# Hosted authentication Authenticate the CLI with the repository-scoped API token from Radforge onboarding. ## Set the credentials Export the API URL and token, then verify access: ```bash export RADFORGE_REMOTE_URL="https://api.radforge.dev" export RADFORGE_API_TOKEN="..." rad remote doctor ``` If authentication succeeds, `rad remote doctor` reports the repository and hosted capabilities available to the token. `RADFORGE_API_TOKEN` is a bearer token. Anyone who has it can use its access. The CLI reads it only from the environment, and remote commands do not accept it as an argument. The `--endpoint` flag or `RADFORGE_REMOTE_URL` must contain an HTTPS origin without a path, query, or embedded credentials. Use the production URL from onboarding unless Radforge support tells you otherwise. ## Store the token Store the token in an operating-system keychain or your CI provider's protected secret store. For local use, export it into the current shell without saving it in shell history. Never commit it, paste it into an issue, include it in a plan, or pass it on the command line. ## Replace an exposed token Stop using the token and contact Radforge to revoke and replace it. Installing the GitHub App does not authenticate the CLI. The two paths use separate credentials.