Log in with your API token (create one under Settings > API in your Cargo workspace):
cargo-ai login --token <your-api-token>
To target a specific workspace, set the CARGO_WORKSPACE_UUID environment variable — otherwise commands run against the token’s default workspace.
API token values are shown only once at creation time. Store them immediately
in a secrets manager (GitHub Secrets, AWS Secrets Manager, 1Password, …).
In CI or an AI coding agent, you can skip cargo-ai login entirely and set the
token via the CARGO_API_TOKEN environment variable — it takes precedence over
saved credentials: export CARGO_API_TOKEN=<your-api-token>.
cdk init writes a starter project (pass --template full for the complete, wired example described in Project layout). The blank default gives you a single cargo.ts with one AI-powered tool — it needs no third-party API keys, so you can deploy and run it with nothing but your Cargo login:
cargo.ts
import { defineTool, defineWorkflow } from "@cargo-ai/cdk";import { z } from "zod";const enrichFlow = defineWorkflow( "enrich-contact", { input: z.object({ email: z.string() }), output: z.object({ company: z.string() }), }, ({ input, ai }) => { const company = ai( `What company owns the email domain of ${input.email}? Reply with just the company name.`, ); return { company }; },);export const enrich = defineTool("enrich", { workflow: enrichFlow, description: "Enrich a contact with firmographic data.", emojiSlug: "mag",});
This reads your workspace and writes typed connector/model config and the integrations.* action registry into .cargo-ai/, so your editor autocompletes real action slugs.
cargo-ai cdk plan # offline diff — no API callscargo-ai cdk deploy # create everything; writes cargo.state.json
deploy applies in dependency order and records each resource’s real uuid in cargo.state.json. Commit that file — the next deploy only changes what changed.
cargo-ai orchestration tool list # → workflowUuidcargo-ai orchestration run create \ --workflow-uuid <uuid> \ --data '{"email":"ada@acme.com"}' \ --wait-until-finished
The run’s output includes the company name — your first deployed tool, end to end. It’s also live in your workspace at app.getcargo.io, where you can open it in the visual editor and inspect its runs.
Connectors bring your CRM, warehouse, and enrichment providers into the same file — for example HubSpot, using a private-app token kept out of git with secret():
export HUBSPOT_API_KEY=... # secret() reads this at deploy timecargo-ai cdk deploy # only the new resources are created
secret() reads from process.env at deploy time. See Secrets &
environments for secret() vs env(),
the CARGO_* variables, and deploying the same code to a second workspace.