Reference
View as Markdowninsecur is experimental and prelaunch. There is no public sign-up yet, and the hosted service is not approved for valuable production secrets. Local Mode runs the development loop with no account.
Environment variables
The insecur CLI reads these environment variables. They are grouped by what they affect. Where scope is concerned, precedence runs flags first, then environment, then project config (.insecur.json), then profile.
Scope resolution
These select which host, org, project, environment, and profile the CLI operates against. A matching command-line flag always overrides the environment value.
| Variable | Purpose |
|---|---|
INSECUR_HOST |
API base URL. Default https://api.insecur.cloud. |
INSECUR_ORG |
Organization to operate in (opaque id). |
INSECUR_PROJECT |
Project to operate in (opaque id). |
INSECUR_ENV |
Environment to operate in (opaque id). |
INSECUR_PROFILE |
Named profile to resolve scope and auth from. |
Authentication
These carry credentials for non-interactive use, such as CI or an agent session.
| Variable | Purpose |
|---|---|
INSECUR_SESSION_TOKEN |
Session credential supplied directly in the environment. |
INSECUR_AGENT_CREDENTIAL_FILE |
Path to a sealed derived-agent credential file. |
INSECUR_AGENT_TAG |
Agent attribution tag recorded in the principal chain. |
Config location
These control where the CLI reads and writes its own configuration. The user config lives at ~/.insecur/config.json. Project config lives at .insecur.json, which is committed, non-secret, and holds opaque ids only.
| Variable | Purpose |
|---|---|
INSECUR_CONFIG_HOME |
Base directory for user config. Falls back to HOME or USERPROFILE. |
Crash reporting and output
| Variable | Purpose |
|---|---|
INSECUR_CRASH_REPORTS |
Set to off to disable crash reporting. |
INSECUR_CLI_SENTRY_DSN |
Override the CLI crash-reporting Sentry DSN. |
INSECUR_CLI_SENTRY_ENVIRONMENT |
Override the environment label attached to CLI crash reports. |
INSECUR_ASCII |
Force ASCII glyphs in output. |
Audit export verification
These hold key material for insecur audit verify. You do not read them directly; you pass their names to the matching --*-env flags of audit verify.
| Variable | Purpose |
|---|---|
INSECUR_AUDIT_EXPORT_HMAC_SECRET |
HMAC secret, passed via --hmac-secret-env. |
INSECUR_AUDIT_EXPORT_SIGNING_PUBLIC_KEY |
Single Ed25519 public key, passed via --signing-public-key-env. |
INSECUR_AUDIT_EXPORT_PUBLISHED_SIGNING_KEYS |
Published signing-keys document, passed via --published-signing-keys-env. |
Installer
These are read by the install scripts, not by the CLI at runtime.
| Variable | Purpose |
|---|---|
INSECUR_CLI_VERSION |
Release tag to install, for example cli-v0.2.0. |
INSECUR_INSTALL_DIR |
Install destination directory. |
INSECUR_INSTALL_BASE_URL |
Base URL for the binary and checksums. |
Example
Non-interactive scope plus a session token for CI:
export INSECUR_HOST=https://api.insecur.cloud
export INSECUR_ORG=org_1a2
export INSECUR_PROJECT=prj_3c4
export INSECUR_ENV=env_5d6
export INSECUR_SESSION_TOKEN=... # supplied by your CI secret store
insecur whoami --json
Values shown are opaque ids. Secret values never appear in configuration or CLI output.