skip to content
The API key

Setup

The API key

Mint the key

conifer.build/account, under API key. Minting unlocks after pay as you go is set up. The key is shown exactly once; the server keeps no copy it can re-show. If it leaks, revoke it there. Revocation reaches the gateway in seconds.

Sign the CLI in

terminal
conifer login

Paste the key when prompted. It is validated against the gateway before it is stored, then kept in the OS keychain. Never a dotfile, never a process argument. conifer login --status reports the signed-in state; conifer logout removes the credential.

Give it to your tools

~/.zshrc
export CONIFER_API_KEY='eyJ...'

Every tool reads the same name: $CONIFER_API_KEY in shell configs, {env:CONIFER_API_KEY} in opencode. The CLI reads it too (releases newer than v0.2.3), so on a machine you never signed in, the variable alone is enough. Per-tool wiring is in Your tools; the wire itself is in the API reference.

CI jobs

terminal
export CONIFER_ENTITLEMENT_TOKEN='eyJ...'

For a scoped, short-lived credential, set this instead. It expires within 24 hours by design and outranks CONIFER_API_KEY when both are set. Mint per job, not per machine.