diff --git a/docs.json b/docs.json
index c0d40d2..1e5d4a6 100644
--- a/docs.json
+++ b/docs.json
@@ -126,7 +126,10 @@
         "tab": "CLI",
         "icon": "terminal",
         "pages": [
-          "reference/cli"
+          "reference/cli",
+          "reference/cli/auth",
+          "reference/cli/browsers",
+          "reference/cli/apps"
         ]
       }
     ]
diff --git a/reference/cli.mdx b/reference/cli.mdx
index 8f032a0..de36ac6 100644
--- a/reference/cli.mdx
+++ b/reference/cli.mdx
@@ -6,8 +6,6 @@ The Kernel CLI helps you access and manage your Kernel resources.
 
 ## Installation
 
-Install the Kernel CLI using your favorite package manager:
-
 ```bash
 # Using brew
 brew install onkernel/tap/kernel
@@ -19,94 +17,44 @@ pnpm install -g @onkernel/cli
 npm install -g @onkernel/cli
 ```
 
-## Authentication
-
-The Kernel CLI supports two authentication methods:
-
-### OAuth 2.0 (Recommended)
-
-The preferred method is OAuth 2.0 with PKCE, which provides secure browser-based authentication:
+Verify installation:
 
 ```bash
-kernel login
+which kernel
+kernel --version
 ```
 
-This opens your browser to complete the OAuth flow. Your tokens are securely stored in your system keychain (macOS/Windows) or a local file (Linux).
-
-### API Key
+<Columns cols={2}>
+  <Card icon="key" title="Authentication" href="/reference/cli/auth">
+    Login, logout, and check auth status.
+  </Card>
+  <Card icon="browsers" title="Browsers" href="/reference/cli/browsers">
+    Create, view, and manage Kernel browsers.
+  </Card>
+  <Card icon="rocket" title="Apps" href="/reference/cli/apps">
+    Deploy apps, invoke actions, and stream logs.
+  </Card>
+</Columns>
 
-You can also authenticate using an API key:
+## Quick Start
 
 ```bash
-export KERNEL_API_KEY=<API_KEY>
-```
+# 1) Login
+kernel login
 
-## Verifying installation
-After installation, verify that Kernel CLI was installed correctly:
+# 2) Deploy your app
+kernel deploy index.ts
 
-```bash
-which kernel
+# 3) Invoke your app
+kernel invoke my-app action-name --payload '{"key":"value"}'
 ```
 
 ## Global Flags
 
-| Flag | Description |
-|------|-------------|
-| `--version`, `-v` | Print the CLI version |
-| `--no-color` | Disable color output |
-| `--log-level <level>` | Set the log level (trace, debug, info, warn, error, fatal, print) |
-
-## Authentication Commands
-
-| Command | Description |
-|---------|-------------|
-| `kernel login [--force]` | Initiates OAuth 2.0 authentication flow via browser. Use `--force` to re-authenticate when already logged in |
-| `kernel logout` | Clears stored authentication tokens and logs out |
-| `kernel auth` | Displays current authentication status, user details, and token expiry. Use `--log-level debug` for detailed information including user ID and storage method |
-
-## Browser Management Commands
-
-| Command | Description |
-|---------|-------------|
-| `kernel browsers list` | List running or persistent browsers |
-| `kernel browsers create` | Create a new browser session |
-| | `--persistence-id <id>` | Unique identifier for browser session persistence. Optional. |
-| | `--stealth` | Launch browser in stealth mode to avoid detection. Optional. |
-| | `--headless` | Launch browser without GUI access. Optional. |
-| `kernel browsers delete` | Delete a browser. Must specify either `--by-persistent-id` or `--by-id` |
-| | `--by-persistent-id <id>` | Delete browser by persistent ID |
-| | `--by-id <id>` | Delete browser by session ID |
-| | `--yes`, `-y` | Skip confirmation prompt |
-| `kernel browsers view` | Get the live view URL for a browser. Must specify either `--by-persistent-id` or `--by-id` |
-| | `--by-persistent-id <id>` | View browser by persistent ID |
-| | `--by-id <id>` | View browser by session ID |
-
-## App Management Commands
-
-| Command | Optional Flags | Description |
-|---------|-------------| -------------|
-| `kernel deploy <entrypoint_file_name>` | - | Deploys an app to Kernel from the current directory. |
-| | `--version <version>` | Specify a version for the app (default: latest). Optional. |
-| | `--force` | Allow overwrite of an existing version with the same name. Optional. |
-| | `--env <ENV_VAR=VAL>`, `-e` | Adds environment variables to the app. Expects the form `ENV_VAR=VAL` delimited by spaces. May be specified multiple times. Optional. |
-| | `--env-file <file>` | Read environment variables from a file (.env format). May be specified multiple times. Optional. |
-| `kernel invoke <app_name> <action_name>` | - | Invokes a specific app action by its name. Generates an Invocation. |
-| | `--version <version>`, `-v` | Specify a version of the app to invoke (default: latest). Optional. |
-| | `--payload <payload_data>`, `-p` | Includes the specified parameters. Expects a stringified JSON object. Optional. |
-| | `--sync`, `-s` | Invoke synchronously (default false). A synchronous invocation opens a long-lived HTTP POST that times out after 60 seconds. Optional. |
-| | `ctrl-c` | Terminates the running invocation in your CLI. Also destroys any associated browsers. |
-| `kernel app list` | - | List deployed application versions. |
-| | `--name <app_name>` | Filter by application name. Optional. |
-| | `--version <version>` | Filter by version label. Optional. |
-| `kernel app history <app_name>` | - | Show deployment history for an application. |
-| `kernel logs <app_name>` | - | Prints the logs for the specified app. |
-| | `--version <version>` | Specify a version of the app (default: latest). Optional. |
-| | `--follow`, `-f` | Follow logs in real-time (stream continuously). Optional. |
-| | `--since <time>`, `-s` | How far back to retrieve logs (e.g., 5m, 1h). Defaults to 5m if not following, 5s if following. Optional. |
-| | `--with-timestamps` | Include timestamps in each log line. Optional. |
-
-## General Commands
+- `--version`, `-v` - Print the CLI version
+- `--no-color` - Disable color output
+- `--log-level <level>` - Set the log level (trace, debug, info, warn, error, fatal, print)
 
-| Command | Description |
-|---------|-------------|
-| `kernel help [command]` | Displays help information about Kernel commands |
+<Info>
+Looking for the API? See the [API Reference](/api-reference/invocations/invoke-an-action).
+</Info>
diff --git a/reference/cli/apps.mdx b/reference/cli/apps.mdx
new file mode 100644
index 0000000..23ae38c
--- /dev/null
+++ b/reference/cli/apps.mdx
@@ -0,0 +1,45 @@
+---
+title: "Apps"
+---
+
+## `kernel deploy <entrypoint_file_name>`
+Deploy an app to Kernel from the current directory.
+
+| Flag | Description |
+|------|-------------|
+| `--version <version>` | Specify a version for the app (default: latest). Optional. |
+| `--force` | Allow overwrite of an existing version with the same name. Optional. |
+| `--env <ENV_VAR=VAL>`, `-e` | Adds environment variables to the app. May be specified multiple times. Optional. |
+| `--env-file <file>` | Read environment variables from a .env file. May be specified multiple times. Optional. |
+
+## `kernel invoke <app_name> <action_name>`
+Invoke a specific app action by its name. Generates an Invocation.
+
+| Flag | Description |
+|------|-------------|
+| `--version <version>`, `-v` | Specify a version of the app to invoke (default: latest). Optional. |
+| `--payload <payload_data>`, `-p` | Stringified JSON object (max 64 KB). Optional. |
+| `--sync`, `-s` | Invoke synchronously (default false). Optional. |
+
+<Info>Synchronous invocations open a long-lived HTTP POST that times out after 60 seconds. Press `ctrl-c` to terminate a running invocation; associated browsers are destroyed.</Info>
+
+## `kernel app list`
+List deployed application versions.
+
+| Flag | Description |
+|------|-------------|
+| `--name <app_name>` | Filter by application name. Optional. |
+| `--version <version>` | Filter by version label. Optional. |
+
+## `kernel app history <app_name>`
+Show deployment history for an application.
+
+## `kernel logs <app_name>`
+Print the logs for the specified app.
+
+| Flag | Description |
+|------|-------------|
+| `--version <version>` | Specify a version of the app (default: latest). Optional. |
+| `--follow`, `-f` | Follow logs in real-time (stream continuously). Optional. |
+| `--since <time>`, `-s` | How far back to retrieve logs (e.g., 5m, 1h). Defaults to 5m if not following, 5s if following. Optional. |
+| `--with-timestamps` | Include timestamps in each log line. Optional. |
diff --git a/reference/cli/auth.mdx b/reference/cli/auth.mdx
new file mode 100644
index 0000000..f952598
--- /dev/null
+++ b/reference/cli/auth.mdx
@@ -0,0 +1,20 @@
+---
+title: "Authentication"
+---
+
+## `kernel login`
+Login via OAuth 2.0 (PKCE) using your browser. Credentials are stored securely and refreshed automatically.
+
+| Flag | Description |
+|------|-------------|
+| `--force` | Force re-authentication even if already logged in |
+
+## `kernel logout`
+Clear stored authentication tokens and log out.
+
+## `kernel auth`
+Show current authentication status and token expiry.
+
+| Flag | Description |
+|------|-------------|
+| `--log-level debug` | Set the log level to debug for detailed info including user ID, org ID, and storage method. |
diff --git a/reference/cli/browsers.mdx b/reference/cli/browsers.mdx
new file mode 100644
index 0000000..408c29c
--- /dev/null
+++ b/reference/cli/browsers.mdx
@@ -0,0 +1,277 @@
+---
+title: "Browsers"
+---
+
+## Core
+
+### `kernel browsers list`
+List running or persistent browsers.
+
+### `kernel browsers create`
+Create a new browser session.
+
+| Flag | Description |
+|------|-------------|
+| `--persistence-id <id>` | Unique identifier for browser session persistence. Optional. |
+| `--stealth` | Launch browser in stealth mode to avoid detection. Optional. |
+| `--headless` | Launch browser without GUI access. Optional. |
+
+### `kernel browsers delete`
+Delete a browser. Must specify either `--by-persistent-id` or `--by-id`.
+
+| Flag | Description |
+|------|-------------|
+| `--by-persistent-id <id>` | Delete browser by persistent ID |
+| `--by-id <id>` | Delete browser by session ID |
+| `--yes`, `-y` | Skip confirmation prompt |
+
+### `kernel browsers view`
+Get the live view URL for a browser. Must specify either `--by-persistent-id` or `--by-id`.
+
+| Flag | Description |
+|------|-------------|
+| `--by-persistent-id <id>` | View browser by persistent ID |
+| `--by-id <id>` | View browser by session ID |
+
+## Logs
+
+### `kernel browsers logs stream`
+Stream browser logs.
+
+| Flag | Description |
+|------|-------------|
+| `--source <source>` | Log source: `path` or `supervisor`. Required. |
+| `--follow` | Follow the log stream (default: true). Optional. |
+| `--path <path>` | File path when `--source=path`. Optional. |
+| `--supervisor-process <name>` | Supervisor process name when `--source=supervisor` (e.g., `chromium`). Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+## Replays
+
+### `kernel browsers replays list`
+List replays for a browser.
+
+| Flag | Description |
+|------|-------------|
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers replays start`
+Start a replay recording.
+
+| Flag | Description |
+|------|-------------|
+| `--framerate <fps>` | Recording framerate (fps). Optional. |
+| `--max-duration <seconds>` | Maximum duration in seconds. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers replays stop`
+Stop a replay recording.
+
+| Flag | Description |
+|------|-------------|
+| `--replay-id <id>` | Replay ID to stop. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers replays download`
+Download a replay video.
+
+| Flag | Description |
+|------|-------------|
+| `--replay-id <id>` | Replay ID to download. Required. |
+| `-o, --output <path>` | Output file path. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+## Process Control
+
+### `kernel browsers process exec`
+Execute a command synchronously in the browser VM.
+
+| Flag | Description |
+|------|-------------|
+| `--command <cmd>` | Command to execute. Optional; if omitted, trailing args are executed via `/bin/bash -c`. |
+| `--args <args>` | Command arguments. Optional. |
+| `--cwd <path>` | Working directory. Optional. |
+| `--timeout <seconds>` | Timeout in seconds. Optional. |
+| `--as-user <user>` | Run as user. Optional. |
+| `--as-root` | Run as root. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers process spawn`
+Execute a command asynchronously in the browser VM.
+
+| Flag | Description |
+|------|-------------|
+| `--command <cmd>` | Command to execute. Optional; if omitted, trailing args are executed via `/bin/bash -c`. |
+| `--args <args>` | Command arguments. Optional. |
+| `--cwd <path>` | Working directory. Optional. |
+| `--timeout <seconds>` | Timeout in seconds. Optional. |
+| `--as-user <user>` | Run as user. Optional. |
+| `--as-root` | Run as root. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers process kill`
+Send a signal to a process.
+
+| Flag | Description |
+|------|-------------|
+| `--process-id <id>` | Target process ID. Required. |
+| `--signal <signal>` | Signal to send: `TERM`, `KILL`, `INT`, `HUP` (default: `TERM`). Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers process status`
+Get process status.
+
+| Flag | Description |
+|------|-------------|
+| `--process-id <id>` | Target process ID. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers process stdin`
+Write to process stdin (base64 data).
+
+| Flag | Description |
+|------|-------------|
+| `--process-id <id>` | Target process ID. Required. |
+| `--data-b64 <data>` | Base64-encoded data to write to stdin. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers process stdout-stream`
+Stream process stdout/stderr.
+
+| Flag | Description |
+|------|-------------|
+| `--process-id <id>` | Target process ID. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+## Filesystem
+
+### `kernel browsers fs new-directory`
+Create a new directory.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute directory path to create. Required. |
+| `--mode <mode>` | Directory mode (octal string). Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs delete-directory`
+Delete a directory.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute directory path to delete. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs delete-file`
+Delete a file.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute file path to delete. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs download-dir-zip`
+Download a directory as a zip file.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute directory path to download. Required. |
+| `-o, --output <path>` | Output zip file path. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs file-info`
+Get file or directory info.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute file or directory path. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs list-files`
+List files in a directory.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute directory path. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs move`
+Move or rename a file or directory.
+
+| Flag | Description |
+|------|-------------|
+| `--src <path>` | Absolute source path. Required. |
+| `--dest <path>` | Absolute destination path. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs read-file`
+Read a file.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute file path. Required. |
+| `-o, --output <path>` | Output file path. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs set-permissions`
+Set file permissions or ownership.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Absolute path. Required. |
+| `--mode <mode>` | File mode bits (octal string). Required. |
+| `--owner <user>` | New owner username or UID. Optional. |
+| `--group <group>` | New group name or GID. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs upload`
+Upload one or more files.
+
+| Flag | Description |
+|------|-------------|
+| `--file <local:remote>` | Mapping local:remote (repeatable). Optional. |
+| `--dest-dir <path>` | Destination directory for uploads. Optional. |
+| `--paths <paths>` | Local file paths to upload. Optional. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs upload-zip`
+Upload a zip and extract it.
+
+| Flag | Description |
+|------|-------------|
+| `--zip <path>` | Local zip file path. Required. |
+| `--dest-dir <path>` | Destination directory to extract to. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |
+
+### `kernel browsers fs write-file`
+Write a file from local data.
+
+| Flag | Description |
+|------|-------------|
+| `--path <path>` | Destination absolute file path. Required. |
+| `--mode <mode>` | File mode (octal string). Optional. |
+| `--source <path>` | Local source file path. Required. |
+| `--by-persistent-id <id>` | Target browser by persistent ID. Optional. |
+| `--by-id <id>` | Target browser by session ID. Optional. |