Turbo Server CLI (ts)

Use ts to administer a Turbo Server from a terminal or a script. It works the same against the server on the machine you are sitting at and a server across the network, and it covers the day-to-day administration you would otherwise do in the Administration site.

What You'll Learn

• How to point ts at a server and sign in
• Which commands cover which part of administration
• How to get machine-readable output for scripts
• What the exit codes mean

---

Installing

ts ships with Turbo Server. On a server it is installed to the Bin directory under the install root — ts.cmd on Windows, ts elsewhere. That directory keeps its name across upgrades, unlike the versioned directory holding the binary itself, so it is the path to put on your PATH or in a script. Adding it to PATH is a manual step; the installer does not modify PATH for you.

Name collision

On Linux, moreutils provides an unrelated ts (a timestamp filter). If you use both, alias one of them on your PATH.

Signing In

Sign in once, naming the server, and every later command goes to it:

ts login --server=https://turbo.example.net

ts login opens the server's sign-in page in your browser. On a machine with no browser, or over SSH, it prints a code to enter on another device instead; --device-code asks for the code anywhere. Signing in to a server when no default is set makes it the default. Once a default is set it stays, and ts login says how to change it with ts config --server=<url>.

Sign-ins are kept per server, so several servers can stay signed in at once. ts logout signs out of one; ts logout --revoke also ends the session on the server.

A script or CI job authenticates as a client you register with ts client, rather than as a person. Set TSCLIENTID and TSCLIENTSECRET, and each command exchanges them for a fresh token, with nothing stored.

Administration commands require a Server Administrator: an account in the built-in Administrators group, directly or through a nested group.

Pointing at a Server

Override the default server for one command with the global --server flag, or for a whole script with the TSSERVER environment variable. Precedence is flag, then environment variable, then the stored default. --server takes a URL, or the host name of a server you signed in to.

ts --server=staging.example.net workspaces

Administering the Local Machine

On the server itself, --local administers the install over loopback with no sign-in at all:

ts --local status

Authorization here is file permissions rather than an account: ts reads a service credential that only root or an Administrator can read, and exchanges it for a short-lived token. Run it elevated, or it will tell you it cannot read the credential. The audit log records the operating-system account and machine you ran it as.

This is the way to administer a server whose sign-in you have broken — a bad authentication setting, an identity provider that is down. ts identity-source can take a broken provider off the sign-in page from here, and ts certificate can fix the HTTPS setup browsers refuse. A few commands need the service token rather than a person's sign-in; their pages say so. ts release runs only on the server, with or without --local.

Environment Variables

Variable	Effect
TSSERVER	The server to target, between --server and the stored default.
TSCLIENTID, TSCLIENTSECRET	Authenticate every command as this registered client. Both are required.
TSACCESSTOKEN	An access token to send instead of any stored sign-in or client.
TSCONFIGDIR	The directory holding the settings and sign-ins, instead of the default.

TSACCESSTOKEN takes precedence over TSCLIENTID, which takes precedence over a stored sign-in. --local uses none of them.

Output

Every command prints a readable table or summary by default, and structured JSON on request:

ts workspaces                  # table
ts workspaces --csv            # tab-separated, nothing truncated
ts workspaces --no-trunc       # full-width columns
ts workspaces --format=json    # one JSON result envelope

The JSON envelope is stable and safe to parse:

[{
  "name": "workspaces",
  "arguments": ["workspaces", "--format", "json"],
  "result": { "exitCode": 0, "workspaces": [ { "id": "acme", "name": "Acme" } ] },
  "messages": ["..."]
}]

--format=json-stream emits one JSON event per line instead, for long-running commands.

Global Options

Flag	Description	Default/Values	Notes
--server	Target server for this invocation.	URL, or the host of a server you signed in to	Overrides the stored default and TSSERVER. On ts config it names the default to store.
--local	Administer the install on this machine over loopback, with no sign-in.		Requires an account that can read the service credential — root or an Administrator. Wins over --server.
--format	Output format.	Default table; json, json-stream	Anything else is an error.
--wait-after-exit	Wait for a key press before exiting.		For double-click launches on Windows.
--wait-after-error	Wait for a key press only on failure.

Commands

Run ts help for the list, or ts help <command> for one command's usage and options. A page covering a plural list command and its singular counterpart is listed once, under the singular name.

Session

Command	Purpose
login	Sign in in a browser, with a code, or as a registered client.
logout	Sign out of a server, and optionally end the session there.
config	Show or set the default server.
status	Show the targeted server's health and its Portal, API, and Hub addresses.
version	Show the version of ts.
help	List the commands, or show one command's usage.

Identity

Command	Purpose
user	Show, create, disable, unlock, delete, or restore an account.
group	Show and manage groups, their members, and the groups nested in them.
identity-source	Show and manage where accounts come from, and move accounts between sources.
client	Register a client, rotate its secret, or revoke it.
device	Show, disable, enable, or remove a computer that signs in as itself.
device-key	Revoke a person's sign-in key.
location	Show and manage named locations, the address ranges and countries an app's access can be limited to.
ip-countries	Import IP-to-country data, or look up the country of an address.

Workspaces

Command	Purpose
workspace	Show and manage a workspace and who has permission on it.
app	Show and manage a workspace's apps, their licensing, and seat reservations.
channel	Show and manage a channel and who can see it.
link	Show and manage a workspace link.
notification	Show and manage notifications and who sees them.
share	Show or revoke a share link.

Policy and Network

Command	Purpose
policy	Show or replace the launch policy, or fetch its schema.
network-rule	Show and manage the network allow-list's access rules.
destination-class	Show and manage the named host sets that network access rules refer to.

Infrastructure

Command	Purpose
server	Show and set a server's settings, hostname, and tags; stop, decommission, or delete it; act on its Application Server.
certificate	Show or change how a server's Gateway serves HTTPS.
join-link	Issue the link a new server joins the cluster with.
logs	Show servers' logs, and archive, download, or delete their log files.
site	Show and manage a site.
proxy	Show and manage a proxy.
routing-rule	Show and manage a proxy routing rule.
fleet	Group application servers into fleets.
session	Show, terminate, or diagnose one of your sessions.
runner	Show or remove a runner, or show a cloud runner's Remote Desktop credentials.

Storage

Command	Purpose
storage-provider	Show and manage a cloud storage provider.
storage-connection	Show and manage storage connections and who can use them.
storage-scope	Show and manage a storage scope.

Hub

Command	Purpose
repo	List, inspect, and remove repositories on this server's hub.
import	Copy repositories from an upstream server and watch the runs.

Releases

Command	Purpose
release	Manage the Turbo Client, Turbo Update Service, and Turbo Server releases this server offers, and how its channels get them. Runs on the server itself.
publisher	Register a CI workflow that publishes releases without a credential.

AI

The AI commands sit under an ai namespace, because tool, endpoint, connector, and skill are generic nouns on their own — a bare ts ai lists what is there.

Command	Purpose
ai endpoint	Show, create, update, or delete an AI model endpoint.
ai tool	Show, update, or delete an AI tool.
ai connector	Show, update, or delete an MCP connector.
ai skill	Enable or disable a stored skill.
ai transcript	List AI calls, or read one call's prompt and response.
ai usage	Show AI usage and token totals.

System

Command	Purpose
settings	Get and set global server settings.
audit	Query the operator audit log.
license	Show or apply the server license.
usage	Show usage reporting.
report	Export a built-in admin report as CSV or PDF.
signing-key	List and rotate the token signing keys.

Command Shape

Commands follow the same two patterns throughout.

Plural lists, singular acts. ts workspaces lists them; ts workspace acme shows one. On a singular command the first word is an action when it names one, and the target otherwise, so ts workspace acme and ts workspace delete acme both read naturally. print is the default action.

Some resources are edited as JSON. Sites, proxies, routing rules, network rules, destination classes, apps, channels, links, storage providers and scopes carry more configuration than a flag list can express, so they are read and written as documents:

ts site 8f14e45f-ceea-467a-9a1f-6b3f0c1e77aa > site.json
# edit site.json
ts site set 8f14e45f-ceea-467a-9a1f-6b3f0c1e77aa --file=site.json

For a single field, reach for the accessor instead of a round trip through a file:

ts site 8f14e45f-ceea-467a-9a1f-6b3f0c1e77aa display-name    # read one field
ts site set 8f14e45f-ceea-467a-9a1f-6b3f0c1e77aa display-name "HQ"

Property names are kebab-case, and the value is typed from the field it replaces, so a number stays a number. A structured field — an object or an array — has no accessor form and is refused with a pointer at --file. Commands that are not edited as documents, such as ts server, ts settings and ts identity-source, take one property at a time in the same way.

Do not add --format=json to the read half

--format=json wraps output in the result envelope, so the file you capture is an envelope rather than the document set expects. Redirect the default output, as above. The round trip also works only for set; creating a resource with new needs a document you write yourself, not one produced by print.

Destructive commands ask for confirmation. Pass --force (or -f) to skip the prompt; when there is no terminal, --force is required rather than assumed.

Exit Codes

Code	Meaning
0	Success
-1	The command failed, or the server refused it
-2	The arguments could not be parsed
-3	The server could not be reached
-4	Not signed in, or the session ended
-5	Signed in, but not permitted
-6	The named resource does not exist
9009	No such command

Exit codes on Linux and macOS

The shell reports an exit code as an unsigned byte, so -4 appears as 252 in $?. Scripts that need the exact value should read result.exitCode from --format=json.

Related

• Turbo CLI (turbo) — the client CLI, whose conventions ts follows.
• Turbo Server — the server roles, and how to plan and deploy them.