# Use in CI

The browser login flow can't run in CI. Provide the app's credentials through the environment instead: when `STREAM_API_KEY` and `STREAM_API_SECRET` are both set, the app-scoped commands (`api`, `token`, `env`, `import`) run with no login and no linked project.

## Store the credentials as secrets

You need the app's key and secret in CI. Get them from either place:

- If you already linked the app locally, read them out of `.stream/creds.yaml`:

  ```bash
  cat .stream/creds.yaml
  ```

  ```yaml
  key: <api key>
  secret: <api secret>
  ...
  ```

- Otherwise, open the app in the [Stream Dashboard](https://getstream.io/signin/) and copy its key and secret.

Add `STREAM_API_KEY` and `STREAM_API_SECRET` to your CI provider's secret store.

Don't run `getstream init` in the pipeline - it opens an interactive picker so cannot be completed in a headless terminal. Linking a project is a one-time local step; CI only needs the key and secret.

## Export the credentials in the pipeline

```yaml
# GitHub Actions
env:
  STREAM_API_KEY: ${{ secrets.STREAM_API_KEY }}
  STREAM_API_SECRET: ${{ secrets.STREAM_API_SECRET }}

steps:
  - name: Install the Stream CLI
    run: curl -fsSL https://getstream.io/cli.sh | bash

  - name: Verify the credentials
    run: getstream api GetApp > /dev/null
```

With both variables set, `getstream api` and `getstream token` run with no login. The pair takes precedence over any `.stream/creds.yaml` the checkout happens to contain, and a `--app-id` flag beats both - see [how credentials are resolved](https://getstream.io/cli/docs/concepts/projects-and-credentials/).

If a step has neither the variables nor a reachable `.stream/creds.yaml`, it fails with `no app credentials` and the error names the three fixes: run `getstream init`, pass `--app-id`, or set `STREAM_API_KEY` and `STREAM_API_SECRET`.

## Verify the setup

The `getstream api GetApp` step above makes a real authenticated call, so a clean exit confirms the credentials work: `0` on success, `1` on failure with the reason on stderr, which fails the CI step. The redirect discards the response so the exit code alone gates the step. Don't verify with `getstream token`: it signs tokens locally without calling the API, so it succeeds even when the key and secret are wrong.

## Related

- [Projects and credentials](https://getstream.io/cli/docs/concepts/projects-and-credentials/): how `.stream/creds.yaml` is resolved
- [Authenticate interactively](https://getstream.io/cli/docs/authentication/): for local development

---

For the most recent version of this documentation, visit [https://getstream.io/cli/docs/ci/](https://getstream.io/cli/docs/ci/).