Authentication

Browser (recommended):

unbound login

Browser login waits up to 120 seconds for your browser to hand the API key back over a loopback connection that is never reachable off the machine. When the wait runs out the CLI prints Authentication timed out after 120 seconds — on a headless box, or where a host firewall or an endpoint agent blocks loopback connections, use the API-key form below instead. API key — for CI/CD or headless environments:

unbound login --api-key <your-api-key>

Custom domain:

unbound login --domain custom.example.com

Credentials are stored at ~/.unbound/config.json.

Logout

unbound logout

Removes stored credentials while preserving custom URL settings.

CLI status

unbound status

Shows your email, organization, role (Admin/Manager/Member/Analytics Viewer), config file location, login state, API connectivity, and the connected tools wired through Unbound on this device (with their mode). Useful for debugging connection issues. For a deep per-tool health check, run unbound doctor. unbound status --json returns the same information for scripts: config_file, logged_in, email, organization, role, backend_url, frontend_url, gateway_url, api_status, and connected_tools[] carrying tool, label, mode and status per entry. Three more fields carry warnings the on-screen report prints only when they fire, so in JSON they are always there to test:

Field	Meaning
`key_validations_skipped`	How many per-tool key checks were skipped because the gateway was unreachable. Anything above `0` means this run did not verify those keys
`claude_config_dir_blank`	`true` when `CLAUDE_CONFIG_DIR` is set to an empty string. Unset it, or point it at a real directory
`claude_config_dir_mismatch`	`null`, or an object carrying `activeDir` and `staleDir` when `CLAUDE_CONFIG_DIR` points at a directory with no Unbound install while `~/.claude` holds one

The last two are also what make unbound doctor exit non-zero with every tool reported healthy.

Device identity

unbound login, unbound status and unbound doctor send this machine’s serial number so the device is attributed to you. sudo unbound onboard attributes the scan to the device’s owner instead, so an admin running it across a fleet does not end up owning every machine. The serial is cached at ~/.unbound/identity.json, which the installed hooks share, so one machine reports one identity. Clone a machine or a VM image and every copy reports as the same device — delete that file on the copy and run any of the three commands to re-read it. The serial number is the only hardware detail sent. Where a machine has none that can be read, a stable machine identifier is used instead, and where neither is available nothing identifying the hardware is sent. Run any of the three commands with UNBOUND_DEBUG=1 to see which was used.

Role access

Role	Data scope	Access
Admin	Organization	Full access to organization data, policies, users, settings, billing, integrations, and credentials.
Analytics Viewer	Organization	View dashboards, analytics, logs, policies, AI Tools Discovery, users, and cost data. Run analytics queries and CSV exports. Manage saved queries and custom dashboards. Cannot change organization controls or access credentials.
Manager	Self and direct or indirect reportees	Reads their team’s data where the CLI and API allow it. Has no console access and cannot use organization administration controls.
Member	Self	Create and access their own applications and related data. Has no console access and cannot view other users’ analytics or logs.

Admin, Analytics Viewer, and Member are assigned roles. Unbound grants Manager access when at least one user reports to that person.

Tenant / Custom Domains

If your organization runs Unbound on its own hosts — for example api.acme.com instead of api.getunbound.ai — pass all three URLs at login. They persist to ~/.unbound/config.json:

unbound login --api-key <YOUR_API_KEY> \
  --gateway-url  https://api.acme.com \
  --frontend-url https://gateway.acme.com \
  --backend-url  https://backend.acme.com

Or set them at any time without re-logging in:

# All three at once:
unbound config urls https://api.acme.com https://gateway.acme.com https://backend.acme.com

# One at a time:
unbound config set-gateway-url  https://api.acme.com
unbound config set-frontend-url https://gateway.acme.com
unbound config set-backend-url  https://backend.acme.com

View current values:

unbound config show
unbound config show --json

Defaults

Host	Default
Gateway (LLM proxy)	`https://api.getunbound.ai`
Frontend (dashboard)	`https://gateway.getunbound.ai`
Backend (CLI API)	`https://backend.getunbound.ai`

Getting Started

CLI

Policies

Analytics

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Logout

CLI status

Device identity

Role access

Tenant / Custom Domains

Defaults

​Login

​Logout

​CLI status

​Device identity

​Role access

​Tenant / Custom Domains

​Defaults

Login

Logout

CLI status

Device identity

Role access

Tenant / Custom Domains

Defaults