Configuration

Authentication

The CLI authenticates with an S2 access token. Generate one from the dashboard, then store it securely:

s2 auth access-token set

Paste the token when prompted. It won’t appear on screen or in your shell history, and the CLI saves it to your system credential manager.

Scripts and CI

For a non-persistent override, set S2_ACCESS_TOKEN. It takes precedence over any saved access token:

S2_ACCESS_TOKEN="$S2_ACCESS_TOKEN" s2 ls

To persist a token supplied by a secret manager or script, pass it through standard input explicitly:

op read 'op://S2/access-token' | s2 auth access-token set --stdin

Headless systems

The CLI does not silently fall back to plaintext when an OS credential store is unavailable. To explicitly use a private local file on a headless system, add --insecure-storage:

printf '%s\n' "$S2_ACCESS_TOKEN" | \
  s2 auth access-token set --stdin --insecure-storage

Migrate an existing token

Access tokens previously saved as access_token in config.toml remain readable but are deprecated. Move one into the OS credential store with:

s2 auth access-token migrate

On a headless system without a credential store, migrate it into the private local file instead:

s2 auth access-token migrate --insecure-storage

Remove a stored token

s2 auth access-token remove

This removes the local credential but does not revoke the access token on S2. Use s2 revoke-access-token when the token must stop working everywhere.

Managing Config

# List all config values
s2 config list

# Get a specific value
s2 config get account_endpoint

# Unset a value
s2 config unset account_endpoint

s2 config list reports a configured access token as <redacted>, and s2 config get access_token does not reveal the credential. Use the s2 auth access-token commands to manage access tokens.

Default Location

When create-basin is called without --location, the basin uses the account’s default location.

s2 list-locations
s2 get-default-location
s2 set-default-location aws:us-east-1

Environment Variables

The CLI also reads endpoint overrides and command-specific settings from environment variables, which is useful when pointing at s2-lite or working with encrypted streams:

Variable	Description
`S2_ACCESS_TOKEN`	Non-persistent access token override; takes precedence over a stored token
`S2_ACCOUNT_ENDPOINT`	Account-level API endpoint
`S2_BASIN_ENDPOINT`	Basin-level API endpoint
`S2_ENCRYPTION_KEY`	Encryption key used by `append`, `read`, and `tail` commands, if configured

# Example: pointing at a local s2-lite instance
export S2_ACCOUNT_ENDPOINT="http://localhost:8080"
export S2_BASIN_ENDPOINT="http://localhost:8080"
export S2_ACCESS_TOKEN="ignored"

Control Plane

Data Plane

Configuration

Authentication

Scripts and CI

Headless systems

Migrate an existing token

Remove a stored token

Managing Config

Default Location

Environment Variables

​Authentication

​Scripts and CI

​Headless systems

​Migrate an existing token

​Remove a stored token

​Managing Config

​Default Location

​Environment Variables

Authentication

Scripts and CI

Headless systems

Migrate an existing token

Remove a stored token

Managing Config

Default Location

Environment Variables