Skip to main content
Reference for the bt CLI. For installation and workflow examples, see the CLI quickstart.

Commands

Authentication and profiles

A profile is a saved login containing credentials and connection details for one Braintrust app URL. One profile can be used with every organization its credentials can access. Most people need only one profile. Add another when you sign in with different credentials or connect to a different Braintrust app URL. Run bt login to save a profile, bt profiles to list, rename, or delete profiles, and bt status --all to verify saved credentials. Organization and project selection is separate from the profile. bt switch saves both as your active context, bt status shows what’s active, and you can override either one per command with --org and --project. bt stores profile metadata locally and credentials in your system’s secure credential store when available. If secure storage is unavailable, it uses a local credentials file. If you’re moving from a version with bt auth commands, see Migrate bt.

Credential precedence

When more than one credential source is present, bt makes two decisions in turn. First, whether to use an API key or a saved profile:
  1. Passing --profile or --prefer-profile on the command line makes bt use a saved profile and ignore BRAINTRUST_API_KEY.
  2. Otherwise, BRAINTRUST_API_KEY from the environment wins.
  3. Otherwise, bt uses a saved profile, selected by the rules below.
The hidden --api-key <KEY> flag is deprecated and will be removed. While it is still available, it takes precedence over other credential sources.
Then, when using a saved profile, which one:
  1. The --profile NAME flag.
  2. The BRAINTRUST_PROFILE environment variable.
  3. The profile saved by bt switch, if it matches the requested app URL.
  4. The only compatible profile for the app URL and organization, if exactly one is saved.
  5. An interactive picker, if several profiles are compatible and bt is running in an interactive terminal. In CI or other non-interactive environments, set BRAINTRUST_PROFILE or pass --profile to avoid an ambiguous-profile error.
Run bt status to see the active organization, project, and selected profile. Run bt status --all to verify saved profiles and report missing, expired, or invalid credentials.
Having a saved login is not the same as selecting one. Only the --profile or --prefer-profile flag suppresses BRAINTRUST_API_KEY. Setting BRAINTRUST_PROFILE does not, so an API key in the environment still wins over it.

Global flags

Most bt commands accept these global flags. Commands that only manage login state, such as bt login, accept the credential-related flags but not organization or project selection flags.

Environment variables

These variables configure common CLI behavior and selected commands. Run bt <command> --help for that command’s complete flag and environment-variable mappings.
bt does not automatically load .env files. Set environment variables explicitly in your shell, through --env-file <PATH>, or with a tool like direnv before running bt commands.

Troubleshooting

Open a new shell. Ensure ~/.local/bin (or $XDG_BIN_HOME if set) is in your PATH.
On SSH, bt auto-detects and prints the auth URL instead of opening a browser. Use --no-browser to force this behavior. The OAuth callback times out after 5 minutes. On remote hosts, paste the final callback URL from your local browser if the localhost callback can’t be delivered.
Run bt profiles list to list saved profiles, or bt status --all to verify their credentials. Specify one with --profile or BRAINTRUST_PROFILE. If you recently migrated from a version with bt auth commands, see the CLI migration guide.
Run bt status --verbose to see the active organization and project and where that context was set.
Run bt status --verbose to inspect the saved profile and context. If BRAINTRUST_API_KEY is set in your shell, it takes precedence over a saved login. Unset it or pass --prefer-profile to use your profile instead. See Credential precedence for the full order.
Run bt login --refresh to force-refresh your OAuth token, or bt login to re-authenticate. If these commands are unfamiliar, they replaced bt auth refresh and bt auth login in v0.16.0; see the CLI migration guide.
bt stores credentials in your system’s secure credential store:
  • macOS: system keychain (via security)
  • Linux: libsecret / secret-tool if available; otherwise a 0600-permission plaintext file
  • Windows: local credentials file (keychain integration not yet implemented)
bt update works for installs made with the standalone shell or PowerShell installer. If you installed with mise or npm, update through that package manager.
macOS and Linux:
Windows (PowerShell):