# CLI 0.3.0

[Read this page in HTML](https://www.scopedb.io/docs/release-notes/2026-11-08-cli-0-3-0)

Published: 2026-11-08

ScopeDB CLI 0.3.0 is available in public preview. This update follows [CLI 0.2.0](https://www.scopedb.io/docs/release-notes/2026-10-25-cli-0-2-0.md) and signs data commands in with a CI job's OIDC token instead of a stored login or API key.

## What's changed since 0.2.0

* `scope query`, `scope catalog`, and `scope doctor` authenticate in CI without a stored login: set `SCOPEDB_WORKSPACE_ID` and `SCOPEDB_OIDC_TOKEN`, and the CLI exchanges the token for a short-lived workspace credential that is never written to disk. On GitHub Actions, the [scopedb/login-action](https://github.com/scopedb/login-action) action supplies the token. A workspace owner first creates a matching OpenID Connect trust policy in the Console under **Credentials** → **OpenID Connect**; see [OIDC sign-in](https://www.scopedb.io/docs/guides/scopedb-cli/automation.md#sign-in-with-oidc).
* `scope workspace use <id>` and `scope auth login --workspace <id>` require a workspace ID. Display names are no longer accepted; use `scope workspace list` to find the ID.
* The CLI configuration directory override is renamed from `SCOPEDB_CONFIG_DIR` to `SCOPEDB_HOME`. The CLI no longer reads the old name; default storage locations are unchanged.
* `scope query`, `scope catalog`, and `scope doctor` no longer read `SCOPEDB_ENDPOINT` and `SCOPEDB_API_KEY`; they always use your CLI login, or the OIDC token when no login exists. `scope auth status` no longer reports `environment` as its `credential_source`, and catalog plans no longer contain `credential_hash`. The variables can stay set for SDK applications.
* `scope api-key create` gives keys created without `--expires-in` or `--expires-at` a default expiration and reports it on stderr.
* Source installations require Go 1.27.3 or newer.

## Upgrade

Choose the steps for your installed CLI, shown by `scope version`:

* **CI jobs that set `SCOPEDB_ENDPOINT` and `SCOPEDB_API_KEY`:** switch to [OIDC sign-in](https://www.scopedb.io/docs/guides/scopedb-cli/automation.md#sign-in-with-oidc), or run `scope auth login` on a managed host where a stored login is acceptable. Application SDKs keep using the endpoint and key.
* **Scripts that select workspaces by name:** use IDs from `scope workspace list` in `scope workspace use` and `scope auth login --workspace`.
* **`SCOPEDB_CONFIG_DIR`:** rename it to `SCOPEDB_HOME` with the same directory.
* **Saved catalog plans:** plans created while environment credentials were set contain `credential_hash`; regenerate them with `scope catalog plan` before applying.
* **API key scripts:** pass `--expires-in` or `--expires-at` explicitly to choose the expiration.

To install this version from source with Go 1.27.3 or later:

```bash
go install github.com/scopedb/scopedb-cli/cmd/scope@v0.3.0
scope version
```

For the current CLI's prebuilt archives and checksum verification, follow the [installation guide](https://www.scopedb.io/docs/guides/scopedb-cli.md#install).

## Related contents

* [ScopeDB CLI](https://www.scopedb.io/docs/guides/scopedb-cli.md)

* [CLI 0.2.0](https://www.scopedb.io/docs/release-notes/2026-10-25-cli-0-2-0.md)

* [All release notes](https://www.scopedb.io/docs/release-notes.md)