Authenticate credentials ↗

Configure credentials before running Cortex CLI. The installer does not save them.

Choose the method that fits your workflow:

• Use a configuration file for persistent local authentication.
• Use environment variables for CI/CD pipelines.
• Use command-line flags for one-off commands or overrides.

Generate API keys in the UI, or use the self-service workflow to create role-restricted CLI and IDE keys through the Public API. The self-service workflow uses a Primary API key. See Self-service API keys for CLI scans.

Do not commit API keys or credential files to source control.

Configuration file

Use a cortex.env file for persistent local authentication. Cortex CLI reads this file automatically from your home or current working directory.

The file uses KEY=VALUE pairs.

macOS and Linux

Create ~/cortex.env and restrict access to it.

cat > ~/cortex.env << EOF
CORTEX_API_BASE_URL=https://api-<TENANT>.xdr.us.paloaltonetworks.com
CORTEX_API_KEY=<YOUR_API_KEY>
CORTEX_API_KEY_ID=<YOUR_KEY_ID>
EOF
chmod 600 ~/cortex.env

Windows

Create cortex.env in your user profile.

$configPath = "$env:USERPROFILE\cortex.env"
@"
CORTEX_API_BASE_URL=https://api-<TENANT>.xdr.us.paloaltonetworks.com
CORTEX_API_KEY=<YOUR_API_KEY>
CORTEX_API_KEY_ID=<YOUR_KEY_ID>
"@ | Out-File -FilePath $configPath -Encoding UTF8

Environment variables

Use environment variables for CI/CD pipelines. Store values in your CI/CD platform's secret store.

Variable name	Description
CORTEX_API_BASE_URL	Your tenant URL (such as https://api-example.xdr.us.paloaltonetworks.com)
CORTEX_API_KEY	The secret key token
CORTEX_API_KEY_ID	The ID associated with the key

macOS and Linux

export CORTEX_API_BASE_URL="https://api-<TENANT>.xdr.us.paloaltonetworks.com"
export CORTEX_API_KEY="<YOUR_API_KEY>"
export CORTEX_API_KEY_ID="<YOUR_KEY_ID>"

Windows

$env:CORTEX_API_BASE_URL="https://api-<TENANT>.xdr.us.paloaltonetworks.com"
$env:CORTEX_API_KEY="<YOUR_API_KEY>"
$env:CORTEX_API_KEY_ID="<YOUR_KEY_ID>"

Command-line flags

Use flags for one-off scans or to override configured credentials. Place global flags before the module name.

cortexcli --api-base-url <URL> --api-key <KEY> --api-key-id <ID> code scan ...