Trylle Documentation

Connect Trylle CLI with a CLI Key, understand credential precedence, and verify the active account.

Trylle platform commands authenticate with a CLI Key. Create one at trylle.com/settings/cli, then save it with the CLI.

A CLI Key is not an AI provider key

The Trylle credential authorizes platform operations such as repositories, pull requests, issues, and CI. The ask, explain, and draft commands use separate credentials for the selected AI provider.

Run the login command in a terminal and paste the CLI Key into its prompt:

try auth login

The CLI validates the key against the active /v1/viewer endpoint before it saves anything. On Linux and macOS, the saved configuration is normally at ~/.config/trylle-cli/config.json; XDG_CONFIG_HOME changes that base path.

Verify both the credential source and the account returned by the API:

try auth status
try whoami

auth status is useful for configuration diagnosis, but it treats an available token as authenticated even when the viewer request fails. whoami is the stronger end-to-end validation of the token and endpoint.

In automation, inject the key through the secret mechanism of the environment. Do not put it directly in a command literal, a repository file, or a build log.

Supply TRYLLE_API_KEY through the environment's secret manager, then run auth login in JSON mode so the command does not prompt. Non-interactive login requires either the environment variable or --api-key. The environment form avoids placing the value in process arguments and shell history. After login, unset the variable and validate with try whoami. The successful login copies the key into the Trylle CLI config file.

For ephemeral automation that should not save the key, skip auth login and run platform commands with TRYLLE_API_KEY supplied only to the process.

Credential precedence

For platform API calls, the first non-empty credential wins:

Priority	Source	Intended use
1	`TRYLLE_BOT_TOKEN`	A bot identity running automation
2	`TRYLLE_API_KEY`	A user CLI Key injected into the current environment
3	Saved `api_key`	The key written by `try auth login`

This means a bot token in the shell overrides both a user environment key and the saved login. Inspect the active source without revealing the value:

try auth token

Do not use try auth token --show in routine diagnostics. It prints the active secret material.

Custom endpoints

The defaults are the public Trylle API and https://trylle.com. A self-hosted or development environment can save explicit endpoints during login:

try auth login \
  --api-endpoint https://api.example.test \
  --web-url https://example.test

Environment variables override saved endpoint settings:

Variable	Purpose
`TRYLLE_API_ENDPOINT`	Public API base URL
`TRYLLE_API_URL`	Legacy alias for the API base URL
`TRYLLE_WEB_URL`	Web application base URL used by `try browse`
`TRYLLE_PLATFORM_URL`	Legacy alias for the web application base URL

Troubleshooting

The source is unexpected

Check for credentials left in the current shell:

try auth token
env | sed -n '/^TRYLLE_\(BOT_TOKEN\|API_KEY\)=/s/=.*$/=<set>/p'

The second command reports only whether variables are set; it does not print their values. Unset the unintended source and run try whoami again.

Repository inference fails

Authentication can be valid while a repository command still cannot identify its target. Inspect the current checkout or pass the repository explicitly:

try repo context
try pr list -R OWNER/NAME

Sign out

try auth logout

Logout removes the whole CLI config file

In the current CLI, auth logout deletes config.json, not only the saved Trylle key. Any saved AI provider tokens, AI settings, agent settings, and custom endpoints in that file are removed too. Back up or reconfigure values you need before signing out.

Environment credentials are not changed by logout. Unset TRYLLE_API_KEY and TRYLLE_BOT_TOKEN separately when they are present.

Authenticate the CLI