> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fintoc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fintoc CLI keys

> Learn how the Fintoc CLI resolves API keys, where they're stored, and how to switch between them.

This page explains how the Fintoc CLI resolves, stores, and switches API keys. When you run `fintoc login`, the CLI stores your secret key in `~/.fintoc/config.toml`. The file uses mode `0600`, so only the current operating system user can read it. You can also provide a key with `--api-key` or the `FINTOC_API_KEY` environment variable.

## Key resolution order

The CLI resolves the API key in this order of precedence:

1. The inline `--api-key` flag.
2. The `FINTOC_API_KEY` environment variable.
3. The key stored in `~/.fintoc/config.toml` by `fintoc login`.

The CLI uses the first available source. This precedence lets you keep a default `test` mode key in your configuration file and override the key for each command. Use an override to switch between Fintoc organizations or between `test` and `live` modes.

## View your active configuration

```bash theme={null}
fintoc config show
```

This command prints a masked version of the active API key, the resolved environment, and the configuration file path.

## Switch keys

To change the persisted key, log out and log back in:

```bash theme={null}
fintoc logout
fintoc login
```

To override the persisted key for a single command:

```bash theme={null}
fintoc payment_intents list --api-key sk_test_a1b2c3d4e5f6g7h8i9j0
```

## Use the CLI in continuous integration

For continuous integration and delivery pipelines, set `FINTOC_API_KEY` as a secret environment variable in your provider. For example, you can configure the variable in GitHub Actions or CircleCI. Avoid persisting credentials to disk:

```bash theme={null}
export FINTOC_API_KEY=sk_test_a1b2c3d4e5f6g7h8i9j0
fintoc payment_intents list --json
```

This approach skips the interactive `fintoc login` flow and avoids writing the key to the configuration file.

## Compare `test` and `live` modes

Each Fintoc API key is scoped to either `test` mode or `live` mode. The CLI infers the mode from the key prefix:

* `sk_test_...` identifies a `test` mode key. A `test` mode key never moves real money: the CLI creates no real payments or refunds.
* `sk_live_...` identifies a `live` mode key. Commands run with this key create real payments and refunds on your production organization.

The CLI works in both `test` and `live` modes. Resource commands such as `fintoc payment_intents list` work with either key. Commands that simulate events, such as `fintoc trigger`, run only in `test` mode and return an error with a `live` key.

By default, `fintoc login` authenticates in `test` mode. To authenticate in `live` mode, pass `--mode live`:

```bash theme={null}
fintoc login --mode live
```