/aem-cli

name: aem-cli
description: Use this when installing, running, or configuring the Adobe AEM CLI (@adobe/aem-cli, formerly the helix-cli npm package; commands `aem up`, `aem import`, `aem content`), when `aem up` fails (port conflicts, cert errors, proxy 404s, pipeline vs. local-file confusion), or when migrating from the old helix-cli package. Covers installation, the local Edge Delivery dev server, .env / AEM_* configuration, HTTPS/TLS, proxy and certificate trust, content sync with da.live, and troubleshooting. For da.live content-format rules or the DA Source API contract use da-content; for writing EDS block code use content-driven-development.
license: Apache-2.0
metadata:
  version: "1.0.0"

AEM CLI

Local development tool for AEM Edge Delivery Services. Three commands: `aem up` (local dev server), `aem import` (import server + UI), `aem content` (da.live content sync).

Binary: `aem` (primary), `hlx` (alias from the former `helix-cli` package, renamed to `@adobe/aem-cli` at v15.0.0).

---

1. Install

**Prerequisite:** Node.js 12.11 or newer (Node 22 LTS recommended). `[verified]`

# Global install
npm install -g @adobe/aem-cli

# One-off via npx (no global install needed)
npx -y @adobe/aem-cli up

**Verify:**

aem --version   # or: hlx --version

Migrating from the old helix-cli package

If `npm install -g @adobe/aem-cli` fails with `File exists: …/hlx`, the old package is still installed and owns the binary. Uninstall it first (npm package scoped under `@adobe`, named `helix-cli`): `[verified]`

npm uninstall -g @adobe/helix-cli
npm install -g @adobe/aem-cli

The binary name changes from `hlx` to `aem`; both work after installation because `aem-cli` ships `hlx` as an alias.

---

2. `aem up` — Local Dev Server

**Agent-standard invocation:**

aem up --no-open --forward-browser-logs

**Check the server is running:**

curl -s -o /dev/null -w "%{http_code}" http://localhost:3000
# Expected: 200

Key flags

| Flag | What it does | |---|---| | `--no-open` | Do not open a browser window on startup | | `--forward-browser-logs` | Forward browser console messages (log, error, warn, info) to the terminal | | `--port <n>` | Listen on a different port (default: `3000`) | | `--addr <addr>` | Bind address; use `*` to allow external connections (default: `127.0.0.1`) | | `--url <url>` | Origin URL to proxy content from (overrides the project's default pages URL) | | `--html-folder <dir>` | Serve local HTML files from `<dir>` without extensions | | `--html-mount <path>` | URL path where `--html-folder` files are served (default: `/<dir>`) | | `--no-livereload` | Disable automatic browser reload on file changes | | `--stop-other` | Stop another AEM CLI instance on the same port before starting (default: true) | | `--tls-cert <file>` | Path to `.pem` file for TLS (see §4) | | `--tls-key <file>` | Path to `.key` file for TLS (see §4) | | `--allow-insecure` | Allow insecure (self-signed cert) requests to the upstream server | | `--print-index` | Print indexed records for the current page (debugging) | | `--site-token <token>` | Site token for CLI access to the website | | `--cookies` | Proxy all cookies (default: only `hlx-auth-token` is proxied) |

**`--html-folder`:** without it, local HTML files are never served — all requests proxy to the remote pipeline, returning 404 for local-only paths. `[verified]`

Serving import HTML locally (preview-import pattern)

aem up --html-folder drafts --no-open --forward-browser-logs
# Files in ./drafts/ are served at /drafts/<name> (no extension needed)

---

3. `.env` Configuration

All options can be persisted in `.env` at the project root; loaded automatically. `[verified]`

# .env example
AEM_PORT=8080
AEM_PAGES_URL=https://stage.myproject.com
AEM_FORWARD_BROWSER_LOGS=true
AEM_HTML_FOLDER=drafts
AEM_TLS_CERT=server.crt
AEM_TLS_KEY=server.key
AEM_OPEN=/products

See [references/command-reference.md](./references/command-reference.md) for the complete `AEM_*` environment variable reference with defaults.

---

4. HTTPS / TLS

Trusted local certificate (recommended — avoids browser warnings)

Install `mkcert` (`brew install mkcert` on macOS, `choco install mkcert` on Windows, `go install filippo.io/mkcert@latest` elsewhere), then:

mkcert -install                                          # one-time CA install
mkcert -cert-file server.crt -key-file server.key localhost 127.0.0.1
aem up --tls-cert server.crt --tls-key server.key

Self-signed certificate (no mkcert)

openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes \
  -out server.crt -keyout server.key -subj "/CN=localhost"
aem up --tls-cert server.crt --tls-key server.key

Persisting TLS in .env

AEM_TLS_CERT=server.crt
AEM_TLS_KEY=server.key

---

5. Corporate Proxy and Certificate Trust

`aem up` fails with `unable to get local issuer certificate` behind HTTPS-intercepting proxies. Export the corporate CA cert from your browser or ask IT, then set:

# macOS / Linux
export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.crt
aem up

# Windows
set NODE_EXTRA_CA_CERTS=./certs/corporate-ca.pem
aem up

`NODE_EXTRA_CA_CERTS` is a Node built-in — set it in the shell profile or CI, not `.env`.

**Proxy env vars:**

| Variable | Purpose | |---|---| | `HTTP_PROXY` | Proxy for HTTP requests | | `HTTPS_PROXY` | Proxy for HTTPS requests | | `ALL_PROXY` | Fallback for either protocol | | `NO_PROXY` | Comma-separated hosts to bypass; `*` disables all proxies |

---

6. `aem import` — Import Server

Local import server (default port 3001) serving the helix-importer-ui.

aem import                   # opens Importer UI in browser at port 3001
aem import --no-open         # headless / background start
aem import --port 3002       # different port

**Key flags:**

| Flag | Default | What it does | |---|---|---| | `--port` | `