credentials.toml

~/.optixlog/credentials.toml stores your API keys and cached identity per profile. This file is secret — never commit it to version control, and never copy its contents into optixlog.toml.

File location

The OPTIXLOG_CONFIG_HOME environment variable overrides the root directory used for all credential operations. Tests and non-default home configurations use this.

Permissions

optixlog login applies restrictive permissions on a best-effort basis when writing the file:

The file is created with 0600 from the first write. On subsequent writes, permissions are tightened if they were relaxed (e.g. by a manual edit). On exotic filesystems where chmod fails, the write proceeds but the permission is left as-is.

File shape

One TOML table per profile. The table key is the profile name (default default). Each table stores the connection settings for that profile plus a cached copy of the identity returned by the server at login time.

[default]
api_base_url = "https://optixlog.leidos.com"
api_key = "sk-opt-xxxxxxxxxxxxxxxxxxxxxxxx"
key_type = "user"
organization_id = "org_abc123"
user_email = "founder@optixlog.com"

[ci]
api_base_url = "https://optixlog.leidos.com"
api_key = "sk-opt-service-yyyyyyyyyyyyyyyy"
key_type = "service"
organization_id = "org_abc123"

Fields per profile

A profile is only treated as present if both api_base_url and api_key are set. The three identity fields (key_type, organization_id, user_email) are informational and are omitted when unknown.

Key masking

The CLI never prints the full API key. optixlog whoami displays the key in the format:

sk-opt-…2345

That is, the first seven characters (sk-opt-) followed by … followed by the last four characters. Keys shorter than 11 characters are shown as ….

How optixlog login writes the file

1. Resolves the base URL and API key (from flags, env, or prompts).
2. Calls the backend's whoami() to verify the key and retrieve identity.
3. Only on success, writes or refreshes the named profile with api_base_url, api_key, and the freshly cached identity fields.
4. Other profiles in the file are not modified.

# Refresh the default profile
optixlog login --api-key sk-opt-new-key

# Write the ci profile without touching default
optixlog login --api-key sk-opt-svc-xyz --profile ci

OPTIXLOG_CONFIG_HOME override

Set this environment variable to store credentials in a non-default location. The CLI reads and writes $OPTIXLOG_CONFIG_HOME/credentials.toml and creates the directory (mode 0700) if it does not exist.

export OPTIXLOG_CONFIG_HOME=/tmp/test-optixlog-home
optixlog login --api-key sk-opt-test --base-url http://x --fixture tests/fixtures/schema.sample.json

This is the recommended pattern for test suites that should not touch ~/.optixlog/.