Clever Tools (CLI)

Clever Tools is the command line interface (CLI) of Clever Cloud. You can use it to create and manage multiple services of the platform as applications, databases or storage add-ons. It also provides easy authenticated access to Clever Cloud public APIv2 and APIv4 through the clever curl command. It’s an easy to set up multiplatform and open source tool, based on Node.js.

You can contribute to it through issue or pull requests. Ask for new features, enhancements or help us to provide them to our community.

Use Clever Tools through npx or npm exec for one-off usage or in CI/CD pipelines for example:

# Set/Export CLEVER_TOKEN and CLEVER_SECRET to login with a given account
# --yes is used to skip the interactive prompts
npx --yes clever-tools@latest version
npm exec -- clever-tools@3.14 profile --format json

You’ll find below the first commands to know to connect Clever Tools to your account, get its information and manage some options. Others are developed in dedicated pages:

Install

Create and manage add-ons

Create and manage applications

Kubernetes

Manage KV stores

Manage logs and drains

Network Groups

Notifications and webhooks

Operators (managed services)

Profiles and overrides

Service dependencies

basic commands

To show Clever tools available commands, use:

clever
clever help

For each of them, you can add these parameters:

[--help, -?]            Display help about this program (default: false)
[--version, -V]         Display the version of this program (default: false)
[--color]               Choose whether to print colors or not. You can also use --no-color (default: true)
[--update-notifier]     Choose whether to use update notifier or not. You can also use --no-update-notifier (default: true)
[--verbose, -v]         Verbose output (default: false)

Tip

For commands returning a list of items, you can use --format json or -F json to get a JSON output.

TLS certificates (corporate proxy / custom CA)

Clever Tools verifies the TLS certificate of every HTTPS connection it makes, both for API calls and for Git-based deployments. Behind a corporate proxy that intercepts HTTPS, or when your endpoint relies on a private or self-signed Certificate Authority (CA), this verification can fail with an error such as:

Error: self signed certificate in certificate chain

The right fix is to make Clever Tools trust your CA, not to disable verification. There are two ways to do it, depending on whether your CA is installed system-wide or only available as a file.

Trust your operating system’s certificate store

If your corporate or proxy root CA is installed at the OS level (Windows Certificate Store, macOS Keychain, Linux /etc/ssl/certs), Clever Tools can rely on it. The binary already trusts the OS certificate store, there is nothing to do. The npm package runs on your own Node.js, so enable it explicitly:

NODE_OPTIONS=--use-system-ca clever profile

If the CA isn’t in the OS store yet, ask your IT team to install it there: other tools relying on the OS certificate store then trust it too, not only Clever Tools.

Trust a specific certificate

When the CA is only available as a file, set the NODE_EXTRA_CA_CERTS environment variable to its path. This works the same way for both the binary and npm installs. The file must be PEM-encoded and may contain several certificates:

export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem
clever profile

Node.js reads NODE_EXTRA_CA_CERTS and NODE_OPTIONS at startup: set them in your shell, or inline before the command, not in a .env file.

Git-based deployments

clever deploy pushes over HTTPS and verifies certificates too. By default, it delegates to your system git binary, which ignores NODE_EXTRA_CA_CERTS and follows its own TLS configuration: the OS certificate store (recommended), or an explicit CA file set with git config --global http.sslCAInfo /path/to/corporate-ca.pem, equivalent to the GIT_SSL_CAINFO environment variable.

If you fall back to the previous JavaScript Git implementation (clever features disable system-git), Clever Tools handles Git operations on Node.js instead. It then trusts the OS certificate store and NODE_EXTRA_CA_CERTS exactly like API calls.

Keep TLS verification enabled, and install your CA in the trust store each client uses: the OS certificate store for the binary, the same store with NODE_OPTIONS=--use-system-ca for npm installs, and the store or CA file configured for your system Git, depending on its TLS backend. Disabling TLS verification entirely, for example with NODE_TLS_REJECT_UNAUTHORIZED=0, exposes you to man-in-the-middle attacks, including the theft of your Clever Cloud credentials.

HTTP proxy

On a network where outgoing traffic must go through an HTTP proxy, Clever Tools follows the http_proxy and https_proxy environment variables. Set them in your shell, and Clever Tools routes its API calls and update checks through the proxy:

export http_proxy=http://proxy.example.com:3128
export https_proxy=http://proxy.example.com:3128
clever profile

Clever Tools also recognizes the uppercase variants, HTTP_PROXY and HTTPS_PROXY. For a proxy that requires authentication, set credentials in the URL, such as http://user:password@proxy.example.com:3128. To bypass the proxy for some hosts, list them in the no_proxy (or NO_PROXY) variable:

export no_proxy=localhost,127.0.0.1,.internal.example.com

Like the TLS variables, Clever Tools reads proxy variables at startup: set them in your shell or inline before the command, not in a .env file. By default, clever deploy delegates to your system git, which follows its own proxy configuration: git config --global http.proxy, or the same http_proxy and https_proxy variables. The previous JavaScript Git implementation, used when you disable system-git, doesn’t go through this proxy.

features

Some features are available as experimental, before they’re completely ready for prime time. They usually work well, but this testing phase allows us to get feedbacks, refine some details, documentation, and break things between two releases.

Experimental features can be (de)activated on-demand. To list them, use:

clever features

To (de)activate an experimental feature, use:

clever features enable theFeature
clever features disable theFeature

To get information about how to use an experimental feature, use:

clever features info theFeature

A feature can also graduate to stable and become enabled by default, while you can still disable it. Since Clever Tools 5.0.0, it’s the case of system-git, which makes Git operations use the git installed on your system instead of a pure JavaScript implementation. Disable it if git isn’t available in your PATH:

clever features disable system-git

diag | version

To check the current version or get information about your setup, use:

clever version
clever diag
clever diag --format json

Note

Such information are nice to provide in your issues report or when you contact Clever Cloud technical support team.

login | logout

To connect to your Clever Cloud account, use:

clever login

It opens your default browser and starts an Open Authorization (OAuth) process to get a token and secret pair added in your account if it succeeds. You can manage it from the Console. Clever Tools automatically stores these token and secret values in a hidden clever-tools.json config file in the current local user home folder. If Clever Tools can’t open a browser, for example on a headless system, it prints a warning with the URL to open and keeps waiting for you to complete the login.

If you already know them, you can use:

clever login --secret SECRET --token TOKEN

Tip

If environment variables CLEVER_SECRET and CLEVER_TOKEN are set, Clever Tools will use them, login is not needed.

To log out, delete this file or use:

clever logout
clever logout --alias ALIAS

profile

To get information about the current logged-in user (ID, name, email, 2FA activation, etc.), use:

clever profile
clever profile open
clever profile -F json

To manage multiple profiles or configure per-profile overrides, see: Profiles and overrides

emails

To list primary email and secondary emails associated with your Clever Cloud account, you can use:

clever emails
clever emails -F json

To open the email management page in your browser, use:

clever emails open

To add a secondary email, use:

clever emails add email@example.com

To set a secondary email as primary, use:

clever emails primary email@example.com

To remove one or all secondary emails, use:

clever emails remove email@example.com
clever emails remove-all
clever emails remove-all --yes

ssh-keys

To list public SSH keys associated with your Clever Cloud account, you can use:

clever ssh-keys
clever ssh-keys -F json

To open the public SSH keys management page in your browser, use:

clever ssh-keys open

To add a new public SSH key, use:

clever ssh-keys add myPublicKey ~/.ssh/id_ecdsa.pub

To remove one or all public SSH keys, use:

clever ssh-keys remove myPublicKey
clever ssh-keys remove-all
clever ssh-keys remove-all --yes

curl

To use our public API, you need to be authenticated for most endpoints. If you’re logged in through Clever Tools, there is a simple way to make any request you want: clever curl. It’s curl, but in an authenticated context for Clever Cloud API.

tokens

You can query Clever Cloud public API with a bearer token thanks to the Auth Bridge. To create a token, use:

clever tokens create myTokenName
clever tokens create myTokenName --expiration 2w --format json

Once created, you can use it replacing the API endpoint with https://api-bridge.clever-cloud.com. For example:

curl https://api-bridge.clever-cloud.com/v2/self -H "Authorization: Bearer myToken"

To list all your tokens, use:

clever tokens
clever tokens -F json

To revoke a token, use:

clever tokens revoke myTokenId

Last updated on September 20, 2026