The CLI authenticates with the same bearer credentials as REST API V2 and the MCP Server. Prefer profiles over pasting keys into every command.

Login flow (planned)

# Interactive — stores a named profile in ~/.config/tradeics/config.toml
tradeics login

# Non-interactive — CI / automation
export TRADEICS_API_KEY="..."
tradeics auth status

You can also pass a key once:

tradeics --api-key "$TRADEICS_API_KEY" api get /master-management/v2.0/vendor-sub-category

Order of precedence (highest wins):

1. --api-key flag
2. TRADEICS_API_KEY environment variable
3. Active profile key from config
4. (Optional) device / browser login session when Platform self-serve ships

Profiles & environments

tradeics config set --profile staging --api-key "$STAGING_KEY" --base-url https://api.tradeics.example/v2
tradeics config set --profile prod --api-key "$PROD_KEY"

tradeics --profile staging auth status
tradeics --profile prod api get /master-management/v2.0/vendor-sub-category

Keep staging and production keys in separate profiles — never reuse production tokens in local agent experiments. See Versioning & environments.

LLM credentials

LLM commands use the same family of secrets or a dedicated LLM key:

export TRADEICS_LLM_API_KEY="sk-..."
tradeics llm models list

Logout / rotate

tradeics logout --profile staging
tradeics auth rotate   # when Platform supports rotation; otherwise rotate via support

Next

• QuickstartAuthenticated happy path.Read
• ConfigurationConfig file layout.Read
• Platform authentication guideHTTP headers.Read