OutLayer CLI

Command-line tool for deploying, running, and managing OutLayer agents.

outlayer login                                              # Import NEAR full access key
outlayer create my-agent                                    # Create project from template
outlayer deploy my-agent                                    # Deploy agent to OutLayer
outlayer run alice.near/my-agent '{"command": "hello"}'     # Execute agent

Install

Quick install (macOS / Linux)

curl -fsSL https://raw.githubusercontent.com/out-layer/outlayer-cli/main/install.sh | sh

From crates.io (requires Rust)

cargo install outlayer-cli

From GitHub source

cargo install --git https://github.com/out-layer/outlayer-cli

GitHub Releases

Pre-built binaries for macOS (ARM/x86), Linux (x86/ARM), and Windows are available on the Releases page.

Quick Start

# 1. Login (prompts for Account ID and Private Key)
outlayer login              # mainnet
outlayer login testnet      # testnet

# 2. Create a new agent
outlayer create my-agent                    # basic template (stdin/stdout)
outlayer create my-agent --template contract # with OutLayer SDK (VRF, storage, RPC)
cd my-agent

# 3. Edit src/main.rs, push to GitHub, then deploy
git init && git remote add origin <your-repo-url>
git push
outlayer deploy my-agent

# 4. Create a payment key for HTTPS calls
outlayer keys create

# 5. Run your agent
outlayer run alice.near/my-agent '{"command": "hello"}'

Commands

Auth

Command	Description
`outlayer login`	Import NEAR full access key (mainnet)
`outlayer login testnet`	Login to testnet
`outlayer logout`	Delete stored credentials
`outlayer whoami`	Show current account and network

Project Workflow

Command	Description
`outlayer create <name>`	Create project from template (basic) in `./<name>/`
`outlayer create <name> --template contract`	Create with OutLayer SDK (VRF, storage, RPC)
`outlayer create <name> --dir /path`	Create in a custom directory
`outlayer deploy <name> <wasm-url>`	Deploy from WASM URL (FastFS, etc.)
`outlayer deploy <name>`	Deploy from current git repo (origin + HEAD)
`outlayer deploy <name> --github`	Explicitly deploy from git (same as no URL)
`outlayer deploy <name> --no-activate`	Deploy without activating
`outlayer run <project> [input]`	Execute agent (HTTPS or on-chain fallback)
`outlayer projects [account]`	List projects for a user
`outlayer status [call_id]`	Project info or poll async call

# Run from project (uses payment key if available, else on-chain NEAR)
outlayer run alice.near/my-agent '{"command": "hello"}'
outlayer run alice.near/my-agent --input request.json             # input from file
outlayer run alice.near/my-agent '{"command": "heavy"}' --async           # async (HTTPS only)
outlayer run alice.near/my-agent '{"command": "premium"}' --deposit 0.01  # attached deposit
outlayer run alice.near/my-agent '{}' --compute-limit 1000000000          # custom compute limit

# Attach secrets to execution (secrets must be stored via `outlayer secrets set`)
outlayer run alice.near/my-agent '{}' --secrets-profile default --secrets-account alice.near

# Run from GitHub repo (on-chain)
outlayer run --github github.com/user/repo '{"command": "hello"}'
outlayer run --github github.com/user/repo --commit abc123 '{"input": 1}'

# Run from WASM URL (on-chain) — FastFS, any HTTP URL
outlayer run --wasm https://alice.near.fastfs.io/outlayer.near/abc.wasm '{"cmd": "hi"}'
outlayer run --wasm https://example.com/file.wasm --hash abc123... '{}'

# List your projects
outlayer projects
outlayer projects bob.near

Secrets

Command	Description
`outlayer secrets set '{"KEY":"val"}'`	Encrypt and store secrets
`outlayer secrets set-for-agent '{"KEY":"val"}' --project <owner>/<name>`	Leave a secret for an agent to use with one connector
`outlayer secrets access --project <owner>/<name> --profile <p> --access <cond>`	Change who may read a stored secret (`update_access`); grant or revoke an agent without re-storing
`outlayer secrets update '{"KEY":"val"}'`	Merge with existing (preserves PROTECTED_*)
`outlayer secrets set --generate PROTECTED_X:hex32`	Generate protected secret in TEE
`outlayer secrets list`	List stored secrets (metadata only)
`outlayer secrets delete`	Delete secrets for a profile

# Set secrets (JSON object, overwrites existing)
outlayer secrets set '{"API_KEY":"sk-...","DB_URL":"postgres://..."}'
outlayer secrets set '{"API_KEY":"sk-..."}' --project alice.near/my-agent
outlayer secrets set '{"API_KEY":"sk-..."}' --repo github.com/user/repo --branch main
outlayer secrets set '{"API_KEY":"sk-..."}' --wasm-hash abc123...   # the row a raw WASM URL run reads under

# Lock a project's row to one build: only a run of these exact bytes reads it, a rebuild is refused.
# The hash is "Executed binary" in an execution's details. Move it to the next release with `access`.
outlayer secrets set '{"SIGNING_KEY":"..."}' --project alice.near/oracle --build <sha256>
outlayer secrets access --project alice.near/oracle --access whitelist:alice.near --build <new sha256>

# Direct calls only: a call reads the row only when the account that CALLS the contract is one the
# condition names — no other contract in between. Without it, a contract you sign any transaction
# to can relay a call naming your secret into the project it is bound to, under your name.
outlayer secrets set '{"SIGNING_KEY":"..."}' --project alice.near/oracle --direct
outlayer secrets access --project alice.near/oracle --direct --via dao.sputnik-dao.near   # and through this DAO
outlayer secrets access --project alice.near/oracle --drop-callers                        # remove the rule

# Generate protected secrets in TEE (values never visible)
outlayer secrets set --generate PROTECTED_MASTER_KEY:hex32
outlayer secrets set '{"API_KEY":"sk-..."}' --generate PROTECTED_DB:hex64   # mixed

# Access control
outlayer secrets set '{"KEY":"val"}' --access allow-all                      # everyone who names it
outlayer secrets set '{"KEY":"val"}' --access whitelist:alice.near,bob.near
outlayer secrets set '{"KEY":"val"}' --access whitelist:me.near,agent@2026-10-01T00:00:00Z   # a grant that lapses
outlayer secrets access --project me.near/app --profile default --access whitelist:me.near    # change who may read; the value stays
# Without --access: a row that exists keeps its condition; a new project row admits only you;
# a new repository- or hash-bound row admits everyone.

# Update (merge with existing, preserves all PROTECTED_* variables)
outlayer secrets update '{"NEW_KEY":"val"}' --project alice.near/my-agent
outlayer secrets update --generate PROTECTED_NEW:ed25519

# Generation types: hex16, hex32, hex64, ed25519, ed25519_seed, password, password:N

# List / delete
outlayer secrets list
outlayer secrets delete --project alice.near/my-agent
outlayer secrets delete --profile production

Default accessor: --project auto-resolved from outlayer.toml if present.

A secret for an agent

secrets set stores a secret for your own project. set-for-agent stores one for a custody agent to use with somebody else's connector — the API key a connector needs on the agent's behalf. It is sealed to the agent's own key, stored on chain under the agent's name, and readable by that agent alone.

export OUTLAYER_WALLET_KEY=wk_...   # the agent's wallet key

# The logged-in account pays the storage, so the agent needs no NEAR
outlayer secrets set-for-agent '{"MAILGUN_KEY":"key-..."}' \
  --project connectors.outlayer.near/near-email

# Or let the agent's own wallet pay (it needs ~0.11 NEAR)
outlayer secrets set-for-agent '{"MAILGUN_KEY":"key-..."}' \
  --project connectors.outlayer.near/near-email --agent-pays

# Refuse unless the secret lands under the vault you expect
outlayer secrets set-for-agent '{"MAILGUN_KEY":"key-..."}' \
  --project connectors.outlayer.near/near-email --vault-id vault.alice.near

The plaintext never leaves the machine: the key it is sealed to is fetched under the agent's own authentication, and only ciphertext is sent. Nothing is signed or sent until the prepared call has been checked field by field — receiver, method, project, ciphertext, audience, vault and deposit — so a wrong answer becomes a refusal rather than a signature.

Payment Keys

Payment keys are required for HTTPS API calls. Created separately (requires USDC top-up).

Command	Description
`outlayer keys create`	Create a new payment key
`outlayer keys list`	List keys with balances
`outlayer keys balance <nonce>`	Check key balance
`outlayer keys topup <nonce> <amount>`	Top up with NEAR (mainnet, swaps to USDC)
`outlayer keys delete <nonce>`	Delete key (refunds storage)

Payment Checks (Agent-to-Agent)

Trustless agent-to-agent payments via ephemeral intents accounts. Requires a wallet API key (outlayer register or POST /register).

Command	Description
`outlayer checks create <token> <amount>`	Create a payment check
`outlayer checks batch-create --file <path>`	Batch create checks from JSON file
`outlayer checks claim <check_key>`	Claim a check (full or partial)
`outlayer checks reclaim <check_id>`	Reclaim unclaimed funds (full or partial)
`outlayer checks status <check_id>`	Check status of a payment check
`outlayer checks list`	List your payment checks
`outlayer checks peek <check_key>`	Check balance of a check by key

# Create a check for 1 USDC with memo and 24h expiry
outlayer checks create 17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1 1000000 \
  --memo "Payment for task" --expires-in 86400

# Claim (full)
outlayer checks claim ed25519:5Kd3NBU...

# Partial claim (take 0.5 USDC out of 1 USDC)
outlayer checks claim ed25519:5Kd3NBU... --amount 500000

# Reclaim (sender takes back)
outlayer checks reclaim pc_a1b2c3d4e5f6

# Partial reclaim
outlayer checks reclaim pc_a1b2c3d4e5f6 --amount 300000

# Check status
outlayer checks status pc_a1b2c3d4e5f6

# List unclaimed checks
outlayer checks list --status unclaimed

# Peek at check balance before claiming
outlayer checks peek ed25519:5Kd3NBU...

# Batch create from JSON
outlayer checks batch-create --file checks.json
# checks.json format: [{"token":"...","amount":"...","memo":"...","expires_in":86400}, ...]

Upload (FastFS)

Upload files to on-chain storage via NEAR transactions (indexed by FastFS).

Command	Description
`outlayer upload <file>`	Upload file to FastFS
`outlayer upload <file> --receiver <account>`	Custom receiver (default: OutLayer contract)
`outlayer upload <file> --mime-type <type>`	Override MIME type

outlayer upload ./target/wasm32-wasip2/release/my-agent.wasm
# Uploading to FastFS...
#   File: ./target/wasm32-wasip2/release/my-agent.wasm
#   Size: 234567 bytes
#   SHA256: abcdef...
# Upload complete!
# FastFS URL: https://alice.near.fastfs.io/outlayer.near/abcdef.wasm

Versions

Command	Description
`outlayer versions`	List project versions
`outlayer versions activate <key>`	Switch active version
`outlayer versions remove <key>`	Remove a version

Earnings

Command	Description
`outlayer earnings`	View developer earnings
`outlayer earnings withdraw`	Withdraw blockchain earnings
`outlayer earnings history`	View earnings history

Logs

Command	Description
`outlayer logs`	View execution history
`outlayer logs --nonce 2 --limit 50`	Specific key, more entries

Global Flags

outlayer --verbose ...            # Verbose output
outlayer --json ...               # JSON output
OUTLAYER_NETWORK=testnet outlayer run ...  # Override network via env

Configuration

Credentials

Stored at ~/.outlayer/{network}/credentials.json. Requires a NEAR full access key. Private key optionally stored in OS keychain (macOS Keychain, Linux Secret Service).

After login, the active network is saved to ~/.outlayer/default-network. If not set, the CLI auto-detects based on which network has credentials.

Project Config

outlayer.toml in your project root (created by outlayer create):

[project]
name = "my-agent"
owner = "alice.near"

[build]
target = "wasm32-wasip2"
source = "github"

[run]
payment_key_nonce = 1

Environment Variables

Variable	Description
`OUTLAYER_HOME`	Config directory (default: `~/.outlayer`)
`OUTLAYER_NETWORK`	Network: `mainnet` or `testnet`
`PAYMENT_KEY`	Payment key for `outlayer run` (format: `owner:nonce:secret`)

Testing

Integration tests run against testnet, spend testnet NEAR and take minutes, so they run only when asked for: set OUTLAYER_LIVE_TESTS=1. Without it every live test prints SKIP and cargo test stays fast. Requires outlayer login testnet. Run them before a release and after any change to the commands they cover.

Execution tests auto-detect: if TESTNET_PAYMENT_KEY is set, calls go via HTTPS API; otherwise they use on-chain request_execution (costs ~0.002 NEAR per call).

# Run all tests (on-chain mode — no payment key needed)
OUTLAYER_LIVE_TESTS=1 cargo test --test integration -- --show-output

# With payment key (HTTPS mode — faster, no NEAR cost)
TESTNET_PAYMENT_KEY="owner:nonce:secret" OUTLAYER_LIVE_TESTS=1 cargo test --test integration -- --show-output

# Individual modules
OUTLAYER_LIVE_TESTS=1 cargo test --test integration -- projects --show-output
OUTLAYER_LIVE_TESTS=1 cargo test --test integration -- run --show-output
OUTLAYER_LIVE_TESTS=1 cargo test --test integration -- secrets --show-output
OUTLAYER_LIVE_TESTS=1 cargo test --test integration -- full_flow --show-output

--show-output prints test logs (mode, tx hashes, results). Use --nocapture to see logs even for passing tests in real-time.

Documentation

Full documentation: docs/CLI.md

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
src		src
templates		templates
tests/integration		tests/integration
wit		wit
.gitignore		.gitignore
Cargo.toml		Cargo.toml
LICENSE-APACHE		LICENSE-APACHE
LICENSE-MIT		LICENSE-MIT
README.md		README.md
install.sh		install.sh

Navigation Menu

Repository files navigation

OutLayer CLI

Install

Quick install (macOS / Linux)

From crates.io (requires Rust)

From GitHub source

GitHub Releases

Quick Start

Commands

Auth

Project Workflow

Secrets

A secret for an agent

Payment Keys

Payment Checks (Agent-to-Agent)

Upload (FastFS)

Versions

Earnings

Logs

Global Flags

Configuration

Credentials

Project Config

Environment Variables

Testing

Documentation

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

OutLayer CLI

Install

Quick install (macOS / Linux)

From crates.io (requires Rust)

From GitHub source

GitHub Releases

Quick Start

Commands

Auth

Project Workflow

Secrets

A secret for an agent

Payment Keys

Payment Checks (Agent-to-Agent)

Upload (FastFS)

Versions

Earnings

Logs

Global Flags

Configuration

Credentials

Project Config

Environment Variables

Testing

Documentation

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages