Where is the Dock CLI config file?

There isn't one. The CLI keeps no dotfile in your home directory. Its only state is your credential, which lives in your operating system's keychain.

How do I point the Dock CLI at staging or a local Dock?

Set `DOCK_URL`. It defaults to https://app.trydock.ai. Each host holds its own credential, so sign in again after pointing somewhere new.

What are the Dock CLI exit codes?

0 success, 1 the command ran and failed (not signed in, or the API rejected it), 2 you used it wrong such as an unknown command or a missing argument.

Will an error message leak my credential?

No. Error output is scrubbed before it reaches the terminal, so a token cannot appear in a stack trace or a logged URL.

CLI · Reference

Configuration

There is almost nothing to configure. One environment variable, and a credential you never handle yourself.

There is no config file

The CLI does not write a dotfile in your home directory. The one piece of state it keeps is your credential, and that lives in your operating system's keychain: macOS Keychain, Windows Credential Vault, or libsecret via keytar. Dock's servers store only a SHA-256 hash of it, never the plaintext.

That is a deliberate choice rather than a missing feature. A token in a plaintext file is a token that gets copied into a dotfile backup, a container image, or a screen share. Nothing to read means nothing to leak.

DOCK_URL

The one setting. It points the CLI at a different Dock host, and defaults to https://app.trydock.ai.

# One command
DOCK_URL=https://staging.trydock.ai dock whoami

# Or for the whole shell
export DOCK_URL=https://staging.trydock.ai
dock login

Each host holds its own credential, so signing in to one does not sign you in to another. Sign in again after pointing somewhere new.

Managing the credential

You never handle the token directly. dock login puts one in the keychain, dock logout revokes it on that machine, and it expires on its own after 90 days. Each machine you sign in from holds its own, so revoking one does not sign out the others. Full detail on Authentication.

Exit codes

Stable, so a script can branch on them: 0 success, 1 the command ran and failed (not signed in, or the API rejected it), and 2 you used it wrong (unknown command, missing argument).

Error output

Errors are scrubbed before they reach your terminal, so a credential cannot leak through a stack trace or a logged URL. If you paste a failure into an issue, you are not pasting your token with it.

Related: CLI reference · Authentication

Frequently asked questions

Where is the Dock CLI config file?: There isn't one. The CLI keeps no dotfile in your home directory. Its only state is your credential, which lives in your operating system's keychain.
How do I point the Dock CLI at staging or a local Dock?: Set `DOCK_URL`. It defaults to https://app.trydock.ai. Each host holds its own credential, so sign in again after pointing somewhere new.
Where does the Dock CLI store my token?: In your operating system's keychain: macOS Keychain, Windows Credential Vault, or libsecret via keytar. Dock's servers store only a SHA-256 hash of it, never the plaintext.
What are the Dock CLI exit codes?: 0 success, 1 the command ran and failed (not signed in, or the API rejected it), 2 you used it wrong such as an unknown command or a missing argument.
Will an error message leak my credential?: No. Error output is scrubbed before it reaches the terminal, so a token cannot appear in a stack trace or a logged URL.