Skip to main content
The Tolmo CLI reads configuration from environment variables, making it easy to use in CI/CD pipelines and scripts without interactive login. Environment variable values take precedence over profile settings for the variables they cover — the rest of the configuration (such as the active organization) still comes from the profile unless you also set the corresponding variable.

​
Variable reference

​
string
API token used to authenticate requests. When set, Tolmo skips the profile lookup entirely and authenticates directly with this token. Generate a token from your organization settings in the Tolmo dashboard.
​
string
Organization slug that identifies which organization to operate against. Required whenever you set TOLMO_API_TOKEN, since the token alone does not encode an org identity.
​
string
Backend API base URL. Defaults to the production endpoint when not set. Override this to point the CLI at a staging or self-hosted environment.
​
string
Directory where the install script places the CLI binary. Set this before running curl -fsSL https://tolmo.com/install.sh | sh to control the installation target. The install script defaults to a writable user directory so that sudo is not required.
​
string
Default profile name used when --profile is not specified on the command line. Useful for switching the active profile for an entire shell session without passing --profile to every command.
​
string
Base URL used when the CLI prints a link into the Tolmo app, such as the link to a finding it just created. Derived from TOLMO_API_URL when not set, so you only need it if you run the app on a host the CLI cannot infer.
​
string
Set to any non-empty value to stop the CLI checking for a newer release. The check is already skipped when CI=true, so pipelines rarely need this.
​
string
Set to any non-empty value to suppress the prompt offering to install the Tolmo agent skill. Useful for non-interactive shells and images built ahead of time.
​
string
System directory the install script falls back to, defaulting to /usr/local/bin. Like TOLMO_INSTALL_DIR, this is read by the installer, not by the CLI.

​
CI/CD example

The following GitHub Actions workflow installs Tolmo and runs a security query using environment variables for authentication. No interactive login is needed and no credentials are stored on disk.
.github/workflows/tolmo.yml
Store TOLMO_API_TOKEN and TOLMO_ORG_SLUG as encrypted secrets in your GitHub repository or organization settings. The env: block injects them into the step at runtime without exposing them in logs.
Never commit API tokens to source control. Use your CI provider’s secrets management to store TOLMO_API_TOKEN. Anyone with access to a committed token can authenticate as your organization.

​
Precedence

Environment variables override the active profile for the specific settings they cover, and a command-line flag overrides both. For example, setting TOLMO_API_TOKEN and TOLMO_ORG_SLUG bypasses profile-based authentication entirely, but any setting not covered by an environment variable — such as a custom API URL — still comes from the profile unless you also set TOLMO_API_URL. The resolution order for each setting is:
  1. Command-line flag — highest priority, for flags like --org and --profile
  2. Environment variable
  3. Active profile — values stored in ~/.tolmo/ by tolmo auth login
  4. Built-in default — the production API URL and the default profile name
So --profile staging wins over TOLMO_PROFILE=prod, and --org other-org wins over TOLMO_ORG_SLUG. A flag is a deliberate, single-invocation override; it is not shadowed by whatever the shell happens to export.