How to pass an API key on the command line (--api-key), and when not to

clearrun score --api-key YOUR_KEY ... works and wins over every other key. Avoid it in shared shells and CI, because the key can end up in shell history and logs. Use CLEARRUN_API_KEY instead.

Last updated

Steps

  1. One-off use

    clearrun score --text "Our API never stores customer data." --api-key YOUR_CLEARRUN_API_KEY

  2. Better: an environment variable

    export CLEARRUN_API_KEY=YOUR_CLEARRUN_API_KEY
clearrun score --text "Our API never stores customer data."

When the flag is fine

Testing a second key for a moment on your own computer. Check with clearrun whoami --api-key YOUR_KEY, which shows Source: --api-key.

When not to

  • In CI. Use a secret passed as CLEARRUN_API_KEY.
  • In scripts you commit.
  • On a shared machine.