The config file

tigby login writes one file and the CLI writes nothing else. It holds your Admin Key in the clear, which is a deliberate trade – the same one gh and aws make – and this page is where it is disclosed rather than assumed.

Where it is

--config <path> and TIGBY_CONFIG point somewhere else – a checkout, a mounted secret, a throwaway directory in a test. Everything below applies to whichever file is in use.

Nothing else is left behind: no cache, no log file, no token store, no history. Two commands write elsewhere, and only when you ask them to: tigby export download writes the archive where you named it – owner-read/write, like this file, because it holds everything Tigby has for the Org – and tigby upgrade replaces the binary in place, staging the download beside it first and removing it again if the checksum does not match. That is the whole footprint.

What it holds

# tigby CLI configuration. Written by `tigby login`; edit at your own pace.
# The keys here are credentials in the clear – the file is 0600 for that reason.

default_profile = "default"

[profiles.default]
api_url = "https://api.tigby.eu"
api_key = "tigby_admin_…"
key_id = "key_01J…"
key_name = "laptop"

[profiles.staging]
api_url = "https://api.staging.example"
api_key = "tigby_admin_…"

One [profiles.<name>] table per profile. api_url is optional and falls back to https://api.tigby.eu; key_id and key_name are what tigby logout uses to revoke exactly the key this machine is holding, rather than all of them.

The 0600 trade

The key is stored as you were shown it, not hashed and not encrypted, because the CLI has to send it. On Unix the file is created owner-read/write and nothing else, and it is created that way rather than corrected afterwards – the mode is what the file is born with, so there is no moment when the key sits in a world-readable file. The directories the CLI creates on the way are 0700 for the same reason. Windows has no Unix mode; the file inherits the user profile's ACL, which is what Windows tooling relies on generally.

What that does and does not buy you:

• It protects the key from other accounts on the same machine. Another user cannot read it.
• It does not protect it from you, or from anything running as you. Any program you run can read the file. A cross-platform keychain was considered and refused: it costs three platform integrations and a headless story that ends in a file anyway.
• A backup of your home directory contains the key. Treat it as you would an SSH private key.

If that trade is not one you want to make, do not run tigby login: pass --api-key per command, or put the key in TIGBY_API_KEY and let your own secret manager put it there. The CLI works fully with no config file at all.

Which credential wins

In order, first match wins:

1. --api-key <key> on the command line
2. TIGBY_API_KEY in the environment
3. the api_key of the selected profile

The API URL follows the same ladder – --api-url, then TIGBY_API_URL, then the profile's api_url, then https://api.tigby.eu. The selected profile is --profile <name>, then TIGBY_PROFILE, then default_profile from the file, then default.

tigby tunnel connect is the exception, because it authenticates as an Identity and not as the Org: it takes --identity-key or TIGBY_IDENTITY_KEY, and an Identity Key is never written to the config file.

The file is the CLI's to rewrite

tigby login is the only command that writes it, and it writes the whole file. Values survive; comments and formatting you add do not. Edit it freely – it is TOML and nothing validates it beyond being readable – but expect the next login to render it afresh.

Switching the default profile is a file edit. tigby login --profile staging creates or updates the staging profile and selects it for that command, but it does not make staging the default: default_profile is written once, when the file has none, and no later login moves it. To change it, change that line by hand, or name the profile every time with --profile or TIGBY_PROFILE. There is no tigby profile use verb; if one is added, this page changes with it.