CLI

Overview

morpha-ui is a thin wrapper around the shadcn CLI that installs Morpha UI components from a gated registry. Free components install with no authentication; pro components require a one-time browser login. The CLI captures a short-lived token and forwards it to the registry when you run add — every other command is delegated straight to shadcn.

Installation

No install step — run it with your package manager's runner:

npx morpha-ui@latest add button

pnpm dlx morpha-ui@latest add button

bunx --bun morpha-ui@latest add button

Prerequisites

• A project with shadcn/ui configured (a valid components.json in the project root).
• Node.js ≥ 18.
• For pro components, an approved account (plan: pro).

Authentication

Morpha UI authenticates through Clerk with a browser OAuth flow:

npx morpha-ui@latest login

1. The CLI starts a temporary local server on 127.0.0.1:<random-port> and opens /cli/authorize in your browser (the URL is printed as a fallback).
2. You sign in. If your account has pro access, the page redirects back to the local server with a signed token — you never copy/paste anything.
3. The token is saved to ~/.morpha/config.json (permissions 0600).

The token is a JWT that expires after ~30 days. When it expires, add prompts you to run npx morpha-ui@latest login again.

Headless mode (CI)

When no browser is available, supply the token directly:

# paste a token captured from the authorize page
npx morpha-ui@latest login --token <jwt>

# or pass it ambiently to a single command (wins over the stored token)
MORPHA_TOKEN="$MORPHA_TOKEN" npx morpha-ui@latest add button

Commands

npx morpha-ui@latest add button                 # add a component
npx morpha-ui@latest add card --overwrite       # overwrite existing files
npx morpha-ui@latest add theme --dry-run        # preview without writing
npx morpha-ui@latest whoami                      # check plan / expiry

Configuration

Two environment variables tune the CLI:

From MORPHA_SITE_URL the CLI derives the registry (${SITE}/r) and the authorize URL (${SITE}/cli/authorize).

The token store at ~/.morpha/config.json (chmod 0600) looks like:

{
  "token": "<jwt>",
  "site": "https://morphaui.com",
  "savedAt": "2026-06-11T10:00:00.000Z",
  "exp": 1752230400
}

The token is never printed — whoami and config only show the decoded plan and exp.

Troubleshooting