Commands Reference

Every command available in the Granite console client. Generated from the CLI source at granite-so/cli — if something here disagrees with novps <command> --help, the CLI is right and this page is stale.

The binary is novps. Install it with curl https://cli.granite.so | sh, then authenticate with a Personal Access Token from the dashboard.

Global options

Every command accepts these.

Option	Short	Default	Description
--project	-p	default	Project alias to act on. Tokens are stored per alias, so one machine can drive several projects.
--json	—	false	Machine-readable output. Available on every list and get command, and on apps apply, apps deploy, resources update and resources deploy.
--force	-f on some commands	false	Skip the typed confirmation on a destructive command.

Destructive commands (apps delete, resources delete, databases delete, storage delete, storage keys regenerate and the sub-command deletes) prompt you to type DELETE and exit with a non-zero code if you do not. --force skips the prompt — that is what makes them usable from CI and from an AI agent.

novps apps apply --wait exits non-zero when the deployment does not reach success, so a deploy step fails a pipeline instead of passing quietly.

novps resources exec runs a command inside a container and exits with that command’s exit code, so a script or an agent can run commands in a container without an interactive shell.

Configuration

Setting	Source	Default
Token	~/.novps/config.json	—
API URL	NOVPS_API_URL, then api_url in the config file	https://api.granite.so
WebSocket URL	NOVPS_WS_URL, then ws_url in the config file	wss://websocket.granite.so
Install directory	NOVPS_INSTALL_DIR (install script only)	~/.local/bin or /usr/local/bin

Authorization

Commands related to authentication. The token is validated with a test API call before it is saved.

novps auth login

Authenticate with a Personal Access Token.

Option	Short	Default	Description
--token	-t	—	Personal Access Token. If not provided, you are prompted interactively.
--project	-p	default	Project alias to store the token under.

Tokens start with nvps_. Reading the token from the environment keeps it out of shell history, which is what you want in CI.

novps auth login
novps auth login --token "$GRANITE_TOKEN"
novps auth login --project=staging

novps auth logout

Remove the saved authentication token.

Option	Short	Default	Description
--project	-p	default	Project alias to remove the token for.

novps auth logout
novps auth logout --project=staging

novps auth status

Show current authentication status: whether you are authenticated, and a truncated token prefix for identification.

Option	Short	Default	Description
--project	-p	default	Project alias to check.

novps auth status

Applications

An application is the scope that holds your resources. apply is the command most workflows are built on: it creates or updates the whole application from a YAML manifest and is idempotent, matching resources by name.

novps apps list

List all applications in the project. Output columns: ID, Name, Resources, Created At.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps apps list
novps apps list --json

novps apps resources

List resources belonging to an application. Output columns: ID, Name, Type, Public Domain, Replicas, Schedule.

Argument	Required	Description
APP_ID	yes	Application ID.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps apps resources 0f3c1b2a-...

novps apps apply

Create or update an application from a YAML manifest. The application name is the CLI argument, not a field in the file, so the same manifest can create my-api-staging and my-api-prod.

Argument	Required	Description
APP_NAME	yes	Application name, unique within the project.

Option	Short	Default	Description
--file	-f	—	Path to the YAML manifest. Required.
--env-file	—	—	Path to a .env file, merged under the shell environment for ${VAR} substitution.
--prune	—	false	Delete resources in the application that are not in the manifest.
--dry-run	—	false	Parse and validate only; no API call.
--wait	-w	false	Wait for the deployment to finish, then print the endpoints.
--json	—	false	Output as JSON, including deployment_status and the resolved endpoints when used with --wait.
--project	-p	default	Project alias.

${VAR} references are substituted locally before the manifest is sent — from --env-file first, then the shell environment, which wins on conflict. An undefined variable is an error, not an empty string. A $VAR reference without braces is left alone and resolved by Granite from the application’s own environment variables at deploy time.

A manifest with source_type: github requires the Granite GitHub App on the repository; the CLI checks this before applying and stops with an explanation if the integration is missing.

novps apps apply my-api -f novps.yaml
novps apps apply my-api -f novps.yaml --wait
novps apps apply my-api -f novps.yaml --dry-run
novps apps apply my-api -f novps.yaml --env-file .env.production --wait
IMAGE_TAG=$(git rev-parse --short HEAD) novps apps apply my-api -f novps.yaml --wait --json

novps apps export

Export an existing application as a YAML manifest compatible with apply. This is how you adopt an application created in the dashboard.

Argument	Required	Description
APP_NAME	yes	Application name.

Option	Short	Default	Description
--output	-o	stdout	Write the manifest to a file instead of standard output.
--include-secrets	—	false	Include environment variable values. Requires the apps.show-secrets permission.
--project	-p	default	Project alias.

Registry credentials are never returned: the export always writes credentials: ''.

novps apps export my-api
novps apps export my-api -o novps.yaml
novps apps export my-api --include-secrets -o novps.yaml

novps apps deploy

Trigger a manual deployment for every resource in the application.

Argument	Required	Description
APP_ID	yes	Application ID.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps apps deploy 0f3c1b2a-...

novps apps update

Update an application’s name or description. At least one of the two is required.

Argument	Required	Description
APP_ID	yes	Application ID.

Option	Short	Default	Description
--name	—	—	New application name.
--description	—	—	New description.
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps apps update 0f3c1b2a-... --name "Production API"

novps apps set-env

Set application-wide environment variables. They are shared by all resources of the application. Unless you pass --no-deploy, the application is redeployed so the new values take effect. Available since CLI v0.10.0.

Merging reads the current values, so it requires the apps.show-secrets permission. --replace does not.

Argument	Required	Description
APP_ID	yes	Application ID.
PAIRS	yes	One or more KEY=VALUE pairs.

Option	Short	Default	Description
--merge / --replace	—	--merge	Merge with the existing variables, or replace them all.
--no-deploy	—	false	Save the variables without redeploying.
--project	-p	default	Project alias.

novps apps set-env 0f3c1b2a-... SENTRY_DSN=https://... LOG_LEVEL=info
novps apps set-env 0f3c1b2a-... LOG_LEVEL=info --replace
novps apps set-env 0f3c1b2a-... LOG_LEVEL=debug --no-deploy

novps apps unset-env

Remove application-wide environment variables. Requires the apps.show-secrets permission. Fails if none of the keys are set. Available since CLI v0.10.0.

Argument	Required	Description
APP_ID	yes	Application ID.
KEYS	yes	One or more keys to remove.

Option	Short	Default	Description
--no-deploy	—	false	Save the change without redeploying.
--project	-p	default	Project alias.

novps apps unset-env 0f3c1b2a-... LOG_LEVEL OLD_FLAG

novps apps delete

Delete an application and all of its resources (soft delete).

Argument	Required	Description
APP_ID	yes	Application ID.

Option	Short	Default	Description
--force	-f	false	Skip the confirmation.
--project	-p	default	Project alias.

novps apps delete 0f3c1b2a-...
novps apps delete 0f3c1b2a-... --force

novps apps events

Show the events of an application — failing healthchecks, restarts, out-of-memory kills, crash loops, image pull and configuration errors, cron runs and deployments — oldest first. (ongoing) marks a problem that is still open.

Argument	Required	Description
APP_ID	yes	Application ID.

Option	Short	Default	Description
--type	-t	—	Only this event type, e.g. resource.down or deployment.failed.
--resource	-r	—	Only events of this resource (name or ID).
--since	-s	—	Only events newer than a duration: 30m, 6h, 7d.
--limit	-n	25	Number of events (1–500).
--follow	-f	false	Keep printing new events as they happen.
--json	—	false	Output as JSON; with --follow, one object per line.
--project	-p	default	Project alias.

novps apps events 0f3c1b2a-...
novps apps events 0f3c1b2a-... -f
novps apps events 0f3c1b2a-... --since 6h -r web
novps apps events 0f3c1b2a-... -t resource.oom_killed -n 100
novps apps events 0f3c1b2a-... -f --json

Resources

A resource is one deployable unit inside an application: a web-app, a worker or a cron-job. update is the general form; scale, set-image and set-env are shortcuts for the fields you change most often.

novps resources get

Show detailed information for a resource.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps resources get 7a91c4d8-...
novps resources get 7a91c4d8-... --json

novps resources logs

View resource logs.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.

Option	Short	Default	Description
--follow	-f	false	Follow log output.
--lines	-n	100	Number of log lines (1–5000).
--since	-s	1h	Show logs since a duration: 30s, 5m, 1h, 1d.
--search	—	—	Filter by substring.
--pod	—	—	Filter by pod name.
--project	-p	default	Project alias.

novps resources logs 7a91c4d8-...
novps resources logs 7a91c4d8-... -f
novps resources logs 7a91c4d8-... -n 500
novps resources logs 7a91c4d8-... --since 30m --search "error"

novps resources connect

Open an interactive shell in a running container — the terminal equivalent of the Console tab in the dashboard.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID to connect to.

Option	Short	Default	Description
--project	-p	default	Project alias.

novps resources connect 7a91c4d8-...

To run commands from a script or an AI agent, use resources exec instead — connect needs a real terminal.

novps resources exec

Run a command in a running container without an interactive terminal. Only the command’s output is printed, and the CLI exits with the command’s exit code — 255 if the session drops before the command finishes. Use it from scripts, CI and AI agents such as Claude Code or Codex.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID to run the command in.
COMMAND	no	Command to run with /bin/sh. Without it, a script is read from stdin.

Option	Short	Default	Description
--stdin	-i	false	Pass local stdin to the command.
--project	-p	default	Project alias.

The arguments are joined with spaces and run by /bin/sh, the same way ssh does, so pipes and && work inside a quoted argument. Put -- before a command that has its own flags.

novps resources exec 7a91c4d8-... -- ls -la /app
novps resources exec 7a91c4d8-... -- 'cd /app && python manage.py migrate'
novps resources exec 7a91c4d8-... < script.sh
cat dump.sql | novps resources exec 7a91c4d8-... -i -- 'psql "$DATABASE_URL"'

The container needs the base64 utility, which Debian, Ubuntu and Alpine images include. Output is text, and stderr is merged into stdout.

novps resources deploy

Trigger a manual deployment for a single resource.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps resources deploy 7a91c4d8-...

novps resources update

Update a resource’s configuration. At least one flag is required. A deployment is triggered unless you pass --no-deploy.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.

Option	Short	Default	Description
--image	—	—	New image name.
--tag	—	—	New image tag.
--docker-credentials	—	—	Private registry credentials as USER:PASSWORD, or the UUID of credentials already stored for this image. An empty string removes them.
--replicas	—	—	Replica size and count as size:count, e.g. sm:2.
--command	—	—	Override the container command.
--port	—	—	HTTP port.
--schedule	—	—	Cron schedule, for a cron-job resource.
--env	-e	—	KEY=VALUE environment variable. Repeatable.
--no-deploy	—	false	Apply the change without triggering a deployment.
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps resources update 7a91c4d8-... --tag 1.4.2
novps resources update 7a91c4d8-... --replicas sm:3 --port 8080
novps resources update 7a91c4d8-... --command "python -m app.worker" -e LOG_LEVEL=debug
novps resources update 7a91c4d8-... --schedule "*/5 * * * *"
novps resources update 7a91c4d8-... --tag 1.4.2 --no-deploy

novps resources scale

Change replica size and count. Shortcut for update --replicas.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.

Option	Short	Default	Description
--replicas	-r	—	Replica size and count as size:count. Required.
--project	-p	default	Project alias.

novps resources scale 7a91c4d8-... -r sm:2

novps resources set-image

Update the image, tag and/or registry credentials. Shortcut for update.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.

Option	Short	Default	Description
--image	—	—	New image name.
--tag	—	—	New image tag.
--docker-credentials	—	—	USER:PASSWORD, a stored credential UUID, or an empty string to remove.
--project	-p	default	Project alias.

The credentials field in a manifest is read only when the resource is created — on later applies it is ignored. That is deliberate, so a committed file never has to carry a secret. Set and rotate credentials here instead, reading the value from the environment to keep it out of shell history.

novps resources set-image 7a91c4d8-... --image registry.example.com/team/api --tag 1.4.2
novps resources set-image 7a91c4d8-... --docker-credentials "$DOCKER_USER:$DOCKER_TOKEN"
novps resources set-image 7a91c4d8-... --docker-credentials ""

novps resources set-env

Set resource environment variables. To set variables shared by every resource of an application, use novps apps set-env.

Merging reads the current values, so it requires the apps.show-secrets permission. --replace does not.

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.
PAIRS	yes	One or more KEY=VALUE pairs.

Option	Short	Default	Description
--merge / --replace	—	--merge	Merge with the existing variables, or replace them all.
--project	-p	default	Project alias.

novps resources set-env 7a91c4d8-... LOG_LEVEL=debug FEATURE_X=on
novps resources set-env 7a91c4d8-... LOG_LEVEL=debug --replace

novps resources delete

Delete a resource (soft delete).

Argument	Required	Description
RESOURCE_ID	yes	Resource ID.

Option	Short	Default	Description
--force	-f	false	Skip the confirmation.
--project	-p	default	Project alias.

novps resources delete 7a91c4d8-...

Secrets

novps secrets list

List secret keys for an application or a single resource. Values are masked unless you ask for them.

Argument	Required	Description
APP_ID	yes	Application ID.

Option	Short	Default	Description
--resource	-r	—	Resource ID, for resource-level secrets.
--with-values	—	false	Include secret values in the output.
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps secrets list 0f3c1b2a-...
novps secrets list 0f3c1b2a-... --with-values
novps secrets list 0f3c1b2a-... -r 7a91c4d8-...

novps secrets get

Get a single secret value by key name.

Argument	Required	Description
APP_ID	yes	Application ID.
SECRET_KEY	yes	Secret key name, e.g. DATABASE_URL.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps secrets get 0f3c1b2a-... DATABASE_URL

Databases

Managed PostgreSQL, MySQL and Redis. Databases are not declared in the application manifest — create them here, then pass the connection string into the application through envs and --env-file, and grant access with databases allow-apps.

Databases are never exposed publicly. Use novps port-forward database to reach one from your machine.

novps databases list

List databases in the project.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps databases get

Show detailed information for a database.

Argument	Required	Description
DATABASE_ID	yes	Database ID.

Option	Short	Default	Description
--show-password	—	false	Include the password and DATABASE_URL.
--format	-f	table	Output format: table, json or env.
--project	-p	default	Project alias.

--format env prints DB_ENGINE, DB_HOST, DB_PORT, DB_USER, DB_NAME and DB_PASSWORD, adding DATABASE_URL when --show-password is given — which makes it a one-liner to seed a local .env.

novps databases get 3b7e-...
novps databases get 3b7e-... --show-password
novps databases get 3b7e-... --format env --show-password >> .env
novps databases get 3b7e-... --format json

novps databases create

Create a new database.

Option	Short	Default	Description
--engine	-e	—	postgres, mysql or redis. Required.
--size	-s	—	Node size: xs, sm, md, lg, xl. Required.
--count	-n	1	Node count (1–3).
--postgres-version	—	17	Postgres version: 15, 16, 17 or 18.
--mysql-version	—	8.0	MySQL version: 8.0.
--wait	-w	false	Wait until the database is ready, then print the connection details.
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps databases create --engine postgres --size sm
novps databases create --engine postgres --size sm --postgres-version 17 --wait
novps databases create --engine mysql --size sm --mysql-version 8.0
novps databases create --engine redis --size xs

novps databases resize

Resize a database. Only scaling up is allowed.

Argument	Required	Description
DATABASE_ID	yes	Database ID.

Option	Short	Default	Description
--size	-s	—	New node size.
--count	-n	—	New node count (1–3).
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps databases resize 3b7e-... --size lg
novps databases resize 3b7e-... --size lg --count 2

novps databases allow-apps

Set the list of applications allowed to reach this database. Passing no --app clears the allowlist.

Argument	Required	Description
DATABASE_ID	yes	Database ID.

Option	Short	Default	Description
--app	-a	—	Application UUID to allow. Repeatable.
--project	-p	default	Project alias.

novps databases allow-apps 3b7e-... --app 0f3c1b2a-... --app 5d2a-...
novps databases allow-apps 3b7e-...

novps databases delete

Delete a database.

Argument	Required	Description
DATABASE_ID	yes	Database ID.

Option	Short	Default	Description
--force	—	false	Skip the typed confirmation.
--project	-p	default	Project alias.

Read-only replicas — novps databases replica

PostgreSQL only. One replica per database.

Command	Arguments	Options
replica create	DATABASE_ID	--size/-s (required), --wait/-w, --json, --project
replica resize	DATABASE_ID	--size/-s (required), --json, --project
replica delete	DATABASE_ID	--force, --project

novps databases replica create 3b7e-... --size sm --wait
novps databases replica resize 3b7e-... --size md
novps databases replica delete 3b7e-...

Backups — novps databases backups

PostgreSQL and MySQL.

Command	Arguments	Options
backups list	DATABASE_ID	--json, --project
backups create	DATABASE_ID	--wait/-w, --json, --project
backups delete	DATABASE_ID, BACKUP_ID	--force, --project

novps databases backups list 3b7e-...
novps databases backups create 3b7e-... --wait
novps databases backups delete 3b7e-... 9c1f-...

Connection pools — novps databases pool

PostgreSQL only.

Command	Arguments	Options
pool list	DATABASE_ID	--json, --project
pool create	DATABASE_ID	--size/-s (required), --mode/-m (transaction, default, or session), --target/-t (primary, default, or replica), --json, --project
pool update	DATABASE_ID, POOL_ID	--size/-s, --mode/-m, --json, --project
pool delete	DATABASE_ID, POOL_ID	--force, --project

novps databases pool list 3b7e-...
novps databases pool create 3b7e-... --size 50 --mode transaction --target primary
novps databases pool update 3b7e-... 4a8d-... --size 80 --mode session
novps databases pool delete 3b7e-... 4a8d-...

Logical databases — novps databases db

The individual databases inside one instance. PostgreSQL and MySQL.

Command	Arguments	Options
db list	DATABASE_ID	--json, --project
db create	DATABASE_ID	--name/-n (required), --json, --project
db delete	DATABASE_ID, ENTRY_ID	--force, --project

novps databases db list 3b7e-...
novps databases db create 3b7e-... --name analytics
novps databases db delete 3b7e-... 2f6b-...

novps databases pg-db is kept as a hidden alias for db. Use db in new scripts.

Users — novps databases user

Users inside one instance. PostgreSQL and MySQL. The generated password is printed once, on creation.

Command	Arguments	Options
user list	DATABASE_ID	--show-password, --json, --project
user create	DATABASE_ID	--name/-n (required), --grant/-g (repeatable, `=ro
user delete	DATABASE_ID, ENTRY_ID	--force, --project

novps databases user list 3b7e-...
novps databases user list 3b7e-... --show-password
novps databases user create 3b7e-... --name app_user --grant analytics=ro --grant reporting=all
novps databases user delete 3b7e-... 8e4c-...

novps databases pg-user is kept as a hidden alias for user. Use user in new scripts.

Registry

novps registry list

List the namespaces in the Granite Docker registry.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps registry list

Storage

S3-compatible buckets. Buckets and keys are addressed by their unique identifier — internal_domain for a bucket, internal_name for a key — not by display name, because display names are not guaranteed unique within a project. Run the matching list command to see the identifier in the first column.

novps storage list

List buckets, with their origin and CDN endpoints.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps storage create

Create a bucket. A unique identifier suffix is appended to the display name automatically; the identifier to use afterwards is internal_domain in the output.

Argument	Required	Description
NAME	yes	Display name, 3–40 characters, alphanumeric and dashes.

Option	Short	Default	Description
--region	—	eu	Region: europe, usa or asia. eu creates the bucket in europe.
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps storage create my-bucket
novps storage create my-bucket --region usa

novps storage set-access

Change a bucket’s access policy.

Argument	Required	Description
BUCKET	yes	Bucket identifier (internal_domain).
ACCESS_LEVEL	yes	private or public-read.

novps storage set-access my-bucket-a1b2 public-read

novps storage delete

Delete a bucket. It disappears from the project immediately; its contents are kept for 14 days and then permanently erased.

Argument	Required	Description
BUCKET	yes	Bucket identifier (internal_domain).

Option	Short	Default	Description
--force	—	false	Skip the typed confirmation.
--project	-p	default	Project alias.

Files — novps storage files

Argument	Required	Description
BUCKET	yes	Bucket identifier.

Option	Short	Default	Description
--path	—	—	Folder path prefix.
--page-size	—	100	Items per page (1–1000).
--continuation-token	—	—	Continuation token from the previous page.
--all	—	false	Fetch all pages and print them together.
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps storage files list my-bucket-a1b2
novps storage files list my-bucket-a1b2 --path logs/ --page-size 500
novps storage files list my-bucket-a1b2 --all

Upload a local file through a pre-signed URL.

Argument	Required	Description
BUCKET	yes	Bucket identifier.
LOCAL_FILE	yes	Local file to upload. Must exist and be readable.

Option	Short	Default	Description
--key	—	file name	Remote key.
--content-type	—	—	Content-Type header for the object.
--project	-p	default	Project alias.

novps storage files upload my-bucket-a1b2 ./data.bin
novps storage files upload my-bucket-a1b2 ./data.bin --key backups/data.bin --content-type application/octet-stream

Argument	Required	Description
BUCKET	yes	Bucket identifier.
KEY	yes	Remote key to download.

Option	Short	Default	Description
--output	-o	key basename in the working directory	Output path.
--duration	—	—	Pre-signed URL lifetime, in seconds.
--project	-p	default	Project alias.

novps storage files download my-bucket-a1b2 backups/data.bin -o ./data.bin

Rename, that is move, a file within a bucket.

Argument	Required	Description
BUCKET	yes	Bucket identifier.
KEY	yes	Current key.
NEW_KEY	yes	New key.

novps storage files rename my-bucket-a1b2 old/key.txt new/key.txt

Print the public CDN URL of a file (novps storage files url). The bucket must be public-read; special characters in the key are percent-encoded. Requires CLI 0.7.0 or newer.

Argument	Required	Description
BUCKET	yes	Bucket identifier.
KEY	yes	Object key, for example images/logo.png.

novps storage files url my-bucket-a1b2 images/logo.png
# https://my-bucket-a1b2.cdn.europe.novps.app/images/logo.png

Argument	Required	Description
BUCKET	yes	Bucket identifier.
KEYS	yes	One or more keys to delete.

Option	Short	Default	Description
--force	—	false	Skip the confirmation.
--project	-p	default	Project alias.

novps storage files delete my-bucket-a1b2 logs/a.txt logs/b.txt

Access keys — novps storage keys

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

The secret is shown once, on success. There is no way to read it again — regenerate the key instead.

In the europe, usa and asia regions all buckets of a key must be in the same region and share one permission level (all ro or all rw); create separate keys otherwise.

Argument	Required	Description
NAME	yes	Display name, 3–60 characters, alphanumeric, dot and dash.

Option	Short	Default	Description
--bucket	-b	—	Bucket permission as `:<ro
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps storage keys create prod-key --bucket my-bucket-a1b2:rw --bucket assets-c3d4:rw

Argument	Required	Description
KEY	yes	Key identifier (internal_name).

Option	Short	Default	Description
--name	—	—	New display name.
--bucket	-b	—	Replace permissions; format `:<ro
--replace-permissions	—	false	Replace permissions with the --bucket list. Pass with no --bucket to clear them all (legacy eu keys only — a key in the other regions must keep at least one bucket).
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

novps storage keys update prod-key-x1y2 --name reporting-key
novps storage keys update prod-key-x1y2 --bucket my-bucket-a1b2:ro
novps storage keys update prod-key-x1y2 --replace-permissions

For keys in the europe, usa and asia regions, changing the permissions re-issues the key: the new Access Key and Secret Key are printed once and the old pair stops working immediately.

Regenerate a key. The old credentials stop working immediately. For keys in the europe, usa and asia regions the Access Key changes as well as the secret.

Argument	Required	Description
KEY	yes	Key identifier (internal_name).

Option	Short	Default	Description
--force	—	false	Skip the confirmation.
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

Argument	Required	Description
KEY	yes	Key identifier (internal_name).

Option	Short	Default	Description
--force	—	false	Skip the typed confirmation.
--project	-p	default	Project alias.

GitHub

novps github list

List the GitHub installations linked to the current project. Output columns: ID, Account.

Option	Short	Default	Description
--json	—	false	Output as JSON.
--project	-p	default	Project alias.

An empty list means the Granite GitHub App is not installed for this project, which is what source_type: github in a manifest needs. Install it at https://github.com/apps/granite-so/installations/new and link the account in the dashboard — this cannot be done from the CLI.

novps github list

Port forwarding

Databases are not reachable from outside the platform, and resources may expose internal ports that have no public domain. Port forwarding is how you reach either from your own machine — to run a migration, open a SQL client, or debug an internal service.

novps port-forward database

Argument	Required	Description
DATABASE_ID	yes	Database ID to forward to.

Option	Short	Default	Description
--local-port	-l	the engine’s default port	Local port to listen on.
--project	-p	default	Project alias.

novps port-forward database 3b7e-...
novps port-forward database 3b7e-... -l 5433

novps port-forward resource

Argument	Required	Description
RESOURCE_ID	yes	Resource ID to forward to.
REMOTE_PORT	yes	Remote port on the resource.

Option	Short	Default	Description
--local-port	-l	the remote port	Local port to listen on.
--project	-p	default	Project alias.

novps port-forward resource 7a91c4d8-... 8080
novps port-forward resource 7a91c4d8-... 8080 -l 3000

Version

novps version

Print the installed CLI version. The Claude Code skill requires v0.3.0 or later.

novps version