werss-cli supports multiple configuration sources with a clear priority order:
CLI flags > Environment variables > werss.toml > .env > Built-in defaults
Higher-priority sources override lower ones. All settings are optional — you only need to provide what differs from the defaults.
werss-cli uses a secure token management system for authentication:
On the first run, you must provide credentials (username and password). These can be provided via:
- CLI flags:
werss-cli --username admin --password secret - Environment variables:
WE_API_USERNAME=admin WE_API_PASSWORD=secret - Config file: set
api.usernameandapi.passwordinwerss.toml - Interactive prompt: if no credentials are found, werss-cli will prompt for them
After the first successful authentication:
- werss-cli automatically loads the saved token from system keyring
- The token is reused for all API requests
- No credentials need to be provided (though you can override them if desired)
- Linux: Stored in GNOME Secret Service or KDE Wallet
- macOS: Stored in Keychain
- Windows: Stored in Credential Manager
This is more secure than file-based storage as the system handles encryption.
- If a token expires, werss-cli automatically attempts to refresh it
- If refresh fails, the tool falls back to re-authentication using your credentials
- This ensures uninterrupted operation even when tokens expire
CLI flags > Environment variables > werss.toml > .env > System keyring > Interactive prompt
| Flag | Env variable | Type | Default | Description |
|---|---|---|---|---|
-a, --api-base <URL> |
WE_API_BASE |
string | (empty) | wechat RSS API base URL |
-u, --username <USERNAME> |
WE_API_USERNAME |
string | (empty) | wechat RSS API username |
-p, --password <PASSWORD> |
WE_API_PASSWORD |
string | (empty) | wechat RSS API password |
| Flag | Env variable | Type | Default | Description |
|---|---|---|---|---|
-m, --mp <IDS> |
WE_TARGET_MPS |
string | all |
comma-separated MP IDs, or "all" |
-o, --output <DIR> |
WE_OUTPUT_DIR |
string | ./articles |
output directory for articles |
-w, --workspace <DIR> |
WE_WORKSPACE_DIR |
string | (empty) | also publish to <DIR>/published/YYYYMMDD/<slug>/ |
-s, --since <DATE> |
WE_SINCE |
date | (empty) | only fetch articles published since DATE (YYYY-MM-DD) |
-e, --until <DATE> |
WE_UNTIL |
date | (empty) | only fetch articles published until DATE (YYYY-MM-DD) |
-l, --limit <N> |
WE_LIMIT |
u32 | 0 |
max articles to fetch per run (0 = unlimited) |
-D, --download-images |
WE_DOWNLOAD_IMAGES |
bool | false |
download images from HTML content to local imgs/ directory |
-S, --start-page <N> |
WE_START_PAGE |
i64 | 0 |
start page for MP sync |
-E, --end-page <N> |
WE_END_PAGE |
i64 | 1 |
end page for MP sync |
| Flag | Description |
|---|---|
-c, --config <CONFIG> |
TOML config file path (default: werss.toml) |
-I, --init-config |
generate a werss.toml template and exit |
Generate a starter config:
werss-cli --init-config # creates werss.toml in CWD
werss-cli --init-config --config /path/to/werss.tomlFull annotated example:
# werss-cli configuration
[api]
base = "http://your-server:8001"
username = "your-username"
password = "your-password"
[sync]
# "all" to fetch every MP, or a list of IDs
target_mps = "all"
# target_mps = ["MP_WXS_3079106503", "MP_WXS_3540720447"]
output_dir = "./articles"
workspace_dir = ""
# Max retry count for failed articles (0 = retry forever)
max_failures = 3
# Only fetch articles published since/until this date (YYYY-MM-DD)
since = ""
until = ""
# Max number of articles to fetch per run (0 = no limit)
limit = 0
# Page range for sync (start_page=0, end_page=1 means only latest page)
start_page = 0
end_page = 1target_mps: Accepts a string ("all") or an array of IDs (["MP_WXS_123", "MP_WXS_456"]). This flexibility is handled by theTomlVecOrStringtype.max_failures: Maximum retry attempts for failed articles. Default is3. Set to0to retry forever.since/until: Date filtering inYYYY-MM-DDformat. Articles are filtered bypublish_time.start_page/end_page: Controls the page range passed to the MP sync endpoint. Default0..1fetches only the latest page.
All CLI flags have equivalent environment variables:
WE_API_BASE=http://10.0.0.1:8001
WE_API_USERNAME=admin
WE_API_PASSWORD=secret
WE_TARGET_MPS=all
WE_OUTPUT_DIR=./articles
WE_WORKSPACE_DIR=
WE_SINCE=2026-01-01
WE_UNTIL=2026-03-31
WE_LIMIT=10
WE_DOWNLOAD_IMAGES=false
WE_START_PAGE=0
WE_END_PAGE=1Usage:
WE_API_BASE=http://10.0.0.1:8001 WE_TARGET_MPS=all werss-cliwerss-cli automatically loads .env from:
- The current working directory
../werss/.env(relative to the project root)
Example .env:
WE_API_BASE=http://192.168.110.2:8001
WE_API_USERNAME=admin
WE_API_PASSWORD=admin@123
WE_TARGET_MPS=all
WE_OUTPUT_DIR=./articlesNote: Prefer
werss.tomlor environment variables for new setups. The.envsupport exists for backwards compatibility.
The absolute minimum required to run werss-cli:
werss-cli --api-base http://localhost:8001 --username admin --password secretOr via werss.toml:
[api]
base = "http://localhost:8001"
username = "admin"
password = "secret"With target_mps = "all" (the default), werss-cli will fetch all public accounts from the server.