Skip to main content

​
setup

Prompts for a key, verifies it against the gateway, and stores it. Verification happens before storage, so a mistyped key fails here rather than on your first real call.
--key puts a live secret in your shell history. Prefer the prompt, or pipe it in: echo "$GORO_KEY" | goro setup. For CI, set GORO_API_KEY and skip setup entirely.

​
keys add

Same flow, but it does not switch the active key unless it is the first one stored. Useful when you have a personal workspace and a client workspace.

​
keys list

* marks the active key. Keys always print as a prefix plus the last four characters. The full secret is never printed by any command, in either human or JSON output. If GORO_API_KEY is set in your shell, keys list says so, because that key wins over everything stored:

​
keys use

​
Where keys live

~/.goro/config.json, mode 0600, inside a directory with mode 0700. The CLI re-applies those permissions on every write, so a file that something else loosened is tightened again rather than left open. If it finds the file world-readable, keys list warns:
Point the whole config directory somewhere else with GORO_CONFIG_HOME, which is how you keep separate profiles:

​
Precedence

When more than one key is available, the first match wins:
1

GORO_API_KEY

An environment variable beats everything stored. Nothing is written to disk.
2

The active stored key

Whatever keys use last selected.
The gateway base URL resolves the same way: --api, then GORO_API_URL, then the api_url saved in your config, then the default.

​
Losing a key

Revoke it in the dashboard. A revoked key fails closed on the next call:
Exit code 2, so a script can tell an auth problem from an empty wallet (3) or a flaky provider (4).