---
name: unseal-space
description: Use unseal-space to create, iterate on, preview, and publish websites; purchase domains; or connect domains owned at another registrar.
---

# unseal-space

Use the `unseal-space` standalone binary to create, iterate on, preview, and publish websites. It does not require Node.js or Bun.

## Setup

Install on macOS or Linux:

```sh
curl -fsSL https://assets.unseal.space/cli/install.sh | sh
```

On Windows, run `irm https://assets.unseal.space/cli/install.ps1 | iex` in PowerShell.

Set the provided `UNSEAL_SPACE_API_KEY`, then run `unseal-space --help`. The CLI's progressively disclosed help is the source of truth for current commands, options, outputs, and required permissions.

## Operate

1. **Discover.** Run `unseal-space --help`, then `unseal-space <group> <command> --help`. This step is complete when the exact command path, required options, output event, and confirmation flags are known.
2. **Execute.** Run the selected command. Reuse an idempotency key only when retrying the exact same mutation; use a new key when any argument changes. This step is complete when the CLI returns a structured success event or a recovery action.
3. **Verify.** Read the resulting resource or wait for its terminal state. Pair `message send` with `message wait`, and `deployment create` with `deployment wait`. This step is complete when returned IDs and state match the requested project, message, deployment, or domain.

## Environment

Configure external services (database URLs, API keys) with the `env` command group: `env list`, `env set`, `env targets`, `env rm`, and `env import`. Values are write-only: they can be replaced or removed but never read back, and no output ever contains a value — pipe values in via stdin or `--value-file`. After a write, poll `unseal-space env list` until `stale` clears to confirm the Preview dev server restarted with the new variables. Production only picks Environment changes up on the next `unseal-space publish`.

## Versions

`unseal-space version restore` rewrites the project's working tree back to a historical version from `unseal-space version list`. `unseal-space deployment create --version` deploys a historical version without touching the working tree. Do not mix the two: restore changes what you keep building on, `--version` only changes what production serves.

## Classify domains before routing

A hostname's acquisition source selects its command group. Inspect both inventories before any routing change:

```sh
unseal-space domain list
unseal-space connected-domain list
```

| Exact hostname match    | Meaning                                                  | Routing command                                                                                                                                          |
| ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `domain list`           | Purchased through unseal-space                           | `unseal-space domain bind`                                                                                                                               |
| `connected-domain list` | Owned at another registrar and connected to unseal-space | `unseal-space connected-domain assign`                                                                                                                   |
| Neither list            | Not yet managed                                          | Use `unseal-space connected-domain connect` for a hostname the user already owns, or the `unseal-space domain search` and purchase flow for a new domain |

The dashboard's **Connected** section maps to the `connected-domain` command group. Changing its project is an `assign`, including when it already has a project.

If the exact hostname appears in both lists, treat it as a data conflict: report both records and resolve ownership before mutation. Classification is complete only when the normalized hostname has exactly one source, or the user has explicitly chosen the connect-versus-purchase branch.

Keep the classification fixed when a permission check fails. Registered-domain routing requires `registeredDomains:read` and `registeredDomains:bind`; connected-domain routing requires `connectedDomains:read` and `connectedDomains:assign`.