Manage API key environment variables for Syntic Code
For everyday use you do not need an API key: you sign in through the browser and Syntic Code renews its access on its own. Environment variables are for places with no browser, such as CI jobs and servers. A key in your shell always wins over your browser sign-in, which is the most common cause of “wrong account” problems.
The credential variables
| Variable or setting | Use it for | Notes |
|---|---|---|
SYNTIC_OAUTH_REFRESH_TOKEN | CI jobs that run on your account | Swapped for short-lived access at start. No key is created. |
SYNTIC_API_KEY | Automation that should use an API key | Wins over every other credential. Create one in the Console. |
syntic setup-token | A long-lived server you set up by hand | Reads the token from a hidden prompt, so it never lands in shell history. |
apiKeyHelper (personal settings only) | Fetching a credential from a secrets manager | A command that prints the credential. |
Which credential is used
Syntic Code takes the first one it finds:
SYNTIC_API_KEYin the environment- A token saved by
syntic setup-token - Your browser sign-in
- The
apiKeyHelpercommand
Run /doctor in a session to see where the active credential came from and when it expires.
Set up a CI job
Store the credential as a secret
Add the refresh token or API key to your CI system’s secret store. Never commit it to the repository or type it on a command line.
Expose it to the job
export SYNTIC_OAUTH_REFRESH_TOKEN="$SYNTIC_TOKEN_FROM_CI"Check it before the real work
syntic auth status exits with 0 when a credential is found and 1 when not, so a job can stop early with a clear message.
Remove a key you no longer want
Unset it in your shell
unset SYNTIC_API_KEYRemove it from your shell profile
Delete the export line from files such as ~/.zshrc or ~/.bashrc, then open a new terminal.
Revoke it if it may have leaked
See Revoke an API key. For browser sign-ins, the website’s Settings › API Access page lists Connected CLIs with a Revoke button for each.
Syntic Code removes its own credentials from the environment of every command, hook and tool server it starts, and a project’s settings files can never set credentials. Even so, treat any token like a password.
Other useful variables
| Variable | Effect |
|---|---|
SYNTIC_NO_BROWSER=1 | Sign in by pasting a code instead of opening a browser. See Sign in on a remote machine. |
SYNTIC_HTTPS_PROXY, SYNTIC_EXTRA_CA_CERTS | Company proxies and certificates. See Proxy or firewall. |
SYNTIC_PRIVACY=essential | Stops optional background calls. |