Configuration
Where the CLI keeps your key and which environment variables change what it does.
Where your key lives
After lockpick login, the CLI keeps your key in your system keychain, under the service lockpick-cli. Where there is no keychain, it keeps it in ~/.config/lockpick/config.json, readable only by you.
Environment variables
| Variable | What it does |
|---|---|
LOCKPICK_HOST |
The Lockpick address to use, instead of the one you signed in to |
LOCKPICK_KEY |
A key to use instead of the saved one, for example in CI |
LOCKPICK_CONFIG_DIR |
Where to keep config.json |
XDG_CONFIG_HOME |
Moves the config folder to $XDG_CONFIG_HOME/lockpick |
LOCKPICK_KEYCHAIN |
Set to 0 to skip the keychain and use the file |
NO_COLOR |
Turns colour off |
FORCE_COLOR |
Set to 1 for colour where the output is not a terminal, such as a CI log; 0 turns it off |
What the CLI prints
Text from scanned sites, such as evidence and finding titles, can contain characters a terminal would act on: clearing the screen, hiding text, writing your clipboard or disguising a link. The CLI shows them as visible symbols, ␛ for an escape, instead of passing them to your terminal. It never prints your key, even when an error repeats it.
With --json, results go to standard output and errors to standard error as JSON, without colour.
Keys expire when idle
Each key lasts while you use it. A key nobody uses for the time your workspace sets, 30 days unless an admin changes it, stops working. See and revoke your keys in Lockpick under Add to your AI, on the CLI and keys tab.
Use the CLI as an MCP server
lockpick mcp runs Lockpick as a local MCP server for coding assistants, and lockpick mcp config claude, cursor, vscode or codex prints the setup for each. Most people use the hosted server instead.
Was this helpful?
Thanks. It helps us improve this page.