Credentials and tokens
Choose the correct credential for users, bots, CI, Git transport, and direct AI providers.
Use the narrowest identity
| Workload | Recommended credential |
|---|---|
| Human using the CLI | Personal CLI key |
| Git over SSH | Device-specific SSH key |
| Automation acting as a service identity | Bot token |
| Workflow runtime | Repository or organization Actions secret |
Local try ask provider | Provider API key stored in local CLI configuration |
Do not use a bot token for routine personal commands. The TRYLLE_BOT_TOKEN environment variable takes precedence over a personal API key and saved configuration.
CLI keys
- Create them in Settings → CLI.
- Use one key per device or automation boundary where practical.
- Validate with
try whoami. - Avoid routine use of
try auth token --show. - Remember that
try auth logoutcurrently deletes the complete local CLI config.
Bot tokens
try bot list
try bot token BOT_IDtry bot token mints secret material. Run it only in a terminal or automation path that can protect output, then place the token in a secret store. The CLI does not create bot identities; create them in the web app first.
Actions secrets
Keep values out of recorded command literals. Load an existing environment variable, write it, and unset it:
try actions secret set NAME "$SECRET_VALUE" -R OWNER/REPOSITORY
unset SECRET_VALUESee CI secrets and variables for scopes and precedence.
Direct AI provider keys
The CLI's AI helpers connect directly to the configured OpenAI, Anthropic, Groq, Gemini, OpenRouter, or other provider. Those credentials stay separate from Trylle API authentication and from Trylle-hosted AI billing.