> For the complete documentation index, see [llms.txt](https://rawctx.gitbook.io/rawctx-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rawctx.gitbook.io/rawctx-docs/documentation/reference/configuration-and-authentication.md).

# Configuration and authentication

## Default configuration

The CLI stores its configuration at `~/.rawctx/config.yaml` by default.

```yaml
registry: "https://<workspace-api-host>"
auth:
  token: "rxctx_..."
  token_id: "uuid"
  token_name: "rawctx-cli"
profile:
  username: "owner"
  tenant_slug: "workspace-slug"
  tenant_display_name: "Workspace name"
```

Do not commit this file or copy tokens into documentation, issue reports, or proof metadata.

## Environment overrides

* `RAWCTX_CONFIG`: alternate configuration path
* `RAWCTX_REGISTRY`: registry URL
* `RAWCTX_TOKEN`: API token

Registry precedence is `--registry`, `RAWCTX_REGISTRY`, then the saved config. Token precedence is `RAWCTX_TOKEN` then the saved config; the CLI does not expose a general `--token` option.

## Authenticated operations

Answer evidence, reconciliation, evidence assets, settings, token management, policy, exports, and trust administration require workspace authentication.

## Production runtime tokens

Do not run `rawctx login` in a production server or container. A workspace administrator creates a dedicated runtime token from **Settings > Access & team > API tokens** in the workspace Hub, copies the value when it is shown, and stores it in the deployment platform's secret manager. Inject the workspace API host as `RAWCTX_REGISTRY` and the token as `RAWCTX_TOKEN`.

Use a distinct name and the shortest practical expiration for each deployment. Rotate or revoke the token from the same UI. Current UI-issued API tokens are workspace/user scoped rather than bound to one `application_key` or a limited scope set, so do not reuse an administrator's interactive CLI token across applications.

Developers and operators can still use `rawctx login` for CLI work on a trusted machine. Do not use it to bootstrap a production server.

## Answer-evidence policy settings

Tenant managers review and update these through the private workspace settings or `GET/PATCH /api/tenant/settings`:

* `answer_audit_store_question_text`
* `answer_audit_store_answer_text`
* `answer_audit_default_retention_days` (`1..3650` on update)
* `answer_audit_keyed_hash_enabled`
* `answer_audit_hash_key_id`

Text submission, text storage, commitment mode, and retention are separate controls. Changing defaults does not rewrite existing records.

## Service endpoint rule

After login, use the saved tenant registry for answer evidence, reconciliation, evidence assets, policy, collectors, and other workspace-scoped actions. An explicit registry override must name that workspace API host. Browser session routing is internal to the Hub and must not be configured as the SDK registry.

## CI guidance

* Create the runtime token in the workspace UI and store `RAWCTX_TOKEN` in the CI or deployment provider's secret store.
* Pin dependency versions where reproducibility matters.
* Avoid printing configuration files or environment variables in debug logs.
* Rotate a token immediately if it appears in a build artifact or log.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://rawctx.gitbook.io/rawctx-docs/documentation/reference/configuration-and-authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.