Configuration

The CLI has no separate "switch project" config — a token is already scoped to one project/environment when it's created. What cloak login configures is just *where that token lives* between commands.

Where credentials are stored

cloak login writes to one of two places:

Local (default)

./.cloak/credentials.json

Scoped to the current repo — good when different repos use different tokens. Add .cloak/ to .gitignore.

Global (--global)

~/.cloak/credentials.json

One login, usable from any directory on your machine.

.cloak/credentials.json

{
  "token": "cloak_live_...",
  "apiUrl": "https://usecloak.top/api/cli"
}

Never commit this file

It holds the raw token. That's the whole reason `.cloak/` belongs in `.gitignore` — the token itself is the only secret here, not the file format.

Resolution order

Every command checks these in order and uses the first one it finds:

1. CLOAK_TOKEN + CLOAK_API_URL env vars
2. ./.cloak/credentials.json   (local, per-repo)
3. ~/.cloak/credentials.json   (global, per-machine)

Different tokens per environment

Since a token is locked to one environment, working across development and production means holding two tokens. The env-var path makes it easy to pick one without touching a saved login:

CLOAK_TOKEN=<prod-token> CLOAK_API_URL=https://usecloak.top/api/cli \
  cloak run -- npm run start

CI/CD

Skip cloak login entirely — set the two env vars as secrets in your CI provider instead:

CLOAK_TOKEN=your_token CLOAK_API_URL=https://usecloak.top/api/cli cloak run -- npm run build

How Cloak encrypts and protects your secrets.

Security

→