> For the complete documentation index, see [llms.txt](https://docs.bito.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bito.ai/governor/available-commands.md).

# Available commands

Quick reference for every Bito Governor command, for both the Docker and the Kubernetes self-hosted deployments.

This page is a quick reference for the commands that run and operate a self-hosted Bito Governor, whether you run it with Docker on a single machine or with Kubernetes in a cluster.

Each deployment uses a different set of commands, so go to the section that matches yours:

1. [**Commands for self-hosted Bito Governor with Docker**](#commands-for-self-hosted-bito-governor-with-docker), for an install on a single machine, using `bito-gateway-ctl`.
2. [**Commands for self-hosted Bito Governor with Kubernetes**](#commands-for-self-hosted-bito-governor-with-kubernetes), for an install in a cluster, using `helm` and `kubectl`.

{% hint style="info" %}
**Note:** The [Bito-hosted deployment](/governor/set-up-bito-governor-bito-hosted.md) needs no commands. Bito operates the infrastructure, and you configure everything in the admin UI.
{% endhint %}

Both self-hosted deployments run the same `gwctl` command inside the gateway, so each section repeats it with the prefix that deployment needs.

The examples use `bito-gateway` as the namespace and `gw` as the Helm release name, matching the setup guides. Substitute your own where they differ.

For the full setup procedures, see [Set up Bito Governor (self-hosted with Docker)](/governor/set-up-bito-governor-self-hosted-with-docker.md) and [Set up Bito Governor (self-hosted with Kubernetes)](/governor/set-up-bito-governor-self-hosted-with-kubernetes.md).

***

## Commands for self-hosted Bito Governor with Docker

#### Install

| Command                                                                     | What it does                                 |
| --------------------------------------------------------------------------- | -------------------------------------------- |
| `curl -fsSL https://gwinstall.bito.ai/latest/install-standalone.sh \| bash` | Installs Governor on Linux or macOS.         |
| `irm https://gwinstall.bito.ai/latest/install-standalone.ps1 \| iex`        | Installs Governor on Windows, in PowerShell. |

Everything installs under `~/.bito-gateway`, or `%USERPROFILE%\.bito-gateway` on Windows. Set `BITO_GW_HOME` to install elsewhere, and `PORT` to serve on a port other than 8788.

#### Manage the service

`bito-gateway-ctl` is installed on your PATH, including on Windows through a `.cmd` shim, and runs from any directory.

<table data-search="false"><thead><tr><th>Command</th><th>What it does</th></tr></thead><tbody><tr><td><code>bito-gateway-ctl status</code></td><td>Reports whether Governor is running.</td></tr><tr><td><code>bito-gateway-ctl health</code></td><td>Runs the <code>/healthz</code> check and a deep self-check.</td></tr><tr><td><code>bito-gateway-ctl logs</code></td><td>Follows the gateway logs. Press Ctrl+C to stop.</td></tr><tr><td><code>bito-gateway-ctl start</code></td><td>Starts Governor, and applies any changes to the <code>.env</code> file.</td></tr><tr><td><code>bito-gateway-ctl stop</code></td><td>Stops Governor and keeps your data.</td></tr><tr><td><code>bito-gateway-ctl restart</code></td><td>Restarts Governor.</td></tr><tr><td><code>bito-gateway-ctl update</code></td><td>Pulls a newer image and restarts.</td></tr></tbody></table>

#### Configure from the command line

`gwctl` lives inside the gateway container, and `bito-gateway-ctl` forwards to it.

| Command                                 | What it does                                                                                                          |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `bito-gateway-ctl gwctl quickstart`     | Walks through creating a workspace, key, provider account, and route.                                                 |
| `bito-gateway-ctl gwctl connect <tool>` | Prints the setup for a coding tool. Accepts `claude`, `cursor`, `codex`, `copilot`, `cline`, `continue`, and `aider`. |
| `bito-gateway-ctl gwctl doctor`         | Validates the database, schema, and key encryption key.                                                               |
| `bito-gateway-ctl gwctl <command> -h`   | Shows help for any command.                                                                                           |

#### Manage admins

| Command                                                                 | What it does                                              |
| ----------------------------------------------------------------------- | --------------------------------------------------------- |
| `bito-gateway-ctl gwctl admin create --role global`                     | Creates an admin with full access. Prints the token once. |
| `bito-gateway-ctl gwctl admin create --role workspace --workspace <id>` | Creates an admin scoped to one workspace.                 |
| `bito-gateway-ctl gwctl admin list`                                     | Lists existing admins.                                    |
| `bito-gateway-ctl gwctl admin revoke <id>`                              | Revokes an admin.                                         |

#### Back up

| Command                               | What it does                                                                            |
| ------------------------------------- | --------------------------------------------------------------------------------------- |
| `mysqldump bito_gateway > backup.sql` | Backs up every workspace, key, account, route, and your encrypted provider credentials. |

Back up `CRYPTO_ENV_KEK_KEY` from `~/.bito-gateway/.env` alongside the dump. Without it, the credentials in the dump cannot be decrypted.

#### Uninstall

| Command                              | What it does                                                                       |
| ------------------------------------ | ---------------------------------------------------------------------------------- |
| `bito-gateway-ctl uninstall`         | Removes the containers and keeps your database volume and secrets.                 |
| `bito-gateway-ctl uninstall --purge` | Also deletes the database volume and the key encryption key. This is irreversible. |

#### Native systemd installs

On a native systemd install rather than Docker, manage the service directly. `gwctl` is on your PATH, so call it without the wrapper.

| Command                             | What it does                                                   |
| ----------------------------------- | -------------------------------------------------------------- |
| `sudo systemctl start bito-gateway` | Starts Governor. Also accepts `stop`, `restart`, and `status`. |
| `journalctl -u bito-gateway -f`     | Follows the logs.                                              |

***

## Commands for self-hosted Bito Governor with Kubernetes

#### Check your cluster first

| Command                          | What it does                                                                   |
| -------------------------------- | ------------------------------------------------------------------------------ |
| `kubectl config current-context` | Shows which cluster your commands will apply to. Check this before installing. |
| `kubectl config get-contexts`    | Lists every cluster you can reach.                                             |

#### Install

```bash
kubectl create namespace bito-gateway
```

```bash
kubectl create secret generic bito-gateway-secrets \
  --namespace bito-gateway \
  --from-literal=DB_PASSWORD="$(openssl rand -base64 24 | tr -d '/+=')" \
  --from-literal=CRYPTO_ENV_KEK_KEY="$(openssl rand -base64 32)" \
  --from-literal=MYSQL_ROOT_PASSWORD="$(openssl rand -base64 24 | tr -d '/+=')" \
  --from-literal=ADMIN_TOKEN="$(openssl rand -base64 32 | tr -d '/+=')"
```

```bash
helm install gw oci://registry-1.docker.io/bitoai/bito-gateway-helm \
  --namespace bito-gateway \
  --set secrets.existingSecret=bito-gateway-secrets
```

| Command                                                                                                          | What it does                                                         |
| ---------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
| `helm install gw oci://registry-1.docker.io/bitoai/bito-gateway-helm --namespace bito-gateway -f my-values.yaml` | Installs with your own values file.                                  |
| `helm show chart oci://registry-1.docker.io/bitoai/bito-gateway-helm`                                            | Shows what a chart version contains, without installing it.          |
| `helm pull oci://registry-1.docker.io/bitoai/bito-gateway-helm --untar`                                          | Downloads and unpacks the chart, including the example values files. |
| `ls bito-gateway-helm/values-*.yaml`                                                                             | Lists the example values files after unpacking.                      |

Add `--version X.Y.Z` to any of these to pin a chart version.

#### Check the deployment

| Command                                                                      | What it does                                                                   |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
| `kubectl -n bito-gateway rollout status deploy/gw-bito-gateway --timeout=5m` | Waits for the gateway to finish rolling out.                                   |
| `kubectl -n bito-gateway get pods`                                           | Lists every pod and its status.                                                |
| `kubectl -n bito-gateway get svc`                                            | Lists the services and their cluster IPs.                                      |
| `kubectl -n bito-gateway logs deploy/gw-bito-gateway`                        | Shows the gateway logs.                                                        |
| `kubectl -n bito-gateway logs deploy/gw-bito-gateway-mysql`                  | Shows the database logs.                                                       |
| `helm list -n bito-gateway`                                                  | Lists the Helm releases in the namespace, with their status and chart version. |

#### Reach the gateway

| Command                                                                                                  | What it does                                                                                        |
| -------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| `kubectl -n bito-gateway port-forward svc/gw-bito-gateway 8788:8788`                                     | Makes Governor available on your own machine at `http://localhost:8788`, while the command runs.    |
| `kubectl -n bito-gateway get secret bito-gateway-secrets -o jsonpath='{.data.ADMIN_TOKEN}' \| base64 -d` | Prints your admin token. Kubernetes stores Secret values base64 encoded, so `base64 -d` decodes it. |

#### Configure from the command line

`gwctl` ships inside the gateway image and reads the database settings the pod already has. Substitute the workspace ID that `workspace create` prints.

| Command                                                                                                                                    | What it does                                            |
| ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------- |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl workspace create --name demo`                                                | Creates a workspace and prints its ID.                  |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl key create --workspace <ID> --name demo`                                     | Creates a gateway key. Prints the `gw_sk_` key once.    |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl account add --workspace <ID> --provider anthropic --key <YOUR PROVIDER KEY>` | Adds a provider account.                                |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl route add --workspace <ID> --alias '*' --provider anthropic`                 | Adds a route.                                           |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl connect <tool>`                                                              | Prints the setup for a coding tool.                     |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl doctor`                                                                      | Validates the database, schema, and key encryption key. |

#### Manage admins

| Command                                                                                                       | What it does                                              |
| ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl admin create --role global`                     | Creates an admin with full access. Prints the token once. |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl admin create --role workspace --workspace <id>` | Creates an admin scoped to one workspace.                 |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl admin list`                                     | Lists existing admins.                                    |
| `kubectl -n bito-gateway exec deploy/gw-bito-gateway -- gwctl admin revoke <id>`                              | Revokes an admin.                                         |

#### Upgrade and roll back

```bash
helm upgrade gw oci://registry-1.docker.io/bitoai/bito-gateway-helm \
  --namespace bito-gateway -f my-values.yaml --timeout 1800s
```

| Command                                                          | What it does                                                                                                   |
| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| `kubectl -n bito-gateway rollout restart deploy/gw-bito-gateway` | Rolls the pods. Run this after rotating a value in a Secret you own, because the chart cannot see that change. |
| `helm rollback gw <revision> -n bito-gateway`                    | Returns the pods to a previous revision. The database keeps the newer schema.                                  |
| `helm history gw -n bito-gateway`                                | Lists the revisions you can roll back to.                                                                      |

{% hint style="info" %}
Pass no new secret values on upgrade. Both `DB_PASSWORD` and `CRYPTO_ENV_KEK_KEY` are fixed after the first install.
{% endhint %}

#### Uninstall

| Command                                                                                                         | What it does                                                                                  |
| --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
| `helm uninstall gw -n bito-gateway`                                                                             | Removes the release and keeps your data. The PersistentVolumeClaims are annotated to be kept. |
| `kubectl -n bito-gateway delete pvc gw-bito-gateway-mysql`                                                      | Deletes the database volume. This is irreversible.                                            |
| `kubectl -n bito-gateway delete pvc gw-bito-gateway-redis`                                                      | Deletes the counter store volume.                                                             |
| `kubectl -n bito-gateway delete job,configmap,serviceaccount,secret gw-bito-gateway-migrate --ignore-not-found` | Removes the migration objects, which Helm leaves behind.                                      |

***

## What's next

* [Governor overview](/governor/overview.md)
* [Set up Bito Governor (Bito-hosted)](/governor/set-up-bito-governor-bito-hosted.md)
* [Set up Bito Governor (self-hosted with Docker)](/governor/set-up-bito-governor-self-hosted-with-docker.md)
* [Set up Bito Governor (self-hosted with Kubernetes)](/governor/set-up-bito-governor-self-hosted-with-kubernetes.md)
* Contact <support@bito.ai> for deployment assistance


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bito.ai/governor/available-commands.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.