OpenAI releases official CLI for REST API

OpenAI has released the official command-line interface for its REST API, marking a significant shift in how developers interact with the platform from the terminal. According to the GitHub repository, the tool is written in Go and requires version 1.26 or later to install. The release introduces a resource-based command structure that replaces legacy colon-separated syntax, aiming to standardize access to both standard API endpoints and admin functions. The most immediate change for users is the default behavior of image generation, which now saves files locally to ~/Downloads/gpt-images/ using the gpt-image-2.5-sunburst model unless a specific model ID is provided.

The details

The CLI follows a strict resource-based hierarchy, where commands are grouped by task. Users can browse these groups by running openai without arguments, which displays descriptions for each group. The documentation notes that existing colon commands, such as openai admin:organization:usage completions, continue to work to ensure backward compatibility. However, the new structure encourages a more modular approach, such as openai admin organization usage.

A key feature of the release is the handling of output formats. By default, successful JSON responses are printed as readable text, even when piped. This is designed for human consumption, but the documentation explicitly warns that scripts parsing API data should use --format json or --format jsonl. For error handling, the CLI prints actionable summaries to stderr by default. Developers can retrieve original API error details, including unknown fields and SDK-reported stream error events, by using the --format-error json flag. The documentation highlights that explicit API error details can contain server-supplied sensitive data, so users should be cautious when logging these outputs.

Authentication remains a critical focus. Standard API endpoints require an API key, while admin endpoints require an admin API key. The CLI supports mutual TLS (mTLS) in beta, allowing organizations to use client certificates for authentication. To activate this, users must provide the client certificate and private key as separate PEM files. The documentation specifies that if certificate chain support is enabled, the certificate file must contain the leaf certificate first, followed by any intermediate certificates. Importantly, the CLI does not automatically select an mTLS endpoint; users must explicitly configure OPENAI_BASE_URL or use the --base-url flag. HTTPS proxies are rejected when mTLS is active to prevent presenting the client certificate during the proxy's own TLS handshake.

Context

This release positions the CLI as a first-class citizen in the OpenAI developer ecosystem, moving beyond simple curl wrappers. The inclusion of admin endpoint support suggests OpenAI is targeting enterprise workflows where usage monitoring and organization management are frequent tasks. The decision to use Go for the implementation ensures cross-platform compatibility and performance, while the requirement for Go 1.26+ indicates a modern toolchain expectation. The retirement of images create-variation in favor of images edit with a GPT Image model signals a consolidation of image generation capabilities, reducing the number of distinct endpoints developers need to manage.

What it means for developers

For developers, the primary workflow change is the shift from ad-hoc API calls to structured commands. The ability to use --header or -H to add custom headers is a direct improvement over previous methods, with the added security feature that header values are redacted in debug logs. For credential-bearing headers, the documentation recommends using the OPENAI_CUSTOM_HEADERS environment variable to keep secrets out of command arguments and shell history. This is a significant security improvement for CI/CD pipelines and local development environments.

The image generation workflow is now more intuitive, with files saved to a predictable directory and paths printed to stdout. This makes it easier to integrate image generation into shell scripts. However, developers should note that --format json returns API data without saving files or applying CLI presets, which is a crucial distinction for automated pipelines. The update check mechanism is designed to be non-intrusive, running at most once every seven days and skipping checks in CI environments or when streams are redirected. This ensures that the CLI remains fast and reliable in automated contexts.

What to watch

• mTLS Beta Adoption: Monitor the OpenAI Mutual TLS Beta Program for broader availability, as this will impact enterprise security configurations.
• Go Version Requirements: Ensure development environments are updated to Go 1.26+ to avoid installation issues.
• Image Model Defaults: Track changes to the default image model, as gpt-image-2.5-sunburst may be updated or replaced.
• Admin Endpoint Stability: Verify that admin commands remain stable as the CLI evolves, particularly for usage and organization management tasks.