Set Up the Operator CLI for Your Team

Before You Start

Use the Operator CLI when a trusted teammate or automation runner needs command-line access to the same Agentic Workers organization that owns your main agent, team agents, integrations, schedules, and traces. A trace is the step-by-step run log for an agent request.

The CLI uses the versioned public operation catalog. It preserves focused hosted-agent commands and can also list or call catalog operations by operation ID.

For direct browser login, you need access to the intended Team workspace and permission to use Operator CLI features. For unattended automation, you also need permission to generate an organization token and a runner where you can keep secrets out of source control.

Decide who owns each login or automation token before setup. Treat credentials like passwords because they can operate inside your organization. Do not paste them into public chats, screenshots, pull requests, or shared documents.

Install the CLI

curl -fsSL "https://www.agenticworkers.com/api/cli/install.sh" | sh
export PATH="$HOME/.local/bin:$PATH"
agw-operator --help

Sign In Directly

agw-operator --login
agw-operator agents list
agw-operator api operations --json

Use a Static Token for Automation

export AGW_API_BASE_URL="https://www.agenticworkers.com"
export AGW_API_TOKEN="<organization-operator-token>"
agw-operator agents list
agw-operator api operations --json

Verify Access Safely

agw-operator api call agents.list --input '{"query":{"limit":20,"offset":0}}' --json

Roll It Out to Teammates

Share the setup steps, not the raw token. Each teammate who needs command-line access should use an approved token path and understand which actions require human approval. Job execution, terminal connect tickets, commands, gateway restarts, and deletion need more scrutiny than read-only checks.

For production workflows, document the owner, runner, token storage location, expected commands, and rollback steps. Keep sensitive values out of the document and link to your internal secret manager instead.

Review CLI access when teammates change roles, when a runner is replaced, or when a workflow starts touching customer data, external messages, billing, or connected provider accounts.

Troubleshooting

If a saved browser login returns unauthorized, run agw-operator --login again and approve the intended workspace. For a static token, confirm it was copied completely, the configured API origin is correct, and the token has not been revoked.

If commands show the wrong organization, rerun browser login while the intended workspace is active or generate a static token from that Team workspace. Do not continue until read-only commands point to the right workspace.

If a command cannot use a connected app, reconnect that integration inside the Team workspace and verify the agent has the required tool enabled before retrying from the CLI.

If a teammate is blocked, ask them to capture the command name, profile name, error text, and timestamp. Do not ask them to send the token itself.