> ## Documentation Index
> Fetch the complete documentation index at: https://docs.helix-db.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Helix Cloud CLI workflow

> Authenticate, link, query, and manage Cloud resources

<div className="flex flex-wrap gap-2"><Badge color="blue" size="sm">Guide</Badge></div>

<Steps>
  <Step title="Authenticate with WorkOS">
    ```bash theme={"languages":{"custom":["languages/helixql.json"]}}
    helix auth login
    helix auth status
    ```
  </Step>

  <Step title="Discover a target">
    ```bash theme={"languages":{"custom":["languages/helixql.json"]}}
    helix workspace list
    helix project list --workspace-id <workspace-id>
    helix database list --project <project-id>
    ```
  </Step>

  <Step title="Link the current project and database">
    ```bash theme={"languages":{"custom":["languages/helixql.json"]}}
    helix project link <project-id>
    helix add cloud --name production --database tenant:<tenant-id>
    ```
  </Step>

  <Step title="Run a query through the broker">
    ```bash theme={"languages":{"custom":["languages/helixql.json"]}}
    helix query production --file request.json
    helix shell production
    ```
  </Step>
</Steps>

The WorkOS session identifies the user. `database.query.read` or `database.query.write` independently
authorizes the selected database; project-management access does not imply query access. The backend
forwards the authorized request using the existing cluster-scoped operational gateway key and, for a
tenant database, the exact tenant header. The CLI never receives that key and never contacts the
gateway directly.

Owners/admins have both query scopes by default. Members have neither unless explicitly granted.
Local queries keep the current local auth-disabled path.

Use `helix database key` only to create application keys for direct gateway clients. Use
`helix service-credential` only to manage headless API/MCP credentials. Neither is a CLI login method.