Authentication

Obtain an API key, run optixlog login, and understand where credentials are stored.

API keys

All requests to OptixLog are authenticated with an API key. Keys look like sk-opt-... and come in two types:

user — associated with a personal account; used for interactive development.
service — associated with a service account; used for CI and automation.

The default server is https://optixlog.leidos.com.

Log in

Run optixlog login once per environment. It resolves your key and base URL, calls the server to validate the key, then writes your credentials to ~/.optixlog/credentials.toml.

optixlog login

The command prompts you for your API key unless you supply it via flag or environment variable.

To supply the key non-interactively:

optixlog login --api-key sk-opt-xxxx

To target a different server:

optixlog login --api-key sk-opt-xxxx --base-url https://optixlog.leidos.com

On success, you will see:

Logged in as founder@optixlog.com (user key). Saved to ~/.optixlog/credentials.toml.

Environment variables

You can bypass credential storage by setting environment variables directly. These take precedence over stored credentials.

Variable	Purpose
`OPTIXLOG_API_KEY`	API key — highest precedence for key resolution.
`OPTIXLOG_BASE_URL`	Base URL override.
`OPTIXLOG_CONFIG_HOME`	Override the `~/.optixlog/` directory root.
`OPTIXLOG_FIXTURE`	Path to a JSON fixture for offline use.

Key precedence: OPTIXLOG_API_KEY env > --api-key flag > stored profile > interactive prompt.

Base URL precedence: --base-url flag > OPTIXLOG_BASE_URL env > stored profile > default https://optixlog.leidos.com.

Where credentials are stored

Credentials are written to ~/.optixlog/credentials.toml with restrictive permissions:

Directory ~/.optixlog/ — mode 0700.
File credentials.toml — mode 0600.

Credential hygiene

Never commit ~/.optixlog/credentials.toml. It contains your API key. Only optixlog.toml (non-secret project config) is safe to commit.

See Credentials TOML reference for the full file format, profile support, and precedence rules.

Named profiles

Every command accepts --profile NAME (default default). You can maintain multiple profiles — for example a personal default key and a ci service key:

optixlog login --api-key sk-opt-service-yyyy --profile ci

Next step

Run the offline quickstart to generate bindings without a server.