# Install and configure the CLI

> Configure a Platform API origin, namespace, tenant restriction, secure API-key source, and stable automation output.

## Before you begin {#before-you-begin}

Obtain a versioned `@constal/cli` release and a Constal API key with only the actions required for your work. Know the namespace you intend to operate. Do not place a key in a command argument, repository, shell history, package manifest, or CI log.

## Steps {#steps}

1. Link the CLI from a source checkout or install the versioned artifact supplied with your deployment.
2. Store a key with a hidden prompt, or pipe it through stdin:

   ```sh
   printf '%s' "$CONSTAL_API_KEY" | constal auth login --token-stdin
   ```

3. Select the default namespace and, when administrative policy requires it, a tenant restriction:

   ```sh
   constal context use --namespace production --tenant acme
   ```

4. Run `constal auth status`. The command checks access by reading the selected namespace catalog rather than merely reporting that a token exists.
5. Use `constal context show` to inspect the effective origin, namespace, tenant restriction, and credential source. It never prints the API key.
6. Override stored values with `CONSTAL_PLATFORM_URL`, `CONSTAL_NAMESPACE`, `CONSTAL_TENANT`, or per-command flags. `CONSTAL_API_KEY` takes precedence over the credentials file.

Configuration is stored separately from credentials. Files are written atomically with owner-only permissions under the platform configuration directory; set `CONSTAL_CONFIG_DIR` when an isolated automation environment needs a different location.

## Verify {#verify}

Run `constal agents list --output json`. Confirm the request reaches the intended namespace and returns only authorized Agents. Then run `constal auth logout` in a disposable environment and verify authenticated commands fail without echoing the removed key.

## Next steps {#next-steps}

Read [CLI workflows and automation](/docs/cli/workflows.md), then choose the CLI guide in [Agents](/docs/agents/cli.md), [Runs](/docs/runs/cli.md), [Resources](/docs/resources/cli.md), [Credentials](/docs/credentials/cli), or another product section.