Configuration
Overview of how the CLI resolves credentials, config, and environment variables — what to commit vs. what to keep secret.
The optixlog CLI reads configuration from three sources, each with a distinct purpose and security posture.
The three sources
| Source | File | Committed? | Contains |
|---|---|---|---|
| Project config | optixlog.toml (in your repo) | Yes | API base URL, codegen output settings, selected project ids |
| Credentials | ~/.optixlog/credentials.toml | Never | API keys, cached identity per profile |
| Environment variables | Shell environment | CI secrets manager | API key, base URL overrides, config home override, fixture path |
Separate secrets from config
~/.optixlog/credentials.toml is secret. Never commit it, add it to .gitignore, and never copy API keys into optixlog.toml. The two files have strictly separate roles.
Precedence summary
API key resolution
OPTIXLOG_API_KEY env → --api-key flag → stored profileBase URL resolution
--base-url flag → OPTIXLOG_BASE_URL env → stored profile → default (https://optixlog.leidos.com)Config home
OPTIXLOG_CONFIG_HOME env → ~/.optixlog/Fixture (offline mode)
--fixture flag → OPTIXLOG_FIXTURE envWhen either --fixture or OPTIXLOG_FIXTURE is set, the CLI uses the local fixture JSON file and does not contact any server.
Typical project layout
my-repo/
optixlog.toml ← committed; no secrets
optixlog_gen.py ← generated; commit after running `optixlog generate`
.gitignore ← should include ~/.optixlog/ (or document separately)The credentials file lives outside the repo in ~/.optixlog/credentials.toml and is written with restrictive permissions (0600) by optixlog login.
optixlog.toml
Full schema: [optixlog], [codegen], and [[projects]] tables.
credentials.toml
Location, permissions, fields per profile, and masking.
Environment Variables
OPTIXLOG_API_KEY, OPTIXLOG_BASE_URL, OPTIXLOG_CONFIG_HOME, OPTIXLOG_FIXTURE.
Profiles
Multiple named profiles for personal and CI credentials.