> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Store credentials and endpoint settings, understand precedence, and configure proxies, custom CAs, and on-prem endpoints.

## Storing Credentials

Store your credentials once instead of passing `--api-key` on every command:

```bash theme={null}
scanoss-cli config set api-key SC_abc123def456
scanoss-cli scan ./my-project --output results.json
```

Settings use the same names as the flags: `api-key`, `api-url`, `proxy`, and `ca-cert`. They live in `~/.scanoss/settings.json`:

```json theme={null}
{
  "api_key": "SC_abc123def456",
  "api_url": "https://api.scanoss.com",
  "proxy": "http://proxy.example.com:8080",
  "ca_cert": "/etc/ssl/corp-ca.pem"
}
```

<Note>
  The command line always uses the dashed names (`api-key`); `snake_case`
  is the file's format, not a second way to type a key.
</Note>

## Precedence

Every setting resolves the same way, and each has a matching flag:

```
--flag  >  environment variable  >  ~/.scanoss/settings.json  >  built-in default
```

The environment variable is the setting name in upper case with a `SCANOSS_` prefix: `SCANOSS_API_KEY`, `SCANOSS_API_URL`, `SCANOSS_PROXY`, `SCANOSS_CA_CERT`. An empty value from the environment or the file is treated as unset and falls through to the next source.

```bash theme={null}
scanoss-cli config set api-url https://scanoss.internal.example.com

# 1. the stored value is used
scanoss-cli scan .

# 2. the environment overrides the file
SCANOSS_API_URL=https://scanoss.staging.example.com scanoss-cli scan .

# 3. the flag overrides both
SCANOSS_API_URL=https://scanoss.staging.example.com \
  scanoss-cli scan . --api-url https://api.scanoss.com
```

`--verbose` reports which source won for each setting (the source only, never the key's value).

## Inspecting

`config list` shows the value each command will actually use, and where it came from:

```console theme={null}
$ scanoss-cli config list
api-key  ********                              (env: SCANOSS_API_KEY)
api-url  https://scanoss.internal.example.com  (config file)

Config file: /Users/you/.scanoss/settings.json
```

<Note>
  **The API key is never printed.** `list` and `get` always render it as
  `********`, there's no flag that reveals it, so it can't land in your
  shell history or a CI log. `config get api-key` therefore only tells you
  whether it's set (exit code `0` or `1`). Scripts that need the value
  should use `$SCANOSS_API_KEY`; to read your own file, open it directly
  with `cat "$(scanoss-cli config path)"`.
</Note>

Non-secret values print normally, so `config get` composes:

```console theme={null}
$ scanoss-cli config get api-url
https://scanoss.internal.example.com
```

## On-Prem Endpoint

A custom API URL may run keyless, so pointing the CLI at an internal deployment is one command:

```bash theme={null}
scanoss-cli config set api-url https://scanoss.internal.example.com
scanoss-cli scan .
```

## Proxy and Custom CA

`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are honoured with no flags. `--proxy` overrides them for one run, and `--ca-cert` trusts a CA the system pool doesn't have, an internal endpoint, or a proxy that intercepts TLS:

```bash theme={null}
scanoss-cli scan . --proxy http://proxy.example.com:8080
scanoss-cli scan . --ca-cert /etc/ssl/corp-ca.pem
```

The CA is *added* to the system pool, so the public API keeps working, and verification stays on, unlike `--ignore-cert-errors`. Both flags work on every command that reaches the API.

<Note>
  Proxy auto-configuration (PAC) is not supported: read the proxy out of
  the PAC file and pass it with `--proxy`.
</Note>

Both can be stored, so neither flag has to be repeated:

```bash theme={null}
scanoss-cli config set proxy http://proxy.example.com:8080
scanoss-cli config set ca-cert /etc/ssl/corp-ca.pem
scanoss-cli scan .
```

A stored `proxy` takes precedence over `HTTP_PROXY`/`HTTPS_PROXY`. `--ignore-cert-errors` is not storable, turning off verification stays a per-run choice.

## CI

Use the environment instead of a config file, no `config set`, and no key on the command line where it would land in build logs:

```yaml theme={null}
- name: SCANOSS scan
  env:
    SCANOSS_API_KEY: ${{ secrets.SCANOSS_API_KEY }}
  run: scanoss-cli scan . --output results.json
```

## Rotating and Removing

```bash theme={null}
scanoss-cli config set api-key SC_newkey789   # overwrite in place
scanoss-cli config unset api-key              # remove the key
scanoss-cli config path                       # print the file location
```

Hand-editing the file is supported, and keys this version doesn't recognize are left untouched by `config set`.