Environment Variables

The rensei CLI and daemon read a set of environment variables for configuration, authentication, and credential plumbing. This page is the authoritative reference for all variables, including the blocklist of variables that are explicitly excluded from the agent sandbox environment.

CLI configuration

These variables configure the CLI's connection to the platform and control its runtime behavior.

Variable	Description	Priority vs flag
`RENSEI_API_URL`	Platform base URL. Overrides the `url` field in `config.json`.	Lower priority than `--url`
`RENSEI_AUTH_TOKEN`	Bearer token for authentication. Used when no named auth context is active, or as an env-backend context.	Lower priority than `--token-stdin`
`RENSEI_API_TOKEN`	Legacy alias for `RENSEI_AUTH_TOKEN`. Accepted for backwards compatibility.	Same as `RENSEI_AUTH_TOKEN`

Auth and setup

These variables control the interactive setup wizard and Linear connection flow.

Variable	Description
`RENSEI_SECRET_PASSPHRASE`	Passphrase for the `encrypted_file` secret backend on headless Linux. Set this in your CI environment to unlock stored org/project tokens without prompting.
`RENSEI_LINEAR_TEAM_ID`	Linear team ID pre-populated into the OAuth wizard flow.
`RENSEI_LINEAR_CONNECT`	Set to `yes`, `true`, or `1` to automatically run the Linear OAuth flow during `rensei setup`.

Daemon and credential socket

These variables are used by the daemon process and injected selectively into agent child processes. They are not set by the user; they are managed by the daemon itself.

Variable	Set by	Description
`RENSEI_CREDENTIAL_SOCKET`	Daemon `BaseEnv`	Absolute path to the Unix credential socket. Present in every agent child process.
`RENSEI_CREDENTIAL_SESSION_ID`	`OnPreSpawn` hook (per-session)	Session-scoped credential identifier. Never in `BaseEnv` - injected per-session only, immediately before agent launch.
`RENSEI_CREDENTIAL_SNAPSHOT_FAILED`	`OnPreSpawn` failure path	Set to `1` when the per-session credential snapshot fails. Signals the agent to fall back to the socket-based credential retrieval path.

Provider passthrough

This variable affects how agents resolve Linear credentials.

Variable	Description
`LINEAR_API_KEY`	When set in the daemon worker's shell environment, it takes precedence over the platform proxy credential path. Normally you should leave this unset and let the platform OAuth proxy supply the token - see Agents use the rensei linear proxy.

XDG standard

Variable	Description
`XDG_RUNTIME_DIR`	On Linux, the credential socket is placed at `$XDG_RUNTIME_DIR/rensei/credentials.sock`. Falls back to `/tmp/rensei-credentials-<uid>.sock` if not set.

Blocklist

The following variables are explicitly blocked from appearing in the agent child process environment. They are stripped before any agent subprocess is launched and never made available via the credential socket or RENSEI_CREDENTIAL_SESSION_ID path. This prevents daemon internals from leaking into agent sandboxes.

If you set any of these variables in your shell and launch the daemon from that shell, the daemon itself will see them but will not propagate them to agent children. Do not rely on these variables being available inside an agent session.

Variable	Why it is blocked
`RENSEI_DAEMON_JWT`	Internal daemon registration token - must never be accessible to untrusted agent code
`RENSEI_DAEMON_API_KEY`	Internal daemon API key
`RENSEI_RUNTIME_JWT`	Short-lived runtime JWT used by the platform worker protocol

Smoke test variables

These variables are used by the rensei-smokes test suite and automation scripts. They are documented here for completeness but are not required for normal platform usage.

Variable	Description
`RENSEI_TOKEN`	Convenience alias used in smoke scripts (same token shape as `RENSEI_AUTH_TOKEN`).
`RENSEI_ORG_SLUG`	Target org for smoke tests: `rensei-smokes`.

CI/CD quick reference

For a GitHub Actions workflow running CLI commands:

env:
  RENSEI_AUTH_TOKEN: ${{ secrets.RENSEI_API_TOKEN }}
  RENSEI_API_URL: https://app.rensei.ai   # optional; defaults to this value

steps:
  - run: rensei --no-interactive --json fleet list

For headless Linux with an encrypted token file:

env:
  RENSEI_AUTH_TOKEN: ${{ secrets.RENSEI_API_TOKEN }}
  RENSEI_SECRET_PASSPHRASE: ${{ secrets.RENSEI_PASSPHRASE }}

steps:
  - name: Setup rensei auth
    run: |
      printf '%s' "$RENSEI_AUTH_TOKEN" | rensei auth add \
        --name ci \
        --kind org_token \
        --secret-store encrypted-file \
        --token-stdin
  - run: rensei fleet list

Auth - secret backends and context management
Global flags - per-invocation flag equivalents for RENSEI_API_URL, RENSEI_AUTH_TOKEN
Host daemon - daemon config at ~/.rensei/daemon.yaml
Credential socket - Unix socket protocol for credential delivery to agents

On this page