CLI Reference

Every sqctl command for the SecurQbit command-line client — signing in, connecting, choosing a country, changing preferences, updating, and reading machine-readable output.

sqctl is how you drive SecurQbit from a terminal. It talks to the background service over a local socket; it holds no credentials and needs no privileges of its own. If you have not installed it yet, start with Desktop & Router Setup.

Every command accepts --json, which prints the raw document instead of the formatted output. That is the interface to script against — the human-readable layout is free to change.

At a glance

sqctl status                        is the VPN on, and as whom
sqctl login                         sign in by approving a link in your browser
sqctl logout
sqctl locations                     countries this plan can use
sqctl connect [COUNTRY] [--fastest]
sqctl disconnect
sqctl set                           show preferences
sqctl set country DE|any
sqctl set autoconnect on|off
sqctl set updates on|off
sqctl update [--check] [--yes]      install the latest version

sqctl status

Shows whether you are protected, and as whom.

$ sqctl status
 
  ● Connected      Germany
    Connected for  12m 40s
    Transferred    ↓ 148 MB   ↑ 22 MB
 
    Account        Alice  [email protected]
    Plan           Monthly
    Renews         1 September 2026

It deliberately shows nothing about how the tunnel is built — no server address, no session identifier. You cannot act on any of it, and the server address in particular is not something to leak into a screenshot when you ask for help.

If the service is not running, sqctl says so and prints the command that starts it on this machine, whichever init system that is.

Signs this computer in by approving it in a browser.

$ sqctl login
 
Open this link to approve the sign-in:
 
    https://accounts.securqbit.com/device?code=BCDF-GHJK
 
Check the page shows this code:
 
    B C D F - G H J K
 
Waiting for approval — expires in 10 minutes, Ctrl-C to cancel

Open the link — sqctl tries to open it for you, and --no-browser stops it trying — sign in if you are not already, check the code on the page matches the one in your terminal, and approve. Nothing is ever typed back into the terminal.

That comparison is the entire security of this flow.

Only approve a request you started yourself. If somebody sends you a link like this and you approve it, you have signed their computer into your account. The code and the machine name shown on the page are there so you can tell the difference.

Signing in needs an account that already exists. Create one in the iOS or Android app — including a guest account, which signs into accounts.securqbit.com with its recovery code and approves from there like any other.

sqctl logout

Turns the VPN off and signs this computer out. The tunnel comes down first, deliberately: leaving one up on credentials that have just been revoked strands your traffic on a session the server is about to drop.

A guest account is confirmed first, because without its recovery code you cannot sign back in. --force skips the prompt.

sqctl connect

sqctl connect            # your saved preference
sqctl connect DE         # appear in Germany
sqctl connect --fastest  # let SecurQbit choose

The country is a two-letter code — run sqctl locations for the ones your plan allows. Connecting takes a few seconds; the terminal follows the real state as it changes rather than sitting silent.

Trials cannot choose a country. On a trial plan, use --fastest. Naming one returns an error telling you a paid plan is needed rather than quietly connecting you somewhere else. See Account & Billing.

sqctl disconnect

Brings the tunnel down and puts your routing and DNS back the way they were.

Disconnecting is also what tells SecurQbit to stop. If a tunnel drops on its own, the service keeps working to bring it back — that is what you want on a laptop that was asleep or a router whose uplink flapped. Only sqctl disconnect, signing out, or shutting the service down clears that intent.

sqctl locations

Lists the countries your plan can use, by name.

$ sqctl locations
 
    DE             Germany
    FR             France
    NL             Netherlands
    SG             Singapore
    US             United States

sqctl set

Shows or changes your preferences. There are three, and they are the three that are genuinely yours to choose.

sqctl set                    # show all three
sqctl set country DE         # default to Germany
sqctl set country any        # default to the fastest
sqctl set autoconnect on     # connect as soon as the machine starts
sqctl set updates off        # stop checking for new versions

$ sqctl set
 
    Location       Germany (DE)
    Auto-connect   on
    Updates        on

Everything else about the tunnel — how it is built, what it uses for DNS, how it retries — is decided for you and is not reachable from the CLI. Those are not choices that improve a VPN by being offered.

updates is a setting rather than a constant because the check is a periodic call to the SecurQbit CDN, and someone running a VPN is entitled to decide against that.

sqctl update

Installs the latest version.

sqctl update            # ask, then install and restart
sqctl update --check    # only say whether there is one
sqctl update --yes      # no prompt

$ sqctl update
 
  ! Update available
 
    Installed      v1.0.0
    Latest         v1.1.0
 
  SecurQbit restarts to finish, so the VPN disconnects for a moment.
 
Install it now? [y/N]

The download is checked against the published checksums before anything is replaced, and the service restarts onto the new version. sqctl waits for it to come back and reads the version out of it, so you are told what is actually running rather than what was written to disk.

SecurQbit checks once a day on its own, and only ever tells you — a line under sqctl status:

    Update         v1.1.0 available — run: sqctl update

It never installs by itself. Finishing an update means restarting, and restarting drops whatever tunnel is up; doing that to somebody unannounced is a worse failure than leaving them a version behind.

If SecurQbit was installed by your distribution's package manager, sqctl update refuses before downloading anything and tells you to update it the way you installed it.

Scripting

--json on any command prints the wire document:

$ sqctl status --json | jq '.state, .country'
"connected"
"DE"

# Connect and check it actually worked
sqctl connect --fastest --json > /dev/null
test "$(sqctl status --json | jq -r .state)" = connected

Exit codes: 0 success, 1 the command failed, 2 the SecurQbit service is not reachable.

When something is wrong

sqctl translates failures into something you can act on, and keeps the internals out of the way. When you need the internals — for a bug report — there is a hidden diagnostics command:

sqctl debug          # versions, where everything lives, which socket answered,
                     # the tunnel engine, and the raw last error
sqctl debug probe DE # test a server end to end WITHOUT connecting

sqctl debug probe is the useful one. It starts the proxy against a real server, sends one request through it and reports the address the far side saw — but it creates no tunnel device and changes no routing, so it tells you whether the path works without costing you your internet if it does not.

Include the output of sqctl debug when you report a problem. See Troubleshooting.

Next steps

Desktop & Router Setup — installing, updating and removing.
Connecting to a Server — how server selection works.
Firewall Bypass & Obfuscation — on a restricted network.