---
title: CLI
category: concept
slug: cli
summary: "Deploy and manage Droplets from your terminal. Full surface for Droplets, Spaces, Groups, Skills, and the Shared Library."
---
# CLI

Deploy and manage Droplets from your terminal. Full surface for Droplets, Spaces, Groups, Skills, and the Shared Library.

The Drop CLI is the fastest way to interact with the platform from a terminal or a CI job. It mirrors the web UI's surface — anything you can do in the dashboard, you can do from `drop`.

The CLI uses OAuth 2.0 Authorization Code + PKCE against a dedicated Cognito app client. Sign in once with `drop login` and tokens auto-refresh.

## Install

```bash
curl -fsSL https://drop.himarley.ai/install-drop.sh | bash
```

## Sign in

```bash
drop login
```

This opens your system browser for Hi Marley SSO.

**Sign-in blocked by Jamf/device trust?** Use your company-managed browser instead of an embedded browser. If needed, run `drop login --no-browser`, open its URL in that browser, and paste the returned code into the waiting terminal. If it is still blocked, contact IT.

## Environment variables

- `DROP_TOKEN` and `DROP_SERVER` (default `https://drop.himarley.ai`) take priority over your saved login, the same as for the MCP server. Use them with an API token from **Settings → API tokens**, for CI or a script.
- Your saved login is only ever sent to the server it was saved for. Setting `DROP_SERVER` (or the older `DROP_API_BASE`) to another server without a `DROP_TOKEN` stops the command before anything is sent.
- **PR previews** (engineering): `eval "$(drop preview token <PR>)"` sets `DROP_SERVER` and `DROP_TOKEN` to a token that works only on that preview. `drop preview exec <PR> -- <command>` runs a command with them and an empty `HOME`, so the PR's own CLI or MCP server doesn't pick up your saved login. `drop login` refuses a PR preview server, because your login also works on production.

## Commands by category

- **Droplets** — `create`, `update`, `get`, `list`, `open`, `download`, `search`, `versions`, `rollback`, `drafts`, `publish`, `discard`, `unpublish`, `republish`, `patch`, `search-content`, `set`
- **Assets** — `assets upload`, `assets list`, `assets delete`
- **Sharing** — `shares list`, `shares create`, `shares delete`
- **Comments** — `comments create`, `comments list`, `comments get`, `comments resolve`, `comments unresolve`, `comments delete`, `comments thumbs-up`, `comments unthumbs-up`
- **Spaces** — `spaces list`, `spaces create`, `spaces get`, `spaces set`, `spaces delete`, `spaces add` (move Droplet in), `spaces remove`, `spaces members`, `spaces pin`, `spaces unpin`, `spaces archive`, `spaces unarchive`
- **Groups** — `groups list`, `groups create`, `groups get`, `groups set`, `groups delete`, `groups members`
- **Skills** — `skills list`, `skills create`, `skills install`, `skills feature`
- **Library** — `library list`, `library upload`, `library delete`
- **State** — `state get`, `state set`, `state import` (owner-only shared key/value read + write), `state list`, `state export`, `state reset`
- **PR previews** (engineering) — `preview open` (sign in to a PR's preview in your browser, or `--print` the link; `--as <persona>`, `--go <scenario>`), `preview token` (preview-only `DROP_SERVER`/`DROP_TOKEN` for `eval`), `preview exec` (run a command with them and an empty `HOME`). Your `drop login` goes only to the preview's `main` deployment, which mints the sign-in link. `preview open local` signs you in to the `npm run local` server of the checkout you're in (the checkout mints that link).
- **Sign-off** (decisions) — `signoff list`, `signoff get`, `signoff cast`, `signoff clear`, `signoff finalize`, `signoff reopen`, `signoff open`, `signoff close`, `signoff set-proposition`, `signoff mine` (list/inspect, weigh in on, undo your response, and open/close a [decision](/docs/decisions)'s sign-off)

Run `drop <command> --help` for full options on any subcommand.


## Operations

### drop create

Deploy a single-file Droplet. HTML and Markdown are both supported — file extension drives the choice. Auto-creates the Droplet if the slug is new; otherwise this is a rejected operation (use `drop update` to redeploy).

**CLI**

```bash
drop create app.html \
  --slug retro-2026-q2 \
  --name "Q2 retro" \
  --description "Quarterly retrospective board"
```

**MCP**

```json
{
  "tool": "drop_create",
  "arguments": {
    "name": "Q2 retro",
    "slug": "retro-2026-q2",
    "description": "Quarterly retrospective board",
    "content": "<!DOCTYPE html>..."
  }
}
```

**HTTP**

```bash
# Two-step: presigned URL then confirm
curl -X POST https://drop.himarley.ai/api/cli/deploy \
  -H "Authorization: Bearer $DROP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"slug": "retro-2026-q2", "name": "Q2 retro"}'
# → response includes uploadUrl
curl -X PUT "$UPLOAD_URL" --data-binary @app.html
# Then confirm:
curl -X POST https://drop.himarley.ai/api/apps/retro-2026-q2/confirm \
  -H "Authorization: Bearer $DROP_TOKEN"
```

### drop list

List your Droplets and ones shared with you. Pass `--space <slug>` to scope to one Space; `--shared` / `--mine` to pick a lane. Order with `--sort last_deployed_at|updated_at|created_at|name` (default `last_deployed_at`) + `--order desc|asc`, and cap with `--limit` (max 200). `updated_at` reflects any metadata edit; `last_deployed_at` only content redeploys.

**CLI**

```bash
drop list
drop list --space team-projects
drop list --shared
drop list --mine --sort updated_at --order desc --limit 10
```

**MCP**

```json
{
  "tool": "drop_list",
  "arguments": {
    "scope": "mine",
    "sort": "updated_at",
    "order": "desc",
    "limit": 10
  }
}
```

**HTTP**

```bash
curl https://drop.himarley.ai/api/cli/apps \
  -H "Authorization: Bearer $DROP_TOKEN"
```

### drop rollback

Roll back a Droplet to a previous version. The target version's content is copied to the live path and the CDN cache is invalidated. The previous live version remains in history as a separate row.

**CLI**

```bash
drop versions my-droplet
drop rollback my-droplet 5
```

**MCP**

```json
{
  "tool": "drop_rollback",
  "arguments": {
    "slug": "my-droplet",
    "version": 5
  }
}
```

**HTTP**

```bash
curl -X POST https://drop.himarley.ai/api/apps/my-droplet/versions/5/rollback \
  -H "Authorization: Bearer $DROP_TOKEN"
```