Environment Variables

kli reads environment variables in two places: the installer script (curl -fsSL https://kli.kleisli.io | sh) reads them once, while it downloads and unpacks a release; the running app reads them on each launch. The two sets do not overlap. A variable read by the installer has no effect once kli is installed, and a variable read by the app has no effect during installation.

Provider credentials

The app reads provider API keys from the environment at the moment it resolves a credential, not at boot. Changing the variable's value changes the credential the next time a request is made; there is no cached copy to clear.

Both variables back a credential reference that names the variable rather than storing its value. The reference is what kli persists; the secret stays in the environment. A provider whose default credential names a variable that is unset or empty is treated as unavailable until the variable holds a non-empty value, or until you register a different credential with /auth.

Variable	Read by	Default	Effect
ANTHROPIC_API_KEY	app	unset	API key for the anthropic provider (the Anthropic Messages API). Resolved live on each request.
OPENAI_API_KEY	app	unset	API key for the openai provider (the OpenAI Responses API). Resolved live on each request.

The openai-codex provider authenticates through OAuth and reads no environment variable. A compatible provider (a user-defined OpenAI-compatible endpoint declared in ~/.config/kli/providers.json) reads the variable named by that entry's key-env field; the field is per-provider, so the variable name is whatever you set it to. See Connect a provider for registering credentials.

Boot profile

Variable	Read by	Default	Effect
KLI_PROFILE	app	interactive-terminal	Names the boot profile to install at launch.

The app resolves the boot profile in order: the --profile flag, then KLI_PROFILE, then the profile key in settings.json, then the built-in default interactive-terminal. The first source that names a profile wins, so KLI_PROFILE overrides the settings key but yields to an explicit --profile. A name that resolves to neither a built-in nor a declared data profile falls back to the default and records a boot diagnostic. See Profiles.

Docs origin

Variable	Read by	Default	Effect
KLI_DOCS_BASE	app	https://docs.kleisli.io	Origin the kli docs subcommand fetches documentation from. Point it at a private mirror or a local docs server; a trailing slash is ignored.
KLEISLI_BASE_URL	app	unset	Fallback docs origin for kli docs, used only when KLI_DOCS_BASE is unset.

kli docs resolves the origin in order: KLI_DOCS_BASE, then KLEISLI_BASE_URL, then the default. The subcommand always fetches the kli project's docs. See Reading the docs.

Installer variables

The installer reads these once, before download. They take effect when set in the same command that runs the installer, for example KLI_VERSION=v0.1.0 curl -fsSL https://kli.kleisli.io | sh.

Variable	Read by	Default	Effect
KLI_VERSION	installer	latest release	Pins the version to install, as a release tag (for example v0.1.0). When unset, the installer queries the GitHub API for the latest release tag. Ignored when KLI_DOWNLOAD_BASE is set.
KLI_INSTALL_DIR	installer	~/.local (/usr/local when run as root)	Install root. The binary lands in <dir>/lib/kli and a launcher wrapper in <dir>/bin/kli.
KLI_DOWNLOAD_BASE	installer	GitHub release URL	Origin to download the release artifact and checksums.txt from, instead of the GitHub release: a private mirror, an air-gapped copy, or a local server. When set, version resolution is skipped and KLI_VERSION is ignored.

The installer downloads kli-<os>-<arch>.tar.gz from the resolved origin and verifies it against checksums.txt when that file is present. The download base is a directory URL; the installer appends the artifact and checksum filenames to it. See Installation for platform coverage and the from-source path.