The CLI now runs in CI under a service token with no configuration of its own, and no command waits on a prompt when there is no terminal.

apivault run and apivault env export now use the token's environment pin when you don't pass --env:

Shell

APIVAULT_TOKEN=av_live_... apivault run -- npm run build

Previously they sent the environment from your local config, which a pinned token refused, and they failed outright in a fresh container with no config. An explicit --env still wins, so a mismatch shows up as an error.

#Commands no longer hang

keys add: reports missing values by flag name instead of prompting, and --environment falls back to the token's pin.
keys delete: without -f, it refuses and names the flag. Deleting can't be undone, so an absent human doesn't count as agreement.
keys update: prompts for every field, so it now says it needs a terminal.
Custom vault keys: a command that can't prompt for one points you to --vault-key and APIVAULT_KEY.

#Clearer service token errors

A rejected token no longer suggests apivault login. An unrecognized APIVAULT_TOKEN says the value didn't match a token, which usually means a truncated copy or a secret set on the wrong repository.
apivault projects list and apivault logs now refuse up front under a service token.
apivault whoami always states the token's reach: Production only for a pinned token, or All environments.

The README now covers headless use, including GitHub Actions and Docker examples. Learn more in the CI/CD documentation.