The debesis-ccp CLI

debesis-ccp is a non-interactive command-line interface for the Debesis control plane, built for CI/CD pipelines. It authenticates every request with a scoped API token sent as a bearer credential — no login flow, no browser, no prompts, no sessions.

It is one file of Python using only the standard library. There is nothing to compile and nothing to install alongside it.

Current version: 0.4.0

Requirements

Python 3.9 or newer. That is the whole list — no third-party packages, so there is no virtualenv to create and nothing for a dependency scanner to flag.

Install

curl -fsSL https://docs.debesis.dev/cli/debesis-ccp -o debesis-ccp
curl -fsSL https://docs.debesis.dev/cli/debesis-ccp.sha256 -o debesis-ccp.sha256
shasum -a 256 -c debesis-ccp.sha256
chmod +x debesis-ccp

Verify the checksum before you run it. We publish it precisely so you do not have to trust the download.

To put it on your PATH:

sudo mv debesis-ccp /usr/local/bin/debesis-ccp
debesis-ccp version

Pinning a version

The URL above always serves the current release. In a pipeline, pin instead, so a new release cannot change your build’s behaviour without you choosing it:

curl -fsSL https://docs.debesis.dev/cli/v0.4.0/debesis-ccp -o debesis-ccp

Configure

Configuration is environment variables only — nothing is read from a config file, and nothing is written to your home directory.

Variable	Meaning
CCP_API_URL	Base URL of the Debesis API. Required.
CCP_API_TOKEN	A scoped API token (ccp_…). Required.
CCP_API_KEK	Your encryption key (base64 AES-256) for operations on encrypted values. Per-command override: --kek.
CCP_API_CA_BUNDLE	Path to a PEM your server’s TLS certificate chains to, for a private CA. Override: --ca-bundle.
CCP_API_INSECURE	Truthy skips TLS verification. Development only. Override: --insecure.

CCP_API_KEK is your key, not ours

If you supply your own encryption key, this is how a pipeline uses it. Source it from your CI secret store — never commit it, and never echo it into build logs. Debesis cannot recover it for you, which is the point: with a customer-supplied key nobody here can decrypt your secrets either.

Issue a token

A token is minted once by someone holding apitoken:create on the target project:

curl -su you@example.com -X POST "$CCP_API_URL/api/v1/api-tokens" \
  -H 'Content-Type: application/json' \
  -d '{"name":"jenkins-payments","projectId":123,"environmentId":456,
       "permissionScopes":["compute:read","compute:deploy","secret:*"],
       "expiresAt":"2027-01-01T00:00:00"}'

The token is shown exactly once

The response contains token: "ccp_…" and it is never displayed again. Put it straight into your CI credential store.

A token is scoped to one project, optionally pinned to one environment, and authenticates as a dedicated service-account identity — never as the person who created it. Revoke one at any time with DELETE /api/v1/api-tokens/{id}?organizationId=….

What a token may carry

Only allowlisted scopes: product permissions and product wildcards (compute:*, sql:*, secret:*, storage:*), plus read, create and update on projects and environments.

The API rejects at issuance, with a 400, any request for *:*, for organisation, user, billing or token administration, or for the container wildcards project:* and environment:*. Grant a pipeline only the scopes that pipeline needs.

Check it works

export CCP_API_URL=https://api.debesis.dev
export CCP_API_TOKEN=ccp_…

debesis-ccp whoami

whoami describes the token you presented — its project and environment, its scopes, its status and its expiry. It is the right first call in any pipeline: it fails loudly on a dead token instead of failing obscurely three steps later.

Next

• Command reference — every command, generated from this release.
• Using it in a pipeline — exit codes, pre-push gates, and deploys.