What it can't do
proton-cli aims for parity with what the Proton web clients let you do. This page is where it falls short.
A refusal that comes from Proton rather than from proton-cli belongs to Troubleshooting instead.
Known gaps
Section titled “Known gaps”An update cannot be verified offline. proton update checks the download against checksums.txt from the same release, and neither is signed. An install from a package manager is verified by the package manager.
Only a security key you plug in can be registered. proton account settings security-keys create registers a key over USB. A built-in authenticator - Windows Hello, Touch ID, a machine’s own secure element - and a passkey held in a phone are registered in Proton’s own settings.
Post-quantum keys are read, never generated or imported. An account that opted in during Proton’s rollout signs in, and mail and shares reach others who opted in. Turning the setting on is done in Proton’s own settings. On such an account, adding an address and generating a key are refused, and a post-quantum key file is imported in a Proton client.
An account that signed up with another provider’s address is not given a Proton address, and its unverified sign-in address is not corrected. Both are done in Proton’s own settings.
Account keys are listed and exported, never generated or deleted. Generating an account key, and deleting one a password reset locked, are done in Proton’s own settings.
A recurring event needs a zone that can be named. proton reads one from TZ, /etc/localtime or /etc/timezone, then from your Proton calendar settings. Where none of those answers, a recurring event drifts by an hour when the clocks change. Pass --zone Europe/Vienna to be sure.
A time on somebody else’s booking page is booked in a browser. Open the link they sent you. Your own booking pages are made and changed with proton calendar booking-pages.
A Drive filter over a large tree is slow. Narrow it with --scope, or index the tree once with proton index create drive (Local index).
Out of scope
Section titled “Out of scope”proton-cli mirrors the Proton web clients for Mail, Drive, Calendar, Pass and Contacts.
Other Proton products are not covered: VPN, Wallet, Docs, Meet, Lumo and Authenticator. Proton VPN has its own CLI.
Endpoints that exist in the API but have no equivalent action in a web client are also out of scope.
For anything the commands do not reach, proton api sends raw authenticated requests to any endpoint.