (verified just now)
base URL: https://tork.network
config:   ~/.tork/config.json

tork whoami verifies your key against the API on every run — the org line shows (verified just now) on success. If the API can't be reached, it falls back to the last known org and labels it explicitly as cached, so you always know whether you're looking at live or stale data.

tork logs

TIME                 ACTION     PII    LATENCY  RECEIPT
2026-07-15 09:41:22  redact       2      92 ms  …9f2e01ab3c7d5e12
2026-07-15 09:38:07  allow        0      61 ms  …b84d20cf6a91e344

Each line is one governance decision — the action taken, how many PII entities were involved, round-trip latency, and the tail of the receipt id. Backed by the receipts feed, so what you see here is what your auditors see.

tork logs --limit 50    # more history
tork logs --follow      # poll for new decisions every 5s (Ctrl+C to stop)
tork logs --json        # machine-readable output

tork usage

plan:      Starter
usage:     ██████░░░░░░░░░░░░░░░░░░  1240 / 5000 (24.8%)
remaining: 3760
period:    started 2026-07-01

Shows calls used against your plan limit, calls remaining, and when the current billing period started. Add --json for machine-readable output.

tork receipts

TIME                 ACTION     PII    LATENCY  RECEIPT
2026-07-15 09:41:22  redact       2      92 ms  …9f2e01ab3c7d5e12
2026-07-15 09:38:07  allow        0      61 ms  …b84d20cf6a91e344
2 of 3184 receipts

Pass a receipt id to fetch the full record — timestamp, action, PII types, and policy version — for a single governed request:

tork receipts tork_rcpt_1784112345678_9f2e01ab3c7d5e12

Never hardcode your API key in scripts and never commit it to a repository. The preferred form is the native --op flag, which resolves the key via the 1Password CLI at login time so it never touches your shell history:

tork login --op 'op://YourVault/Tork API Key/credential'

You can also inject the key at runtime from any secrets manager:

# 1Password CLI: the key is fetched at runtime and never written anywhere
TORK_API_KEY=$(op read 'op://YourVault/Tork API Key/credential') tork test

The identical pattern works with any secrets manager — HashiCorp Vault, AWS Secrets Manager, Doppler — feeding TORK_API_KEY. In CI, use your platform's secret store (e.g. GitHub Actions secrets) mapped to TORK_API_KEY.

You're Governed!

Your project now sends governed requests and receives signed receipts. Explore the SDK docs to go deeper, or watch activity arrive in your dashboard.

Quick Reference