Credentials vs Config

OptixLog uses two separate files to separate secrets from project configuration. Understanding which file does what prevents accidental credential exposure.

~/.optixlog/credentials.toml — secret, per-user

This file stores your API key and cached identity. It is never committed to source control.

Location: ~/.optixlog/credentials.toml (or $OPTIXLOG_CONFIG_HOME/credentials.toml if the env var is set).

Permissions: directory 0700, file 0600. The SDK sets these on write.

Written by: optixlog login. Re-running login refreshes the profile in place and leaves other profiles untouched.

Contents:

[default]
api_base_url = "https://optixlog.leidos.com"
api_key = "sk-opt-xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
key_type = "user"
organization_id = "org_abc123"
user_email = "founder@optixlog.com"

[ci]
api_base_url = "https://optixlog.leidos.com"
api_key = "sk-opt-service-yyyyyyyyyyyyyyyyyyyy"
key_type = "service"
organization_id = "org_abc123"

Each TOML table is a profile. The default profile is named default. A profile is considered present only when both api_base_url and api_key are set; the identity fields (key_type, organization_id, user_email) are informational and may be absent.

optixlog.toml — non-secret, per-project

This file records which projects you are working with and where to write generated bindings. It contains no secrets and is committed to source control.

Location: written by optixlog init in your current directory. Read by walking up from cwd (so you can run commands from subdirectories).

Contents:

[optixlog]
api_base_url = "https://optixlog.leidos.com"
schema_version = 1

[codegen]
output_path = "optixlog_gen.py"
module_style = "single_file"

[[projects]]
id = "proj_grating_7f3a"
name = "Grating Coupler Lab"

[[projects]]
id = "proj_modulator_22b1"
name = "Modulator Program"

The [[projects]] entries tell optixlog generate which projects to fetch schemas for. Node-to-project associations are never stored here — they come from the fetched schema.

Precedence rules

API key resolution

OPTIXLOG_API_KEY (env)  →  --api-key (flag)  →  stored profile  →  interactive prompt

The first source that yields a value wins. If none yields a key, the command errors.

Base URL resolution

--base-url (flag)  →  OPTIXLOG_BASE_URL (env)  →  stored profile  →  default (https://optixlog.leidos.com)

Profile selection

All commands accept --profile NAME (default default). The named profile is loaded from credentials.toml.

Environment variables

Summary

See Credentials TOML reference and optixlog.toml reference for the full file specifications.