> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment variables

> Configure Flint AI CLI behavior with environment variables

**Make `flintai-cli` work for you.** Set these environment variables to customize scans and evals. Defaults work out of the box.

## Using environment variables in config.json

Reference environment variables in your config file using `${VAR_NAME}` syntax:

```json theme={null}
{
  "models": [
    {
      "id": "my-chatbot",
      "type": "anthropic",
      "name": "Claude Haiku 4.5",
      "model_name": "claude-haiku-4-5",
      "key": "${ANTHROPIC_API_KEY}",
      "temperature": 0
    }
  ]
}
```

You can use this syntax anywhere in your config.json:

* API keys: `"key": "${ANTHROPIC_API_KEY}"`
* Endpoints: `"host": "${STAGING_URL}"`
* Any string value: `"name": "${AGENT_NAME}"`

<Warning>
  **Security:** Use `${...}` references for API keys rather than pasting them as plaintext. This keeps credentials out of config files.
</Warning>

***

## API Keys

Flint AI CLI uses an LLM to analyze your agent code and filter false positives. Choose one provider:

<Tabs>
  <Tab title="Google Gemini (recommended)">
    **GEMINI\_API\_KEY**

    Free tier available. Get your key: [aistudio.google.com/apikey](https://aistudio.google.com/apikey)
  </Tab>

  <Tab title="OpenAI">
    **OPENAI\_API\_KEY**

    For GPT models. Get your key: [platform.openai.com/api-keys](https://platform.openai.com/api-keys)
  </Tab>

  <Tab title="Anthropic">
    **ANTHROPIC\_API\_KEY**

    For Claude models. Get your key: [console.anthropic.com/settings/keys](https://console.anthropic.com/settings/keys)
  </Tab>

  <Tab title="LiteLLM">
    **Provider-specific API key**

    LiteLLM supports 100+ providers via proxy. Set the API key for your chosen backend (e.g., OPENAI\_API\_KEY, GEMINI\_API\_KEY, etc.). See [docs.litellm.ai](https://docs.litellm.ai/docs/)
  </Tab>
</Tabs>

### How to set your API key

<Tabs>
  <Tab title="flintai init (recommended)">
    Run the interactive setup wizard:

    ```bash theme={null}
    flintai init
    ```

    This creates `~/.flintai/.env` (provider, API key, runtime settings) and a `~/.flintai/config.json` skeleton.
  </Tab>

  <Tab title="Manual setup">
    Create `~/.flintai/.env` with one of these:

    ```bash theme={null}
    GEMINI_API_KEY=your-key-here
    OPENAI_API_KEY=your-key-here
    ANTHROPIC_API_KEY=your-key-here
    ```

    <Tip>
      For LiteLLM, set the API key for your backend provider. See [docs.litellm.ai](https://docs.litellm.ai/docs/)
    </Tip>
  </Tab>
</Tabs>

<Warning>
  **Production and CI/CD environments**

  The `.env` file stores API keys as plaintext on disk. For production or shared infrastructure, use an external secret manager:

  <Tabs>
    <Tab title="1Password CLI">
      ```bash theme={null}
      op run --env-file=.env -- flintai scan ...
      ```
    </Tab>

    <Tab title="AWS Secrets Manager">
      ```bash theme={null}
      export GEMINI_API_KEY=$(aws secretsmanager get-secret-value --secret-id flintai-api-key --query SecretString --output text)
      ```
    </Tab>

    <Tab title="Google Secret Manager">
      ```bash theme={null}
      export GEMINI_API_KEY=$(gcloud secrets versions access latest --secret="flintai-api-key")
      ```
    </Tab>

    <Tab title="Azure Key Vault">
      ```bash theme={null}
      export GEMINI_API_KEY=$(az keyvault secret show --name flintai-api-key --vault-name your-vault --query value -o tsv)
      ```
    </Tab>
  </Tabs>

  Never commit `.env` files to version control.
</Warning>

## GENERATOR\_MODEL

<ParamField path="GENERATOR_MODEL" type="string" default="gemini:gemini-3.1-flash-lite">
  Controls which LLM reads your agent code and filters false positives during scan.

  **Format:** `<provider>:<model-name>`

  **Supported providers:** `gemini`, `openai`, `anthropic`, `litellm`

  **Why this matters:**

  * Faster models = faster scans (Gemini Flash is fastest)
  * More capable models = better false positive filtering (GPT-4, Claude Opus)
  * Cost varies by provider and model

  **Where it's used:**

  * Scan: AI reasoning to analyze agent code and filter false positives
  * Eval: LLM-as-judge scoring, security probe generation

  **Examples:**

  ```bash theme={null}
  # Use Claude Sonnet for better reasoning
  export GENERATOR_MODEL=anthropic:claude-sonnet-4.5

  # Use OpenAI GPT-4
  export GENERATOR_MODEL=openai:gpt-4
  ```
</ParamField>

## Scan Limits

Control how much agent code Flint AI CLI scans. Raise these if scanning large codebases.

<ParamField path="ADK_MAX_ITERATIONS" type="number" default="300">
  Maximum analysis iterations per agent file.

  **When to change:** Large agents with complex logic need more iterations to analyze thoroughly.

  **Example:**

  ```bash theme={null}
  export ADK_MAX_ITERATIONS=100
  flintai scan /path/to/agent
  ```
</ParamField>

<ParamField path="ADK_MAX_FILES_FETCHED" type="number" default="50">
  Maximum number of files to analyze.

  **When to change:** Scanning a very large codebase (100+ Python files).

  **Example:**

  ```bash theme={null}
  export ADK_MAX_FILES_FETCHED=200
  flintai scan /path/to/large-project
  ```
</ParamField>

<ParamField path="ADK_MAX_FETCH_TOKENS" type="number" default="200000">
  Maximum tokens allowed for file content during scan. Scan stops when limit is reached.

  **When to change:** Scan stops early with "token budget exhausted" on large codebases.

  **Example:**

  ```bash theme={null}
  export ADK_MAX_FETCH_TOKENS=500000
  flintai scan /path/to/agent
  ```
</ParamField>

<ParamField path="ADK_LOOP_TIMEOUT_SECS" type="number" default="600">
  Maximum seconds for analysis before timeout (default is 10 minutes).

  **When to change:** Scanning times out on large codebases or slow models.

  **Example:**

  ```bash theme={null}
  export ADK_LOOP_TIMEOUT_SECS=600  # 10 minutes
  flintai scan /path/to/agent
  ```
</ParamField>

## Eval Limits

<ParamField path="EXECUTOR_MAX_WORKERS" type="number" default="20">
  Thread pool size for concurrent evaluation tasks when using the `thread` executor.

  **When to change:** Tune up to increase eval throughput on capable machines, or down to limit resource use.

  **Example:**

  ```bash theme={null}
  export EXECUTOR_MAX_WORKERS=40
  flintai eval run --model my-agent
  ```
</ParamField>

## Logging

<ParamField path="LOG_LEVEL" type="string" default="INFO">
  Control verbosity of `flintai-cli` logs.

  **Options:**

  * `DEBUG` — Verbose logging (useful for troubleshooting)
  * `INFO` — Standard logging (default)
  * `WARNING` — Only warnings and errors
  * `ERROR` — Only errors

  **Example:**

  ```bash theme={null}
  export LOG_LEVEL=DEBUG
  flintai scan /path/to/agent 2> debug.log
  ```
</ParamField>

***

**Need help?** See [Troubleshooting](/flintai/cli/troubleshooting/common-issues#installation) for common configuration issues.