# Environment and diagnostics

`cademi env` shows the settings the CLI is using and where each one comes from, and `cademi doctor` checks the configuration, the network, and the credentials. This page also lists every environment variable the CLI reads.

## `cademi env`

```sh
cademi env
cademi env base_url
cademi env --json
```

`cademi env` prints one row per setting with its value and its source. With a setting name, it prints only the value, for use in scripts; an unknown name exits with code `2`. `--json` prints an array of objects with `name`, `value`, `source`, and, when the value comes from an environment variable, `variable`. Secrets are never printed, only whether they are set and where.

For example, with `CADEMI_API_KEY` set and no saved profile:

```text
NAME            VALUE                                          SOURCE
config_dir      /Users/you/Library/Application Support/cademi  default
profile         -                                              unset
base_url        https://api.cademi.com.br                      default
auth_mode       key (autonomous)                               env (CADEMI_API_KEY)
credential      set                                            env (CADEMI_API_KEY)
lang            en-US                                          env (LANG)
color           auto (on in a terminal)                        default
auto_update     on                                             default
update_channel  stable                                         default
update_url      https://cli.cademi.dev                         default
listen_secret   ephemeral per run                              unset
version         0.1.4                                          build
api_release     3.4.5                                          build
platform        darwin/arm64                                   build
executable      /Users/you/.cademi/bin/cademi                  build
install_method  script                                         build
```

| Setting | Meaning |
|---|---|
| `config_dir` | Directory of the configuration file and the update state. |
| `profile` | Profile in use. |
| `base_url` | Platform URL of the requests. |
| `auth_mode` | `human` (OAuth plus credential) or `key` (credential only). |
| `credential` | Whether the credential secret is available, and the credential ID. |
| `environment` | `production` or `sandbox`, as saved in the profile. Shown only for saved profiles, and not when `CADEMI_API_KEY` is set. |
| `lang` | Language requested for API messages. |
| `color` | Whether the CLI uses colors. |
| `auto_update`, `update_channel`, `update_url` | Automatic updates, their channel, and where releases are downloaded from. |
| `listen_secret` | Where the signing secret of `cademi listen` comes from. |
| `version`, `api_release`, `platform`, `executable`, `install_method` | The build of the CLI and where it is installed. |

The source is one of `flag`, `env` (with the variable name), `config` (the configuration file), `profile`, `keychain`, `build`, `default`, or `unset`.

`cademi bug` reuses these settings: it opens a GitHub issue with them already filled in, without `config_dir` and `executable`, so you can report a bug in the CLI without copying them by hand. See [Report a problem](https://cademi.dev/cli.md#report-a-problem).

## Precedence

When a setting can come from several places, the first one found wins:

1. A command-line flag, such as `--profile` or `--base-url`.
2. An environment variable, such as `CADEMI_PROFILE` or `CADEMI_BASE_URL`.
3. The configuration file or the active profile.
4. The built-in default.

`CADEMI_API_KEY` is the exception: when it is set, it replaces the credentials of every profile ([Authentication](https://cademi.dev/cli/authentication.md#without-a-profile-cademi_api_key)). The platform URL still follows the order above.

## Environment variables

| Variable | Effect |
|---|---|
| `CADEMI_API_KEY` | Credential secret for autonomous mode. Takes precedence over every profile, and the keychain is not used. |
| `CADEMI_PROFILE` | Profile to use when the command has no `--profile`. |
| `CADEMI_BASE_URL` | Platform URL, overriding the profile. `--base-url` takes precedence. |
| `CADEMI_CONFIG_DIR` | Configuration directory. Defaults to `cademi` inside the system configuration directory: `~/Library/Application Support/cademi` on macOS, `$XDG_CONFIG_HOME/cademi` or `~/.config/cademi` on Linux, and `%AppData%\cademi` on Windows. |
| `CADEMI_LANG` | Language of API messages: `pt`, `en`, `es`, or `fr`, with or without a region (`pt_BR.UTF-8` works). When it is not set, the CLI reads `LC_ALL`, `LC_MESSAGES`, and `LANG`, in that order, and uses the first one that is set. If that value is not one of these languages, the CLI sends no language preference and the API answers in `en-US`. |
| `CADEMI_LISTEN_SECRET` | Signing secret of `cademi listen --forward-to`, instead of the one saved in the profile. |
| `CADEMI_DISABLE_AUTOUPDATE` | Any value turns off automatic updates. |
| `CI` | Any value turns off automatic updates. |
| `CADEMI_UPDATE_URL` | Base URL of a mirror for `cademi update` and automatic updates. Defaults to `https://cli.cademi.dev`. Signatures are verified the same way. |
| `NO_COLOR` | Any value turns off colors. `TERM=dumb` has the same effect. |

The install scripts read their own variables, listed in [Installation](https://cademi.dev/cli/installation.md#installer-options).

## `cademi doctor`

```sh
cademi doctor
cademi doctor --json
```

`cademi doctor` runs a series of checks and prints one line per check, marked `✓` (ok), `!` (warning), or `✗` (failure):

| Check | What it verifies |
|---|---|
| `config` | The configuration file can be read, and how many profiles it has. |
| `profile` | A profile or `CADEMI_API_KEY` is available, and the mode in use. |
| `keychain` | The profile's secrets can be read from the keychain. |
| `network` | The platform URL is reachable, with the latency and TLS version. |
| `clock` | The local clock is within 1 minute of the server's. A larger difference is a warning, because OAuth tokens and signatures may fail. |
| `oauth` | In human mode, the authorization server metadata is valid. |
| `credential` | The credential is accepted, with its ID, name, environment, and status. |
| `human mode` | In human mode, the administrator behind the calls. |
| `api release` | The server's API release compared with the release the CLI was built for. A newer server is a warning: update the CLI, and use `cademi api` for new operations in the meantime. An older server is also a warning, because some commands may not exist on it yet. A different major version is a failure. |
| `deprecations` | Shown as a warning only when the API announces deprecated operations, with how many there are. See them with `cademi capabilities get --jq .deprecations`. |

A failed check that prevents the next ones, such as a missing profile or an unreachable platform, ends the run. The command exits with code `1` when any check fails. With `--json`, it prints an array of objects with `name`, `status` (`ok`, `warn`, or `fail`), and `detail`.

On a machine without credentials:

```text
✓ config         /Users/you/Library/Application Support/cademi/config.toml (0 profiles)
✗ profile        no profile configured: run `cademi auth login` or set CADEMI_API_KEY
Error: some checks failed
```

## Debugging requests

`--debug` logs every HTTP request to standard error: method, URL, status code, duration, and `request_id`. Credentials and tokens are never logged. Include the `request_id` when you contact Cademí support about a call.

```sh
cademi --debug products list
```