Configuration

Storing Credentials

Store your credentials once instead of passing --api-key on every command:

scanoss-cli config set api-key SC_abc123def456
scanoss-cli scan ./my-project --output results.json

Settings use the same names as the flags: api-key, api-url, proxy, and ca-cert. They live in ~/.scanoss/settings.json:

{
  "api_key": "SC_abc123def456",
  "api_url": "https://api.scanoss.com",
  "proxy": "http://proxy.example.com:8080",
  "ca_cert": "/etc/ssl/corp-ca.pem"
}

The command line always uses the dashed names (api-key); snake_case is the file’s format, not a second way to type a key.

Precedence

Every setting resolves the same way, and each has a matching flag:

--flag  >  environment variable  >  ~/.scanoss/settings.json  >  built-in default

The environment variable is the setting name in upper case with a SCANOSS_ prefix: SCANOSS_API_KEY, SCANOSS_API_URL, SCANOSS_PROXY, SCANOSS_CA_CERT. An empty value from the environment or the file is treated as unset and falls through to the next source.

scanoss-cli config set api-url https://scanoss.internal.example.com

# 1. the stored value is used
scanoss-cli scan .

# 2. the environment overrides the file
SCANOSS_API_URL=https://scanoss.staging.example.com scanoss-cli scan .

# 3. the flag overrides both
SCANOSS_API_URL=https://scanoss.staging.example.com \
  scanoss-cli scan . --api-url https://api.scanoss.com

--verbose reports which source won for each setting (the source only, never the key’s value).

Inspecting

config list shows the value each command will actually use, and where it came from:

$ scanoss-cli config list
api-key  ********                              (env: SCANOSS_API_KEY)
api-url  https://scanoss.internal.example.com  (config file)

Config file: /Users/you/.scanoss/settings.json

The API key is never printed. list and get always render it as ********, there’s no flag that reveals it, so it can’t land in your shell history or a CI log. config get api-key therefore only tells you whether it’s set (exit code 0 or 1). Scripts that need the value should use $SCANOSS_API_KEY; to read your own file, open it directly with cat "$(scanoss-cli config path)".

Non-secret values print normally, so config get composes:

$ scanoss-cli config get api-url
https://scanoss.internal.example.com

On-Prem Endpoint

A custom API URL may run keyless, so pointing the CLI at an internal deployment is one command:

scanoss-cli config set api-url https://scanoss.internal.example.com
scanoss-cli scan .

Proxy and Custom CA

HTTP_PROXY, HTTPS_PROXY, and NO_PROXY are honoured with no flags. --proxy overrides them for one run, and --ca-cert trusts a CA the system pool doesn’t have, an internal endpoint, or a proxy that intercepts TLS:

scanoss-cli scan . --proxy http://proxy.example.com:8080
scanoss-cli scan . --ca-cert /etc/ssl/corp-ca.pem

The CA is added to the system pool, so the public API keeps working, and verification stays on, unlike --ignore-cert-errors. Both flags work on every command that reaches the API.

Proxy auto-configuration (PAC) is not supported: read the proxy out of the PAC file and pass it with --proxy.

Both can be stored, so neither flag has to be repeated:

scanoss-cli config set proxy http://proxy.example.com:8080
scanoss-cli config set ca-cert /etc/ssl/corp-ca.pem
scanoss-cli scan .

A stored proxy takes precedence over HTTP_PROXY/HTTPS_PROXY. --ignore-cert-errors is not storable, turning off verification stays a per-run choice.

CI

Use the environment instead of a config file, no config set, and no key on the command line where it would land in build logs:

- name: SCANOSS scan
  env:
    SCANOSS_API_KEY: ${{ secrets.SCANOSS_API_KEY }}
  run: scanoss-cli scan . --output results.json

Rotating and Removing

scanoss-cli config set api-key SC_newkey789   # overwrite in place
scanoss-cli config unset api-key              # remove the key
scanoss-cli config path                       # print the file location

Hand-editing the file is supported, and keys this version doesn’t recognize are left untouched by config set.

Documentation

Links

Storing Credentials

Precedence

Inspecting

On-Prem Endpoint

Proxy and Custom CA

CI

Rotating and Removing

​Storing Credentials

​Precedence

​Inspecting

​On-Prem Endpoint

​Proxy and Custom CA

​CI

​Rotating and Removing

Storing Credentials

Precedence

Inspecting

On-Prem Endpoint

Proxy and Custom CA

CI

Rotating and Removing