apivault config
The apivault config command reads and writes the defaults other commands fall back on when you leave out a flag. Settings in the current directory's .apivault.json take precedence over your global defaults in ~/.apivault/config.json.
Usage
apivault config list
Shows every value in effect and whether it is local or global.
apivault config set run.env Development
Saves a default.
Config keys
| Key | Description |
|---|---|
project | The target project ID or slug for this directory/repository |
run.command | The default command to execute for apivault run (e.g. "npm start") |
run.env | The default environment to pull secrets from (e.g. Production) |
vaultKey | The custom vault key used to decrypt secrets for custom-mode accounts |
Resolution precedence
When executing CLI commands, settings are resolved in the following priority order:
- Command-line flags (e.g.,
-p,--env,--vault-key) - Environment variables (
APIVAULT_TOKEN,APIVAULT_PROJECT,APIVAULT_KEY) - Local project configuration (
.apivault.jsonin project directory) - Global user configuration (
~/.apivault/config.json)
APIVAULT_TOKEN makes every command authenticate as that service token, ahead of the device token in ~/.apivault/token.json — which is what makes the CLI usable in CI, where neither a browser nor a stored token exists. While it is set, login and logout refuse to run rather than writing a device token the next command would ignore, and projects list and logs refuse because a project-scoped token cannot read them. A token pinned to an environment also supplies it to run and env export, ahead of any run.env left on the machine. Run apivault whoami to see which identity is actually in use. See CI/CD & service tokens.Subcommands
config list
Show all active config values, indicating whether each setting is resolved from (local) or (global). Secrets like vaultKey are masked.
# Show active merged config with sources apivault config list # Show only local directory config apivault config list --local # Show only global user config apivault config list --global
config get
Print a specific config value (e.g. run.command, project). Unlike list, it prints secrets in full.
# Get resolved value (local takes precedence) apivault config get run.command # Get explicitly from global config apivault config get project --global
config set
Set a config value. By default, writes to local .apivault.json if a local config already exists, or to global user config. Pass --local (-l) or --global (-g) to explicitly choose the target scope. Leave out the value for vaultKey and the CLI prompts for it with hidden input, which keeps it out of your shell history.
# Set local project default environment apivault config set --local run.env Development # Set local project default command apivault config set --local run.command "npm run dev" # Set global user default environment apivault config set --global run.env Production # Prompt securely for vault key apivault config set --global vaultKey
config delete
Remove a config value from local or global configuration. Exits with code 1 if the value was not set.
# Remove from local project config apivault config delete --local run.env # Remove from global config apivault config delete --global run.env
Unique options
| Option | Description |
|---|---|
-l, --local | Only the current directory's project file |
-g, --global | Only ~/.apivault/config.json |
Both work with every subcommand.
Global options
apivault config also accepts the global options, such as --json.