Your company, from the command line.

Orders, customers, invoices, appointments and more — the Pixelbase API as commands you can pipe. Sign in once from your browser, pin a company and a location, and the IDs every call needs are filled in for you.

Needs Node 18.17 or newer. One self-contained executable — no package manager, no dependency tree.

Setting up an AI agent rather than yourself? Start here

Sign in once. Then stop repeating yourself.

Most endpoints want a locationId, and threading one through every call is the tax you normally pay for a REST API. Pin the company and location once and it is filled in for you — in query strings and request bodies alike. Anything you pass explicitly still wins.

One sign-in reaches every company you approved it for. pxb company use switches which one you are acting in, and drops the pinned location as it goes, so the wrong context never carries across.

~/acmezsh
$ pxb auth
Opening your browser to approve the sign-in... ok
$ pxb company use acme
$ pxb location use headquarters
$ pxb customer list -q limit=5
200 GET customers using locationId=Headquarters (loc_abc123)
$ pxb thread message conv_1 "Any update on this?"

Built to be piped.

The response body goes to stdout and the status line to stderr, so | jq works without a flag — and --json drops the status line entirely for when you are capturing both.

Exit codes are meaningful: zero on success, one on any error, including a 4xx. So && and || are enough for control flow, and a failed step stops a chain instead of corrupting the next one.

~/acmezsh
$ pxb customer list | jq -r '.content.customers[].fullname'
Ada Lovelace Grace Hopper Alan Turing
$ pxb order list --json -q status=PAYMENT_PENDING \ && pxb appointment list --json -q status=CONFIRMED

Least privilege, without the ceremony.

When you approve a sign-in you choose what it may do, company by company — starting from nothing, and never beyond what you can do yourself. So the session that reads orders and replies in threads cannot reprice your catalog, whatever it is asked to do. Each machine gets its own, listed under Dev Tools, and you can disconnect one without disturbing the rest. CI, with no browser to approve in, uses a company API client the same way.

Tokens live in the OS keychain and are handed to it over stdin, never as a command line argument where ps or your shell history would keep a copy. They are short-lived and refreshed for you.

How signing in works

least privilegezsh
$ pxb whoami --json | jq -r '.content.token.scopes[]'
orders:read threads:read threads:write
$ pxb product list
403 GET products
Access token is missing required scope(s): products:read

Install it in one line.

Sign in, pin a company, and your first call is about thirty seconds away.