> ## Documentation Index > Fetch the complete documentation index at: https://docs.nerves-hub.org/llms.txt > Use this file to discover all available pages before exploring further. # nh Command Reference > Full reference for every nh CLI subcommand: user, org, product, device, firmware, deployment, key, ca, script, config, and migrate commands with flags. The `nh` CLI provides a subcommand for every NervesHub resource — organizations, products, devices, firmware, deployment groups, signing keys, CA certificates, and more. Every command and subcommand accepts `--help` to print detailed usage, available flags, and examples directly in your terminal. ## User Commands Manage your NervesHub identity and session. ```bash theme={null} nh user auth # Log in and store a session token nh user login # Browser-based login nh user logout # Log out and clear stored credentials nh user whoami # Show the currently authenticated user ``` ## Organization Commands List, inspect, and manage members of your NervesHub organizations. ```bash theme={null} nh org list # List all organizations you belong to nh org show [name] # Show details for an organization nh org members [name] # List all members of an organization nh org member # Show details for a single member nh org invite # Invite a user to the organization nh org set-role # Change a member's role nh org remove-member # Remove a member from the organization ``` Organization roles (in decreasing order of permissions): `admin`, `manage`, `view`. | Role | Grants | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `admin` | Everything `manage` can do, plus organization settings, inviting and removing members, and managing certificate authorities | | `manage` | Create, modify, and delete products, devices, firmware, deployment groups, signing keys, and support scripts; reboot, reconnect, and console a device | | `view` | Read-only access to the organization's resources, plus permission to run existing support scripts | Inviting members and changing roles requires the `admin` role. ## Product Commands Create and manage products within your organization. A product groups a fleet of devices that share the same firmware lineage. ```bash theme={null} nh product list # List all products in the current org nh product show # Show details for a product nh product create # Create a new product nh product delete # Delete a product ``` ## Device Commands Manage individual devices, trigger remote actions, access consoles, and view logs. ```bash theme={null} nh device list # List all devices in the current product nh device show # Show details for a device nh device create # Register a new device nh device update # Update device metadata nh device delete # Remove a device nh device upgrade # Push a specific firmware version to a device nh device move # Move a device to a different product nh device reboot # Send a reboot command nh device reconnect # Force the device to reconnect to NervesHub nh device clear-penalty # Clear a device's update failure penalty ``` ### Remote Access ```bash theme={null} nh device console # Open a remote IEx console session nh device shell # Open a remote shell session nh device iroh-console # Open a console via Iroh P2P (no server relay) ``` ### Logs ```bash theme={null} nh device logs [flags] ``` | Flag | Description | | ---------- | ----------------------------------------------------- | | `--level` | Filter by log level (e.g. `error`, `warning`, `info`) | | `--search` | Full-text search within log messages | | `--since` | Show logs after this timestamp | | `--before` | Show logs before this timestamp | | `--limit` | Maximum number of log lines to return | | `-f` | Follow (stream) logs in real time | ### Remote Code Execution ```bash theme={null} nh device run-code # Evaluate an Elixir expression on the device nh device scripts # List saved scripts available for this device nh device run-script # Execute a saved script on the device ``` ### Network Identities and Certificates ```bash theme={null} nh device network-identities # List network identities for a device nh device certificates list # List device certificates nh device certificates show # Show a specific certificate nh device certificates delete # Delete a certificate nh device certificates generate # Generate a new device certificate nh device certificates upload # Upload an existing certificate ``` ## Firmware Commands Upload, inspect, download, and delete firmware artifacts. Firmware files use the fwup `.fw` format and are signed before upload. ```bash theme={null} nh firmware list # List all firmware for the current product nh firmware show # Show details and metadata for a firmware artifact nh firmware download # Download a firmware file by UUID nh firmware delete # Delete a firmware artifact ``` ### Upload Firmware ```bash theme={null} nh firmware upload [path] ``` `upload` is also available as `nh firmware publish`. Key flags: | Flag | Description | | ---------------------------- | ------------------------------------------------------------------------- | | `--deploy ` | Create a release on an existing deployment group immediately after upload | | `--key ` | Name of the signing key to use when signing the firmware | | `--skip-signing` | Upload firmware that is already signed; skip the signing step | If no `path` is provided, `nh firmware upload` looks for a `.fw` file in the current directory. When `--key` is omitted, the key configured in your CLI settings or `NERVES_HUB_FW_PRIVATE_KEY` is used. ## Deployment Group Commands Deployment groups target a subset of devices (by tag and version condition) and control how firmware rolls out, including concurrency limits and failure thresholds. The CLI still spells the command `deployment`. ```bash theme={null} nh deployment list # List all deployment groups for the current product nh deployment show # Show group configuration and status nh deployment create # Create a new deployment group nh deployment update # Update group settings (tags, version, limits, state) nh deployment delete # Delete a deployment group ``` ## Signing Key Commands Firmware signing keys are managed per-organization. A public key is stored in NervesHub; the private key never leaves your machine. ```bash theme={null} nh key list # List all signing keys for the current org nh key show # Show details for a signing key nh key create # Generate and register a new signing key pair nh key delete # Remove a signing key from the org ``` ## CA Certificate Commands CA certificates are used to bootstrap device identity through mutual TLS (mTLS). Devices that present a certificate signed by a registered CA are automatically authenticated. ```bash theme={null} nh ca generate # Generate a new CA certificate and private key nh ca upload [name] # Upload an existing CA certificate to the current org nh ca list # List all CA certificates registered with the org nh ca show # Show details for a CA certificate by serial number nh ca delete # Remove a CA certificate ``` CA certificate commands require the `admin` role. ## Iroh P2P Endpoint Commands Iroh endpoints enable direct peer-to-peer device connections without routing traffic through the NervesHub server — useful for low-latency console access or large file transfers. ```bash theme={null} nh iroh-endpoint list # List all registered Iroh endpoints nh iroh-endpoint register # Register a device as an Iroh endpoint nh iroh-endpoint show # Show Iroh endpoint details for a device nh iroh-endpoint delete # Remove an Iroh endpoint registration ``` ## Script Commands Scripts are reusable Elixir code snippets stored in NervesHub that can be executed on devices remotely. ```bash theme={null} nh script list # List all saved scripts for the current product nh script show # Show a script's content and metadata nh script create # Create a new script (opens an editor) nh script update # Update an existing script nh script delete # Delete a script ``` Creating, updating, and deleting scripts requires `manage`. Running an existing script only requires `view`. ## Config Commands Read and write the `nh` CLI configuration, and manage named profiles for switching between environments. ```bash theme={null} nh config get # Print the full current configuration nh config set # Set a configuration value nh config unset # Remove a configuration value (revert to default) nh config save # Save current config to a named profile nh config load # Load a previously saved profile nh config profiles # List all saved profiles ``` ## Migration ```bash theme={null} nh migrate # Import settings and signing keys from the Elixir CLI ``` Run `nh migrate` once if you previously used the Elixir `nerves_hub_cli`. It reads that CLI's data directory (`~/.nerves-hub`, or `$NERVES_HUB_HOME`) and copies your saved defaults, API token, and signing keys into `nh`'s own data directory. Signing keys are re-encoded rather than decrypted, so no key password is required and password-protected keys keep theirs. *** Run `nh --help` or `nh --help` at any time to see full flag documentation, argument descriptions, and usage examples for that specific subcommand. Every `nh` command supports `--output json` (or `-o json`) for machine-readable output. Use this flag when integrating `nh` into scripts, CI pipelines, or tooling that needs to parse the response programmatically.