Kernel CLI

Kernel CLI

The Kernel CLI provides command-line access to Kernel's cloud browser platform for browser automation, serverless app deployment, and infrastructure management.

Installation

• Homebrew: brew install kernel/tap/kernel
• npm: npm install -g @onkernel/cli

Verify with kernel --version. Use kernel <command> --help as the source of truth for the installed version.

Authentication

• Preferred: Set KERNEL_API_KEY environment variable
• Fallback: Run kernel login for interactive OAuth

Quick Start

# Authenticate
export KERNEL_API_KEY=your_api_key

# Create a browser session
kernel browsers create -o json

# Run Playwright automation (use `return` to get a value back)
kernel browsers playwright execute <session_id> '
  await page.goto("https://example.com");
  return await page.evaluate(() => document.title);
'

# Take a screenshot
kernel browsers computer screenshot <session_id> --to screenshot.png

# Cleanup
kernel browsers delete <session_id>

Safe Operation

• Prefer -o json plus jq for scripts; deploy and invoke emit JSONL rather than one JSON object.
• Use --project <id-or-name> or KERNEL_PROJECT when an API key can access multiple projects.
• Keep confirmation prompts for destructive operations unless non-interactive execution is intentional.
• Delete created browser sessions and pools after testing. Never echo, log, commit, or share API keys, credentials, or proxy passwords.

Project, API Key, and Organization Administration

# Rename, archive, or reactivate a project (provide at least one update)
kernel projects update <id-or-name> --name <new-name> -o json
kernel projects update <id-or-name> --status archived -o json
kernel projects update <id-or-name> --status active -o json

# Look up a soft-deleted API key
kernel api-keys get <id> --include-deleted -o json

# Inspect limits before changing the default project cap
kernel org limits get -o json
kernel org limits set --default-project-max-concurrent-sessions <n> -o json

For org limits set, 0 removes the default cap; the value cannot exceed the organization concurrency limit.

Rotate an API key interactively with kernel api-keys rotate <id>. Use --days-to-expire <1-3650> to set the replacement key lifetime and --expire-in-days <n> to set the old key's grace period (default 7 days; 0 revokes it immediately). The output contains the replacement plaintext key once: keep it out of logs, migrate callers during the grace period, and then verify the old key no longer works.

References

• Browser Management - Create, list, view, and delete browser sessions
• App Deployment - Deploy TypeScript/Python apps and invoke actions
• Computer Controls - OS-level mouse, keyboard, and screenshot capabilities
• Process Execution - Execute and manage processes in browser VMs
• Profiles - Manage persistent browser profiles
• Managed Auth - Auth connections, login sessions, credential providers, auto re-authentication
• Proxies - Create and manage datacenter, ISP, residential, and mobile proxies
• Browser Pools - Manage pre-warmed browser pools
• Extensions - Upload and manage Chrome extensions
• Replays - Record and download video replays
• Filesystem Operations - Read, write, upload, and download files