# CLI Reference `sqctl` is how you drive SecurQbit from a terminal. It talks to the background service over a local socket; it holds no credentials and needs no privileges of its own. If you have not installed it yet, start with [Desktop & Router Setup](/cli-installation). Every command accepts `--json`, which prints the raw document instead of the formatted output. That is the interface to script against — the human-readable layout is free to change. ## At a glance ```text sqctl status is the VPN on, and as whom sqctl login sign in by approving a link in your browser sqctl logout sqctl locations countries this plan can use sqctl connect [COUNTRY] [--fastest] sqctl disconnect sqctl set show preferences sqctl set country DE|any sqctl set autoconnect on|off sqctl set updates on|off sqctl update [--check] [--yes] install the latest version ``` ## sqctl status Shows whether you are protected, and as whom. ```text $ sqctl status ● Connected Germany Connected for 12m 40s Transferred ↓ 148 MB ↑ 22 MB Account Alice alice@example.com Plan Monthly Renews 1 September 2026 ``` It deliberately shows nothing about how the tunnel is built — no server address, no session identifier. You cannot act on any of it, and the server address in particular is not something to leak into a screenshot when you ask for help. If the service is not running, `sqctl` says so and prints the command that starts it on *this* machine, whichever init system that is. ## sqctl login Signs this computer in by approving it in a browser. ```text $ sqctl login Open this link to approve the sign-in: https://accounts.securqbit.com/device?code=BCDF-GHJK Check the page shows this code: B C D F - G H J K Waiting for approval — expires in 10 minutes, Ctrl-C to cancel ``` Open the link — `sqctl` tries to open it for you, and `--no-browser` stops it trying — sign in if you are not already, **check the code on the page matches the one in your terminal**, and approve. Nothing is ever typed back into the terminal. That comparison is the entire security of this flow. > **Only approve a request you started yourself.** If somebody sends you a link like this and you approve it, you have signed *their* computer into *your* account. The code and the machine name shown on the page are there so you can tell the difference. Signing in needs an account that already exists. Create one in the [iOS or Android app](/installation) — including a [guest account](/anonymous-accounts), which signs into accounts.securqbit.com with its recovery code and approves from there like any other. ## sqctl logout Turns the VPN off and signs this computer out. The tunnel comes down first, deliberately: leaving one up on credentials that have just been revoked strands your traffic on a session the server is about to drop. A [guest account](/anonymous-accounts) is confirmed first, because without its recovery code you cannot sign back in. `--force` skips the prompt. ## sqctl connect ```bash sqctl connect # your saved preference sqctl connect DE # appear in Germany sqctl connect --fastest # let SecurQbit choose ``` The country is a two-letter code — run `sqctl locations` for the ones your plan allows. Connecting takes a few seconds; the terminal follows the real state as it changes rather than sitting silent. > **Trials cannot choose a country.** On a trial plan, use `--fastest`. Naming one returns an error telling you a paid plan is needed rather than quietly connecting you somewhere else. See [Account & Billing](/account-billing). ## sqctl disconnect Brings the tunnel down and puts your routing and DNS back the way they were. Disconnecting is also what tells SecurQbit to *stop*. If a tunnel drops on its own, the service keeps working to bring it back — that is what you want on a laptop that was asleep or a router whose uplink flapped. Only `sqctl disconnect`, signing out, or shutting the service down clears that intent. ## sqctl locations Lists the countries your plan can use, by name. ```text $ sqctl locations DE Germany FR France NL Netherlands SG Singapore US United States ``` ## sqctl set Shows or changes your preferences. There are three, and they are the three that are genuinely yours to choose. ```bash sqctl set # show all three sqctl set country DE # default to Germany sqctl set country any # default to the fastest sqctl set autoconnect on # connect as soon as the machine starts sqctl set updates off # stop checking for new versions ``` ```text $ sqctl set Location Germany (DE) Auto-connect on Updates on ``` Everything else about the tunnel — how it is built, what it uses for DNS, how it retries — is decided for you and is not reachable from the CLI. Those are not choices that improve a VPN by being offered. `updates` is a setting rather than a constant because the check is a periodic call to the SecurQbit CDN, and someone running a VPN is entitled to decide against that. ## sqctl update Installs the latest version. ```bash sqctl update # ask, then install and restart sqctl update --check # only say whether there is one sqctl update --yes # no prompt ``` ```text $ sqctl update ! Update available Installed v1.0.0 Latest v1.1.0 SecurQbit restarts to finish, so the VPN disconnects for a moment. Install it now? [y/N] ``` The download is checked against the published checksums before anything is replaced, and the service restarts onto the new version. `sqctl` waits for it to come back and reads the version out of it, so you are told what is actually running rather than what was written to disk. SecurQbit checks once a day on its own, and only ever tells you — a line under `sqctl status`: ```text Update v1.1.0 available — run: sqctl update ``` It never installs by itself. Finishing an update means restarting, and restarting drops whatever tunnel is up; doing that to somebody unannounced is a worse failure than leaving them a version behind. If SecurQbit was installed by your distribution's package manager, `sqctl update` refuses before downloading anything and tells you to update it the way you installed it. ## Scripting `--json` on any command prints the wire document: ```bash $ sqctl status --json | jq '.state, .country' "connected" "DE" ``` ```bash # Connect and check it actually worked sqctl connect --fastest --json > /dev/null test "$(sqctl status --json | jq -r .state)" = connected ``` Exit codes: `0` success, `1` the command failed, `2` the SecurQbit service is not reachable. ## When something is wrong `sqctl` translates failures into something you can act on, and keeps the internals out of the way. When you need the internals — for a bug report — there is a hidden diagnostics command: ```bash sqctl debug # versions, where everything lives, which socket answered, # the tunnel engine, and the raw last error sqctl debug probe DE # test a server end to end WITHOUT connecting ``` `sqctl debug probe` is the useful one. It starts the proxy against a real server, sends one request through it and reports the address the far side saw — but it creates no tunnel device and changes no routing, so it tells you whether the path works without costing you your internet if it does not. Include the output of `sqctl debug` when you report a problem. See [Troubleshooting](/troubleshooting). ## Next steps - [Desktop & Router Setup](/cli-installation) — installing, updating and removing. - [Connecting to a Server](/connecting) — how server selection works. - [Firewall Bypass & Obfuscation](/firewall-bypass) — on a restricted network.