Quickstart

1. Get a MuleRun API key

cli2api authenticates with a muk- API key — a stable, long-lived, per-account key. Pick whichever flow fits your machine:

# Install the MuleRun CLI once, then log in via browser.
npm i -g @mulerunai/cli
mulerun login

# cli2api reads ~/.config/mulerun/oauth_cache.json, exchanges the
# JWT → muk- on startup, refreshes the JWT when it expires, and
# caches the muk- back into the same file for instant subsequent
# starts. Nothing else to set.
./cli2api

# Capture the muk- key once with the bundled helper, paste into env.
# Prereq: mulerun CLI installed + `mulerun login` done.
export MULERUN_TOKEN=$(curl -fsSL \
  https://raw.githubusercontent.com/yeagoo/MuleRunCLI2API/master/scripts/get-muk-key.sh \
  | bash)

./cli2api    # token_source=env:MULERUN_TOKEN

# If you already have a muk- (e.g. from a teammate or vault).
export MULERUN_TOKEN=muk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
./cli2api

Which to pick

A — laptop / dev machine: zero static secret, auto-refresh, JWT and muk- live in the cache file mulerun login already wrote.
B — container / CI / production systemd: one stable env var, no filesystem dep, no mulerun CLI in the runtime image.
C — multi-tenant or vault-backed: bring your own key.

The mulerun login token alone is NOT a `muk-` key

mulerun login caches an OAuth/JWT session token; MuleRun's gateway only accepts muk- keys. cli2api v0.2.0+ exchanges the JWT for a muk- at startup (flow A above), but if you set MULERUN_TOKEN=eyJ... manually without the exchange succeeding, every upstream call 401s. See Troubleshooting → getting your muk- key.

2. Build and start

curl -sSL -o cli2api \
  https://github.com/yeagoo/MuleRunCLI2API/releases/latest/download/cli2api-linux-amd64
chmod +x cli2api
./cli2api

git clone https://github.com/yeagoo/MuleRunCLI2API cli2api && cd cli2api
make build     # version stamped from the git tag
./bin/cli2api

On startup you'll see:

{"level":"INFO","msg":"startup","version":"v0.1.0","addr":":51222",
 "registered_models":61,"jobstore":"memory","auth_required":false,
 "token_source":"file:/home/you/.config/mulerun/oauth_cache.json"}

The token_source field tells you where the credential came from. If startup fails with no mulerun credentials found, run mulerun login or set MULERUN_TOKEN.

3. First call

curl http://localhost:51222/v1/images/generations \
  -H "Content-Type: application/json" \
  -d '{"model":"wan2.6-t2i","prompt":"a synthwave fox","size":"1024x1024"}'
# → {"created":1733...,"data":[{"url":"https://cdn.mulerun.com/..."}]}

Done.

4. (Optional) Inbound auth

No auth by default — fine for local use. To expose it publicly, add an allow-list:

CLI2API_API_KEYS=sk-team1,sk-team2 ./cli2api

Every request must then carry Authorization: Bearer sk-team1 (OpenAI style) or x-api-key: sk-team1 (Anthropic style).

1. Get a MuleRun API key

2. Build and start

3. First call

4. (Optional) Inbound auth

On this page