# Keys and configuration

Configure one active credential securely and understand which API origin the CLI will use.

## Add your API key

Replace YOUR_API_KEY and run one of these commands locally. The CLI performs a read-only access check before saving the key. A failed check preserves the previous configuration. Avoid the argument form when terminal history must not contain the key; use hidden input below.

```
purrkey keys add YOUR_API_KEY
# Equivalent flag form
purrkey keys add -k YOUR_API_KEY
```

## Use hidden input or a secret store

purrkey config prompts for hidden input in an interactive terminal. --key-stdin reads the key from stdin. ATX_API_KEY provides a runtime credential override without putting the key in a request file. Saving a new key does not clear this environment override; update or remove it when rotating credentials.

```
purrkey config
# For scripts: pipe a secret from your secret manager
# <secret-manager command> | purrkey config --key-stdin
```

## Environment variables

The ATX_ names are supported compatibility names. Normal installation uses the built-in production API and does not require these variables. By default, configuration and recovery files live in the operating system's user configuration directory under agenttoolx.

| Variable | Purpose |
| --- | --- |
| ATX_API_KEY | Overrides the saved key for API requests. |
| ATX_API_URL | Overrides the saved API origin unless --api-url is provided. |
| ATX_CLI_HOME | Overrides the configuration and recovery-journal directory. |

## Change the API origin only when needed

Origin precedence is --api-url, then ATX_API_URL, then saved configuration, then the built-in production address. HTTPS is required except for loopback development addresses.

Starting with 0.3.4, the CLI uses api.purrkey.app for configurations saved with the former production address. Your key and Run recovery records carry over. If you set ATX_API_URL to the old address, remove that override. To switch a custom deployment to production, run the command below.

```
purrkey config --api-url https://api.purrkey.app
```