Saved settings, environment variables, which value wins, and the tools for checking your setup.

Settings

Command	What it does
`valiqai config list`	Shows every setting, and the workspaces you're signed in to.
`valiqai config get <key>`	Prints one setting: `apiKey`, `apiUrl`, `defaultMode` or `timeout`.
`valiqai config set <key> <value>`	Saves `apiUrl`, `defaultMode` (`generic` or `custom`) or `timeout` (like `20m`). `scan` uses them when you leave out the flag.
`valiqai config path`	Prints where settings are saved.
`valiqai config reset`	Removes every saved setting, including the key.

Settings are saved in your user folder (valiqai config path prints where). Keys from valiqai login are saved there too, per workspace.

Environment variables

Variable	What it does
`VALIQAI_API_KEY`	The API key. Takes priority over any signed-in workspace.
`VALIQAI_WORKSPACE`	Which signed-in workspace to use, like `--workspace`.
`VALIQAI_API_URL`	Which ValiqAI to use, if not `https://www.valiqai.com`. A `--api-url` flag takes priority.
`VALIQAI_NO_UPDATE_NOTIFIER`	`1` stops the once-a-day check for a newer version. It never runs in CI.
`NO_COLOR`	Any value turns colours off, like `--no-color`.

Which value wins

For the key, see Which key is used. For everything else, the first of these that's set:

The flag, like --timeout 20m.
The environment variable, like VALIQAI_API_URL.
This folder's valiqai.json, for the address, scan.type and scan.failOn.
A saved setting (valiqai config set).
The default.

Options for every command

Option	What it does
`-q, --quiet`	`scan` and `scans watch` print only the result: the summary, the verdict and any error.
`--debug`	Prints each request to ValiqAI with its status, time and request id. The key shows only as its first characters. Send this with a bug report.
`--no-color`	No colours. Setting `NO_COLOR` does the same.

Once a day, outside CI, the CLI checks npm for a newer version in the background and mentions it after a command. VALIQAI_NO_UPDATE_NOTIFIER=1 turns that off.

Check your setup

valiqai doctor checks what a scan needs, each with a tick or what to fix:

Terminal

$ valiqai doctor✓ Node 22.3.0✓ CLI 1.7.0✓ Key from your browser sign-in (Northstar)✓ Reached https://www.valiqai.com (84 ms)✓ Signed in as Maya · Northstar (team)! The key expires in 6 days  Run valiqai login to get a new one.✓ valiqai.json: northstar.app (staging, production)✓ northstar.app is verified✓ 140 credits· Not in CI Ready to scan, with a warning above.

It exits 1 when something would stop a scan, so it works as a first CI step too. --json prints the checks.

On its own, valiqai shows who you're signed in as, this folder's site, your last scan, and three commands to try next.

Shell completion

valiqai completion <shell> prints a script that completes commands, flags and their values when you press Tab:

~/.zshrc

source <(valiqai completion zsh)