Security

Credential storage

• The config file is written 0600 inside a 0700 directory, using a temporary file and rename so an interrupted write cannot truncate an existing credential.
• The API key is never logged and never printed in full. auth status shows only a masked prefix (first 12 characters plus ...), in both text and JSON output.
• The interactive prompt does not echo the key to the terminal. Prefer it over --api-key, which is visible to other users via ps. The flag exists for CI, where the value comes from a secret store.
• Errors report only the API’s detail field, never a raw response body.
• Your key carries your full account permissions. Revoke it in the dashboard if a machine is lost, and run threatoptic auth logout to remove the local copy.

Output conventions

• Results go to stdout, errors to stderr, and failures exit non-zero.
• --json emits machine-readable output as the only content on stdout, so threatoptic whoami --json | jq -r .email is safe.

Auth model

The CLI sends Authorization: Bearer <api_key>. Keys start with top_ and are created in the dashboard under Account → API keys. The CLI cannot create or revoke keys — those endpoints require a browser session (JWT).