bt CLI. For installation and workflow examples, see the CLI quickstart.
Commands
Authentication and profiles
A profile is a saved login containing credentials and connection details for one Braintrust app URL. One profile can be used with every organization its credentials can access. Most people need only one profile. Add another when you sign in with different credentials or connect to a different Braintrust app URL. Runbt login to save a profile, bt profiles to list, rename, or delete profiles, and bt status --all to verify saved credentials.
Organization and project selection is separate from the profile. bt switch saves both as your active context, bt status shows what’s active, and you can override either one per command with --org and --project.
bt stores profile metadata locally and credentials in your system’s secure credential store when available. If secure storage is unavailable, it uses a local credentials file.
If you’re moving from a version with bt auth commands, see Migrate bt.
Credential precedence
When more than one credential source is present,bt makes two decisions in turn. First, whether to use an API key or a saved profile:
- Passing
--profileor--prefer-profileon the command line makesbtuse a saved profile and ignoreBRAINTRUST_API_KEY. - Otherwise,
BRAINTRUST_API_KEYfrom the environment wins. - Otherwise,
btuses a saved profile, selected by the rules below.
- The
--profile NAMEflag. - The
BRAINTRUST_PROFILEenvironment variable. - The profile saved by
bt switch, if it matches the requested app URL. - The only compatible profile for the app URL and organization, if exactly one is saved.
- An interactive picker, if several profiles are compatible and
btis running in an interactive terminal. In CI or other non-interactive environments, setBRAINTRUST_PROFILEor pass--profileto avoid an ambiguous-profile error.
bt status to see the active organization, project, and selected profile. Run bt status --all to verify saved profiles and report missing, expired, or invalid credentials.
Having a saved login is not the same as selecting one. Only the
--profile or --prefer-profile flag suppresses BRAINTRUST_API_KEY. Setting BRAINTRUST_PROFILE does not, so an API key in the environment still wins over it.Global flags
Mostbt commands accept these global flags. Commands that only manage login state, such as bt login, accept the credential-related flags but not organization or project selection flags.
Environment variables
These variables configure common CLI behavior and selected commands. Runbt <command> --help for that command’s complete flag and environment-variable mappings.
Troubleshooting
bt not found after install
bt not found after install
Open a new shell. Ensure
~/.local/bin (or $XDG_BIN_HOME if set) is in your PATH.OAuth login fails
OAuth login fails
On SSH,
bt auto-detects and prints the auth URL instead of opening a browser. Use --no-browser to force this behavior. The OAuth callback times out after 5 minutes. On remote hosts, paste the final callback URL from your local browser if the localhost callback can’t be delivered.No profile found
No profile found
Run
bt profiles list to list saved profiles, or bt status --all to verify their credentials. Specify one with --profile or BRAINTRUST_PROFILE. If you recently migrated from a version with bt auth commands, see the CLI migration guide.Wrong org or project
Wrong org or project
Run
bt status --verbose to see the active organization and project and where that context was set.bt is using the wrong credentials
bt is using the wrong credentials
Run
bt status --verbose to inspect the saved profile and context. If BRAINTRUST_API_KEY is set in your shell, it takes precedence over a saved login. Unset it or pass --prefer-profile to use your profile instead. See Credential precedence for the full order.Token expired
Token expired
Run
bt login --refresh to force-refresh your OAuth token, or bt login to re-authenticate. If these commands are unfamiliar, they replaced bt auth refresh and bt auth login in v0.16.0; see the CLI migration guide.Where are credentials stored?
Where are credentials stored?
bt stores credentials in your system’s secure credential store:- macOS: system keychain (via
security) - Linux: libsecret /
secret-toolif available; otherwise a0600-permission plaintext file - Windows: local credentials file (keychain integration not yet implemented)
Update fails
Update fails
bt update works for installs made with the standalone shell or PowerShell installer. If you installed with mise or npm, update through that package manager.Uninstall
Uninstall
macOS and Linux:Windows (PowerShell):