​

config

orc config shows the CLI authentication source and configuration path, and reads or changes saved settings. Reads do not display an API key secret; configured credentials are represented by an opaque identifier or configured state.

It operates on the current local CLI configuration, not account profiles or server-side Workspace settings. Use orc auth login to configure credentials.

Inspect the authentication source and configuration path.

Shows whether authentication is configured, its source, the configuration path, and missing configuration. When a credential exists, shows its opaque ID instead of its secret.

Specify apiKey, apiKeyHelper, apiUrl, defaultWorkspace, or profile as key to read a saved value. Configured apiKey values return [redacted]. Unset values return an empty string; unsupported keys return exit code 2.

Saves a supported key and non-empty value, trimming leading and trailing whitespace. For apiKeyHelper, pass the command's argument array as JSON. Reports the configuration path without displaying API key values.

Read the default Workspace.

Change the default Workspace.

Configure a command that reads the API key from Secret Manager.

Call a local API explicitly.

Changing a local saved value does not verify credentials or Workspace access. Check with orc status or orc auth status afterwards. Use standard input with auth login instead of putting a secret into shell history as a config set argument.

The API endpoint is resolved from the global --api-url <url> option, then ORCHESTOR_API_URL, then the profile apiUrl, then the default https://api.orchestor.io.

A sign-in saved by orc auth login is bound to the API and auth origins that issued it. When the endpoint has a different origin, the saved sign-in is neither sent nor refreshed, and the command exits with code 2. Use an explicit API key for another endpoint.

Credentials are used in this order: ORCHESTOR_API_KEY, the profile apiKeyHelper, a saved API key, then the saved sign-in. apiKeyHelper is the argument array of a command run without a shell; its standard output, trimmed, is the API key. The key is held in memory for five minutes and the command runs again after a 401. It is never written to disk or printed.

The following global options can be used with orc config:

For details and examples, see global options.