> ## Documentation Index
> Fetch the complete documentation index at: https://s2.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Configure the S2 CLI with access tokens, endpoint overrides, and encryption keys from config values or environment variables.

## Access Token

The CLI needs an access token to authenticate with S2. Generate one from the [dashboard](https://s2.dev/dashboard), then persist it:

```bash theme={null}
s2 config set access_token YOUR_ACCESS_TOKEN
```

## Managing Config

```bash theme={null}
# List all config values
s2 config list

# Get a specific value
s2 config get access_token

# Unset a value
s2 config unset access_token
```

## Default Location

When `create-basin` is called without `--location`, the basin uses the account's default [location](/concepts/basins#location).

```bash theme={null}
s2 list-locations
s2 get-default-location
s2 set-default-location aws:us-east-1
```

## Environment Variables

The CLI also reads endpoint overrides and command-specific settings from environment variables, which is useful when pointing at [s2-lite](/s2-lite) or working with encrypted streams:

| Variable              | Description                                                                                         |
| --------------------- | --------------------------------------------------------------------------------------------------- |
| `S2_ACCESS_TOKEN`     | Access token (alternative to `s2 config set`)                                                       |
| `S2_ACCOUNT_ENDPOINT` | Account-level API endpoint                                                                          |
| `S2_BASIN_ENDPOINT`   | Basin-level API endpoint                                                                            |
| `S2_ENCRYPTION_KEY`   | [Encryption key](/concepts/encryption) used by `append`, `read`, and `tail` commands, if configured |

```bash theme={null}
# Example: pointing at a local s2-lite instance
export S2_ACCOUNT_ENDPOINT="http://localhost:8080"
export S2_BASIN_ENDPOINT="http://localhost:8080"
export S2_ACCESS_TOKEN="ignored"
```