CLI authentication#

Configure CLI environment credentials without confusing them with desktop browser sign-in or a verified server identity.

Overview#

The CLI reads credentials from the process environment. It does not use the desktop applications’ browser sign-in and licence flow, and it does not provide a general public token-issuance flow.

Desktop and CLI Credentials Are Separate#

Surface

Credential path

What it is used for

SystemVerilog IDE and ISA Design Studio

Browser sign-in followed by the desktop licence check

Whether that desktop application can open for the current account and machine

Altifigence CLI

ALTI_TOKEN and ALTI_ORG_ID in the process environment

Only the credential material presented by that CLI process

A successful desktop sign-in does not populate CLI environment variables. A configured CLI environment does not grant a desktop licence.

Environment Variables the CLI Reads#

ALTI_TOKEN and ALTI_ORG_ID are the only required values, and the CLI fails closed when either is missing or blank after trimming. Three further variables change behaviour and belong in the same review as the credentials themselves:

Variable

Required

Effect

ALTI_TOKEN

yes

Bearer credential. A value that already starts with Bearer is sent unchanged; otherwise the prefix is added

ALTI_ORG_ID

yes

Organization scope for org-scoped requests

ALTI_API_BASE

no

Overrides the API base URL. Defaults to https://api.altifigence.com

ALTI_BYO

no

1, true, or yes selects the bring-your-own principal kind. Any other value, including unset, means first-party

ALTI_ALLOW_SOURCE_UPLOAD

no

Read by the stdio MCP server, whether started as alti-mcp or as alti mcp serve. 1, true, or yes un-hides the three source-bearing actions that are hidden and denied by default. Unset means denied

Treat ALTI_API_BASE as a security control rather than a convenience flag: it is the one variable that can send an otherwise correct credential to an unintended host. Set it only for an endpoint you control or that Altifigence has named for you, and not in a shared shell profile.

Configuration Status Is Not Authentication#

The binary contains an auth status surface that classifies the two environment values as missing, partial, or configured. It does not contact an identity server, and its serverVerification value is not_performed. It reports configuration only, not an authenticated identity, organization role, or entitlement.

That surface is not needed for the offline first-success workflow. Do not provision credentials merely to run CLI First Success.

Interactive alti login and alti whoami are unavailable in this release. They return exit status 4 with AUTH_FLOW_UNAVAILABLE and IDENTITY_NOT_VERIFIED, respectively. alti logout cannot remove a value set by the parent process. It returns 0 after reporting that nothing was removed; clear or rotate the value where it was originally configured.

Secret Handling#

  • Store CI values in the CI platform’s secret store.

  • Inject them only into the step that needs them.

  • Never put them in a repository file, command example, MCP configuration, build artifact, screenshot, or support report.

  • Do not print the environment or enable shell tracing around a credentialed command.

  • Remove temporary credentials from the process environment when the step finishes and rotate any value that may have entered a log.

Remote API Access#

This release does not publish a general Public API, complete remote workflow, or self-service CLI token issuance. Only use a remote operation when the account and documentation both show it as available.