---
title: config
description: Display, read, and change local CLI configuration.
canonical_url: https://orchestor.io/docs/en/cli/config
markdown_url: https://orchestor.io/docs/en/cli/config.md
contentType: reference
---

# config

`orc config` shows the CLI authentication source and configuration path, and reads or changes saved settings. Reads do not display an API key secret; configured credentials are represented by an opaque identifier or configured state.

It operates on the current local CLI configuration, not account profiles or server-side Workspace settings. Use [`orc auth login`](https://orchestor.io/docs/cli/auth.md) to configure credentials.

## Usage

```bash title="terminal"
orc config show
```

*Inspect the authentication source and configuration path.*

## Subcommands

### `show`

Shows whether authentication is configured, its source, the configuration path, and missing configuration. When a credential exists, shows its opaque ID instead of its secret.

```bash title="terminal"
orc config show [options]
```

### `get`

Specify `apiKey`, `apiKeyHelper`, `apiUrl`, `defaultWorkspace`, or `profile` as `key` to read a saved value. Configured `apiKey` values return `[redacted]`. Unset values return an empty string; unsupported keys return exit code 2.

```bash title="terminal"
orc config get <key> [options]
```

### `set`

Saves a supported `key` and non-empty `value`, trimming leading and trailing whitespace. For `apiKeyHelper`, pass the command's argument array as JSON. Reports the configuration path without displaying API key values.

```bash title="terminal"
orc config set <key> <value> [options]
```

## Examples

### Read the default Workspace.

```bash title="terminal"
orc config get defaultWorkspace
```

*Read the default Workspace.*

### Change the default Workspace.

```bash title="terminal"
orc config set defaultWorkspace <workspace-id>
```

*Change the default Workspace.*

### Configure a command that reads the API key from Secret Manager.

```bash title="terminal"
orc config set apiKeyHelper '["gcloud","secrets","versions","access","latest","--secret=orc-dev-<user>"]'
```

*Configure a command that reads the API key from Secret Manager.*

### Call a local API explicitly.

```bash title="terminal"
orc --api-url http://localhost:40900 whoami
```

*Call a local API explicitly.*

## Configuration and verification

Changing a local saved value does not verify credentials or Workspace access. Check with [`orc status`](https://orchestor.io/docs/cli/status.md) or `orc auth status` afterwards. Use standard input with `auth login` instead of putting a secret into shell history as a `config set` argument.

## API endpoint and explicit API keys

The API endpoint is resolved from the global `--api-url <url>` option, then `ORCHESTOR_API_URL`, then the profile `apiUrl`, then the default `https://api.orchestor.io`.

A sign-in saved by `orc auth login` is bound to the API and auth origins that issued it. When the endpoint has a different origin, the saved sign-in is neither sent nor refreshed, and the command exits with code 2. Use an explicit API key for another endpoint.

Credentials are used in this order: `ORCHESTOR_API_KEY`, the profile `apiKeyHelper`, a saved API key, then the saved sign-in. `apiKeyHelper` is the argument array of a command run without a shell; its standard output, trimmed, is the API key. The key is held in memory for five minutes and the command runs again after a 401. It is never written to disk or printed.

## Global Options

The following [global options](https://orchestor.io/docs/cli/global-flags.md) can be used with `orc config`:

- [`--help`](https://orchestor.io/docs/cli/global-flags.md#help)
- [`--workspace`](https://orchestor.io/docs/cli/global-flags.md#workspace)
- [`--json`](https://orchestor.io/docs/cli/global-flags.md#json-output)
- [`--pretty`](https://orchestor.io/docs/cli/global-flags.md#json-output)
- [`--format`](https://orchestor.io/docs/cli/global-flags.md#output-format)
- [`--field`](https://orchestor.io/docs/cli/global-flags.md#field-selection)
- [`--fields`](https://orchestor.io/docs/cli/global-flags.md#field-selection)
- [`--raw`](https://orchestor.io/docs/cli/global-flags.md#raw-output)
- [`--output`](https://orchestor.io/docs/cli/global-flags.md#file-output)
- [`--no-pager`](https://orchestor.io/docs/cli/global-flags.md#pager)
- [`--dry-run`](https://orchestor.io/docs/cli/global-flags.md#dry-run)
- [`--yes`](https://orchestor.io/docs/cli/global-flags.md#confirmation)
- [`--stdin`](https://orchestor.io/docs/cli/global-flags.md#standard-input)
- [`--from-stdin`](https://orchestor.io/docs/cli/global-flags.md#standard-input)
- [`--page-all`](https://orchestor.io/docs/cli/global-flags.md#all-pages)
- [`--timing`](https://orchestor.io/docs/cli/global-flags.md#request-timing)
- [`--readonly`](https://orchestor.io/docs/cli/global-flags.md#read-only-mode)
- [`--wrap-untrusted`](https://orchestor.io/docs/cli/global-flags.md#untrusted-content-wrapping)

For details and examples, see [global options](https://orchestor.io/docs/cli/global-flags.md).

---

[Documentation index](https://orchestor.io/docs/llms.txt)