# rivr api, rivr orders and rivr whoami run with an organisation key, for CI

- Date: 2026-10-28
- Type: New
- Surface: Developer portal and CLI
- What you need to do: Nothing.
- Address: https://developers.rivr.io/changelog/2026-10-28-cli-org-key-mode

In CI there is no browser to sign in with, so the CLI could not be used there. `rivr api`, `rivr orders get|cancel|refund|list` and `rivr whoami` now run with an organisation key when `RIVR_CLIENT_ID` and `RIVR_CLIENT_SECRET` are both set in the environment. The key is swapped for a short-lived token at rivr-auth, with a form-encoded `client_credentials` request that carries `resource=https://api.rivr.io`, and the calls go straight to the API (`https://api.test.rivr.io` in the sandbox); `..`, encoded dots and whole addresses are refused before anything is sent. `--merchant <id>`, or `--organization <id>`, which is the same option, becomes the `Rivr-Organization` header. `rivr whoami` prints the key's `client_id` and the organisations it reaches. The secret is read from the environment and is never an option, since an option ends up in your shell history. The token is kept in memory for the run and never written to disk or to `config.json`; neither it nor the secret is printed, not even in an error message. A `400` or `401` from the token endpoint exits with 1 and names the OAuth error code, such as `invalid_client`. With only one of the two variables set the command stops and says which one is missing: it does not fall back on a portal sign-in. The answer, the `Rivr-Request-Id`, the `Idempotency-Key` that `cancel` and `refund` send and the exit codes (1 for a 4xx or 5xx) are the same as when you are signed in. `RIVR_TOKEN_URL` and `RIVR_API_BASE` replace the two addresses. `rivr listen`, `rivr trigger` and `rivr logs` still need the portal sign-in and refuse to run while the key is set. `cli/README.md` has a new section, In CI, with an example for GitHub Actions. The CLI is now version 0.3.0: run the install command again to get it.