Credentials and configuration

Credentials

Default path: ~/.phrony/credentials (TOML). Override with PHRONY_CREDENTIALS_FILE (absolute path).

Omit --profile to use defaultProfile from phrony.config.json, or the default key inside the credentials file, or the profile name default.
phrony login writes OAuth fields under the profile table (for example access_token, refresh_token, tenant_id, …). phrony profile logout or phrony logout clears those OAuth fields for --profile (see Profile and logout). phrony profile ls lists profiles and shows whether a usable OAuth session or a stored access token is present (no secrets printed).
An optional api_key field in a profile is ignored for plan, apply, diff, and agent (use the TypeScript SDK for /v1 with API keys).
Workspace access tokens are not stored in this file by default: set PHRONY_ACCESS_TOKEN in your environment (for example CI secrets).

Treat this file like a secret; keep it out of version control (.phrony/ is suggested in phrony init).

phrony.config.json in the project root (optional but helpful):

Field	Purpose
`tenantId`	Default workspace tenant id.
`apiBase`	Gateway origin (no trailing slash required; the CLI normalizes it).
`rootAgentId`	Default root agent for `phrony diff`.
`defaultProfile`	Credentials profile when `--profile` is omitted.

The CLI only reads phrony.config.json. A generated phrony.config.ts is for your editor; duplicate values into JSON if you use both.