OpenAI releases an official CLI for its API

OpenAI has published an official command-line client for its REST API. The utility is written in Go (version 1.26 or later is required) and installs via Homebrew or a go install command. The source is on GitHub under the Apache 2.0 license.

How the commands work

The interface is organized around resources: a call looks like openai <resource> [subresource...] <command> [flags]. For instance, openai responses create --input "Say this is a test" --model gpt-5.5 hits a standard endpoint and needs an OPENAI_API_KEY. Admin requests — say, an organization's usage statistics — run through a separate OPENAI_ADMIN_KEY. Help (--help or openai help COMMAND) opens without a key or a network connection, and running bare openai lists command groups by task.

Images and files

The openai images generate command saves its output to ~/Downloads/gpt-images/ and defaults to the gpt-image-2.5-sunburst model. It can preview previously saved images without an API call and display them inline in the terminal. Files can be uploaded, inspected, and downloaded back; a @file:// and @data:// syntax lets you inject file contents into JSON payloads.

A focus on security

A striking share of the documentation is devoted to protecting data. Header values and secrets are hidden in help and redacted from debug logs; to pass credentials, the docs recommend the OPENAI_CUSTOM_HEADERS variable rather than command-line arguments, keeping secrets out of shell history. A dedicated OPENAI_UNTRUSTED_STDIN=1 mode treats input from an untrusted stream as literal data and forbids it from reading local files. A custom backend via --base-url must use HTTPS (localhost aside), and HTTPS proxies are rejected so the client certificate is not presented during the proxy's own handshake. Mutual TLS is still a beta program.

Updates, but no autopilot

The client checks for new stable releases, yet does so politely: at most once every seven days, without an API key, with a 200-millisecond timeout, and only when its streams are attached to a terminal. Nothing is installed automatically, and checks can be disabled with OPENAI_CLI_NO_UPDATE_CHECK=1. The project does not accept outside contributions: pull requests are limited to repository collaborators.

Source: Hacker News