Configuration

The API key resolves in this order. First match wins.

Priority	API key
1. Flag	--api-key
2. Environment	THREATOPTIC_API_KEY
3. Config file	api_key

Config file

The config file lives at $XDG_CONFIG_HOME/threatoptic/config.yaml, falling back to ~/.config/threatoptic/config.yaml:

api_key: top_...

The directory is created 0700 and the file is written 0600 via a temporary file and rename, so an interrupted write cannot truncate an existing credential.

CI

Run without writing anything to disk:

export THREATOPTIC_API_KEY="$CI_THREATOPTIC_KEY"
threatoptic whoami --json

auth login sources its key from --api-key, then THREATOPTIC_API_KEY, and otherwise the prompt. A key already on disk never suppresses the prompt.