# Environment Variables


kli reads environment variables in two places: the installer script (`curl -fsSL https://kli.kleisli.io | sh`) reads them once, while it downloads and unpacks a release; the running app reads them on each launch. The two sets do not overlap. A variable read by the installer has no effect once kli is installed, and a variable read by the app has no effect during installation.

## Provider credentials

The app reads provider API keys from the environment at the moment it resolves a credential, not at boot. Changing the variable's value changes the credential the next time a request is made; there is no cached copy to clear.

Both variables back a credential reference that names the variable rather than storing its value. The reference is what kli persists; the secret stays in the environment. A provider whose default credential names a variable that is unset or empty is treated as unavailable until the variable holds a non-empty value, or until you register a different credential with `/auth`.

| Variable | Read by | Default | Effect |
|---|---|---|---|
| `ANTHROPIC_API_KEY` | app | unset | API key for the `anthropic` provider (the Anthropic Messages API). Resolved live on each request. |
| `OPENAI_API_KEY` | app | unset | API key for the `openai` provider (the OpenAI Responses API). Resolved live on each request. |

The `openai-codex` provider authenticates through OAuth and reads no environment variable. A `compatible` provider (a user-defined OpenAI-compatible endpoint declared in `~/.config/kli/providers.json`) reads the variable named by that entry's `key-env` field; the field is per-provider, so the variable name is whatever you set it to. See [Connect a provider](/kli/guides/connect-a-provider) for registering credentials.

## Boot profile

| Variable | Read by | Default | Effect |
|---|---|---|---|
| `KLI_PROFILE` | app | `interactive-terminal` | Names the boot profile to install at launch. |

The app resolves the boot profile in order: the `--profile` flag, then `KLI_PROFILE`, then the `profile` key in `settings.json`, then the built-in default `interactive-terminal`. The first source that names a profile wins, so `KLI_PROFILE` overrides the settings key but yields to an explicit `--profile`. A name that resolves to neither a built-in nor a declared data profile falls back to the default and records a boot diagnostic. See [Profiles](/kli/concepts/profiles).

## Docs origin

| Variable | Read by | Default | Effect |
|---|---|---|---|
| `KLI_DOCS_BASE` | app | `https://docs.kleisli.io` | Origin the `kli docs` subcommand fetches documentation from. Point it at a private mirror or a local docs server; a trailing slash is ignored. |
| `KLEISLI_BASE_URL` | app | unset | Fallback docs origin for `kli docs`, used only when `KLI_DOCS_BASE` is unset. |

`kli docs` resolves the origin in order: `KLI_DOCS_BASE`, then `KLEISLI_BASE_URL`, then the default. The subcommand always fetches the `kli` project's docs. See [Reading the docs](/kli/cli/docs).

## Installer variables

The installer reads these once, before download. They take effect when set in the same command that runs the installer, for example `KLI_VERSION=v0.1.0 curl -fsSL https://kli.kleisli.io | sh`.

| Variable | Read by | Default | Effect |
|---|---|---|---|
| `KLI_VERSION` | installer | latest release | Pins the version to install, as a release tag (for example `v0.1.0`). When unset, the installer queries the GitHub API for the latest release tag. Ignored when `KLI_DOWNLOAD_BASE` is set. |
| `KLI_INSTALL_DIR` | installer | `~/.local` (`/usr/local` when run as root) | Install root. The binary lands in `<dir>/lib/kli` and a launcher wrapper in `<dir>/bin/kli`. |
| `KLI_DOWNLOAD_BASE` | installer | GitHub release URL | Origin to download the release artifact and `checksums.txt` from, instead of the GitHub release: a private mirror, an air-gapped copy, or a local server. When set, version resolution is skipped and `KLI_VERSION` is ignored. |

The installer downloads `kli-<os>-<arch>.tar.gz` from the resolved origin and verifies it against `checksums.txt` when that file is present. The download base is a directory URL; the installer appends the artifact and checksum filenames to it. See [Installation](/kli/cli/installation) for platform coverage and the from-source path.