socket config

$ socket config --help

  Manage Socket CLI configuration

  Usage
    $ socket config <command>

  Commands
    auto                        Automatically discover and set the correct value config item
    get                         Get the value of a local CLI config item
    list                        Show all local CLI config items and their values
    set                         Update the value of a local CLI config item
    unset                       Clear the value of a local CLI config item

  Options

    --no-banner                 Hide the Socket banner
    --no-spinner                Hide the console spinner

socket config reads and changes the settings the CLI saves on your machine, like your API token and default org. socket login writes most of them for you, so you mostly need socket config to check a value or change a single setting.

Every subcommand has its own --help and supports --json and --markdown output.

Config keys

Where the config is stored

The CLI saves its config as config.json in a socket/settings folder in your OS data directory:

• macOS: ~/Library/Application Support/socket/settings/config.json
• Linux: ~/.local/share/socket/settings/config.json
• Windows: %LOCALAPPDATA%\socket\settings\config.json

On macOS and Linux, the CLI uses $XDG_DATA_HOME/socket/settings/config.json instead when XDG_DATA_HOME is set. The file holds base64-encoded JSON, so use socket config to read and change it.

Overriding the config

Pass --config with a JSON object to use that config for a single run. The SOCKET_CLI_CONFIG env var does the same thing and wins over --config.

$ socket scan list --config '{"apiToken":"sktsec_...","defaultOrg":"my-org"}'
$ SOCKET_CLI_CONFIG='{"defaultOrg":"my-org"}' socket scan list

The override replaces the saved config for that run, so any key you leave out falls back to its default. While an override is active the config is read-only, and socket config set fails with a "not saved" error. SOCKET_CLI_NO_API_TOKEN also makes the config read-only.

Setting SOCKET_CLI_API_TOKEN only overrides the token. Other keys still save normally.

socket config list

Shows every key and its current value. The token is masked unless you pass --full.

socket config get

Prints the value of one key, for example socket config get defaultOrg. When SOCKET_CLI_API_TOKEN is set, socket config get apiToken prints that token.

socket config set

Saves a value for a key, for example socket config set defaultOrg my-org. The CLI stores the value as given and does not validate it, so the API may reject a bad value later.

Only skipAskToPersistDefaultOrg treats true and false as booleans. For other keys, true, false and undefined are saved as strings, and the CLI warns you. Use socket config unset to go back to the default.

socket config unset

Removes a key so its default applies again, for example socket config unset defaultOrg. It takes only the key.

socket config auto

Tries to find the right value for a key. This works for defaultOrg and enforcedOrgs, and both need an API token.

• socket config auto defaultOrg looks up the orgs your token can access and offers to save one as defaultOrg.
• socket config auto enforcedOrgs lists the orgs whose security policy you can enforce.

For the other keys it prints a hint. For apiToken, for example, it points you to socket login.