Sume CLI: --confirm-submit vs --confirm-paid, which one when
The Sume CLI gates non-paid writes with --confirm-submit and avatar creates with --confirm-paid. Reads need neither. Here is the split, with defaults to know.
The split
The Sume CLI uses two confirmation flags, and they are not interchangeable. --confirm-submit is for writes that do not spend: cancelling a job and the asset steps assets create, assets upload-url and assets complete. --confirm-paid is for the commands that can spend: avatars create and avatar-videos create. Read commands need neither flag.
The point of two flags is that a script that uploads assets cannot spend by accident, and a spending command cannot be run by habit.
| Command | Kind | Flag |
|---|---|---|
| jobs list / get / wait | Read | None |
| assets list / get | Read | None |
| jobs cancel | Write, not paid | --confirm-submit |
| assets create / upload-url / complete | Write, not paid | --confirm-submit |
| avatars create | Paid | --confirm-paid |
| avatar-videos create | Paid | --confirm-paid |
Details that catch people
Avatar scripts run 4 to 60 seconds, and the default quality is plus. There is no sume image, sume video or sume music command: those products are REST-only and are not part of the CLI.
Because the flag is explicit, you can grep your scripts for --confirm-paid and see every line that can spend money. That is a cheap review step before a merge.
A safe wrapper habit
Run the command without the flag first. A gated command that is missing its flag stops and tells you what it needs, which is a free dry check. Add the flag only after you have read the arguments.
In CI, keep paid commands out of shared jobs. Give a paid job its own secret and a spending ceiling on the key's workspace, so a bad loop is bounded by the wallet.
- Never put
--confirm-paidin a shell alias. - Keep keys in the environment, not on the command line.
- Log job ids and statuses, not signed URLs.
How it matches the other surfaces
Hosted MCP expresses the same idea with scopes and idempotency_key, while REST uses the Idempotency-Key header. The CLI uses flags because a human or a script types the command. In all three the rule is the same: a paid action is explicit.
Review checklist
Before you merge a script, search for both flags and check that each use matches the table. A --confirm-submit on a command that actually spends is a sign the wrong tool is being called. A missing flag is a sign the step has not been run on purpose.
Also check where credentials come from. The CLI uses the key's workspace, so a script on a shared runner spends from that workspace, not from the person who started it.
- List every line with
--confirm-paid. - Check each avatar script is 4 to 60 seconds.
- Confirm no step calls
sume image,sume videoorsume music.
Keep a written record
Document the decision in the repository next to the code that makes the call, so the next engineer sees why the choice was made and which docs page it came from. Re-read that page when you upgrade a client or change a key, since gates and limits are the parts most likely to differ from what you remember.
A short note of the date you last verified the behaviour, such as 2026-10-08, is enough for a reviewer to know how fresh the claim is.
Sources
Related posts
More in Developers
- Sume Image API 400 unsupported_parameter: which field fails where
Which Sume image models list quality, resolution, mask_url, background, output_format and references, and which never do (seed, stream). Plus a check script.
- Sume image n: docs say up to 10, every catalog row says 4 or less
The Image API docs say n is 1 to 10, but each catalog row publishes its own ceiling: 4 on most, 1 on Grok Imagine. Cost is cost_usd times n. Table with prices.
- Sume job 404 for an id you created: check which member's key made it
A 404 on GET /v1/jobs/{id} can mean the job belongs to another member or workspace. A Python helper separates unknown from not visible.
- job.canceled: the third Sume terminal event your handler forgets
Sume sends job.completed, job.failed and job.canceled and nothing else. A handler that covers only two leaves canceled jobs open. Route all three, 204 the rest.
Written by Sume