Set APIVAULT_TOKEN and every CLI command authenticates as that service token, ahead of any device token in ~/.apivault/token.json. Combined with APIVAULT_KEY, this lets apivault run work unattended in CI:

Shell

APIVAULT_TOKEN=av_live_... apivault run -- npm run build

Two commands also change while the variable is set:

apivault whoami reports the token's name, project, scopes, and environment pin, so a pipeline can check which credential it picked up.
apivault login and apivault logout refuse to run and explain why. Login would otherwise write a device token the next command ignored, and logout would clear one the caller never asked to sign out.

Learn more in the CI/CD documentation.