# Configuration

Where the CLI keeps your key and which environment variables change what it does.

## Where your key lives

After `lockpick login`, the CLI keeps your key in your system keychain, under the service `lockpick-cli`. Where there is no keychain, it keeps it in `~/.config/lockpick/config.json`, readable only by you.

## Environment variables

| Variable              | What it does                                                                                 |
| --------------------- | -------------------------------------------------------------------------------------------- |
| `LOCKPICK_HOST`       | The Lockpick address to use, instead of the one you signed in to                             |
| `LOCKPICK_KEY`        | A key to use instead of the saved one, for example in CI                                     |
| `LOCKPICK_CONFIG_DIR` | Where to keep `config.json`                                                                  |
| `XDG_CONFIG_HOME`     | Moves the config folder to `$XDG_CONFIG_HOME/lockpick`                                       |
| `LOCKPICK_KEYCHAIN`   | Set to `0` to skip the keychain and use the file                                             |
| `NO_COLOR`            | Turns colour off                                                                             |
| `FORCE_COLOR`         | Set to `1` for colour where the output is not a terminal, such as a CI log; `0` turns it off |

> **Careful**
>
> A key can do what you allowed when you signed in. Keep `LOCKPICK_KEY` in
> your CI's secret store, never in your repository.

## What the CLI prints

Text from scanned sites, such as evidence and finding titles, can contain characters a terminal would act on: clearing the screen, hiding text, writing your clipboard or disguising a link. The CLI shows them as visible symbols, `␛` for an escape, instead of passing them to your terminal. It never prints your key, even when an error repeats it.

With `--json`, results go to standard output and errors to standard error as JSON, without colour.

## Keys expire when idle

Each key lasts while you use it. A key nobody uses for the time your workspace sets, 30 days unless an admin changes it, stops working. See and revoke your keys in Lockpick under **Add to your AI**, on the **CLI and keys** tab.

## Use the CLI as an MCP server

`lockpick mcp` runs Lockpick as a local MCP server for coding assistants, and `lockpick mcp config claude`, `cursor`, `vscode` or `codex` prints the setup for each. Most people use [the hosted server](/docs/mcp/hosted-server) instead.