OpenAI's New CLI Is Apache-2.0 and Written in Go, but Its README and Docs Disagree on the Go Version
Software / news
OpenAI's New CLI Is Apache-2.0 and Written in Go, but Its README and Docs Disagree on the Go Version
The openai/openai-cli repository drew 202 points on Hacker News on Oct. 22, and its own documentation carries two shutdown dates for audio models.
OpenAI published openai-cli, an official command-line client for its REST API, under the Apache-2.0 licence, and it reached 202 points on Hacker News on Oct. 22. The repository README says it requires Go 1.26 or later to install from source. OpenAI's documentation page for the same tool says Go 1.25.
The repository showed 999 stars, 83 forks, 4 open issues and 23 open pull requests when fetched on Oct. 22. Its Releases section was empty in that capture, so a Go install from @latest pulls whatever is on the default branch.
What the CLI does
Commands follow a resource pattern, openai <resource> [subresource...] <command> [flags...]. The README example is openai responses create --input "Say this is a test" --model gpt-5.5. Other commands cover file upload and download, image generation and editing, model listing and admin usage reports.
Install is brew install openai/tools/openai or go install 'github.com/openai/openai-cli/cmd/openai@latest'. Standard endpoints read OPENAI_API_KEY, admin endpoints read OPENAI_ADMIN_KEY, and OPENAI_BASE_URL points it at another host. Mutual TLS is listed as beta.
The docs page adds that older Python SDK versions also installed a legacy openai command. A shell that resolves the old binary will not match the guide.
Where the two OpenAI pages differ
The Go requirement is one. Another is image output. The README says openai images generate saves images to ~/Downloads/gpt-images/ by default. The docs page says image commands "do not yet have native --output support," so users must decode the b64_json payload themselves.
Debug logging is a third. The README warns that --debug logs HTTP request and response bodies and that logs may contain sensitive data. The docs say "Authorization is redacted; review headers before sharing logs." Those statements can both be true, since bodies are not headers, but neither page reconciles them.
| Topic | README | Docs page |
|---|---|---|
| Minimum Go version | 1.26 | 1.25 |
| Image output | Saved to ~/Downloads/gpt-images/ | No native --output flag |
| Debug logs | Bodies logged, may be sensitive | Authorization redacted |
Dates in the docs to plan around
The docs page lists two shutdowns. The gpt-4o-mini-tts speech model "will shut down on January 6, 2027", and migration goes through the Realtime API to gpt-realtime-2.1-mini, since changing only the model ID is not supported. whisper-1 and gpt-4o-transcribe-diarize shut down on Feb. 26, 2027.
The README adds two behaviours worth knowing. Interactive runs check GitHub release metadata at most once a day, and the CLI "never installs updates automatically." OPENAI_CLI_NO_UPDATE_CHECK=1 turns the check off.
Pull requests are limited to repository collaborators. Outside users are told to file issues.
How Hacker News received it
The Hacker News thread split. User hahahacorn was "surprised this wasn't available sooner." User bluegatty objected that a "2 trillion dollar company can't put 1 single sentence describing what something is, why it's useful" in the README.
Others asked when to use it instead of Codex, and whether it draws on subscription quota or API credits. The README answers neither question. One commenter, kristopolous, said they built a similar tool called llcat over the past year.
Related coverage includes Google Cloud's private-preview listing of OpenAI models and OpenAI's PHP vulnerability claims.
No release tag exists yet, so the first versioned build is the milestone to watch, along with which Go version the maintainers settle on.
Sources
More in Software
- 01UUIDv7 Guarantees Uniqueness and Little Else, and Python 3.14's Generator Kept Running Ahead of a Reset ClockRobert Alexander's Oct. 19 post sets RFC 9562's own wording against the ordering, timestamp and unguessability assumptions developers make.
- 02Postgres recovery_prefetch Stalled Writes for Over 30 Minutes in a Synchronous-Replication TestJeremy Schneider's Oct. 20 reproduction kills a standby's walreceiver on a 500-IOPS replica; with prefetch off, the same update applied in under 10 minutes.
- 03Cloudflare's Security-Audit Skill Started as 450 Lines, and Its Own Numbers Show One Run Finds About Half the BugsThe MIT-licensed skill topped GitHub trending on Oct. 23; Cloudflare's June post on the harness behind it reports 7,245 actionable findings from 128 repositories and claims no false-negative rate.
- 04Chrome's HTML-in-Canvas Trial Runs in Versions 148 to 150, and Chrome's Post and the Spec Name the API DifferentlyThe API draws live DOM, form fields included, into 2D, WebGL and WebGPU canvases; Google's post carries no trial dates and a May 19 update stamp.