Where Does Snyk CLI Store Auth and Config?
Snyk CLI keeps auth and defaults in a configstore JSON file, with per-project policy in a separate .snyk file.
Last updated
Snyk CLI state lives in a JSON file under the configstore directory. API tokens, endpoint choice, and CLI defaults sit there, managed by the config subcommand. CI overrides arrive through environment variables.
Project policy is a different file entirely. The repo-level .snyk file carries ignores and patches with the code. One travels with machines, the other with repositories.
Where Snyk stores this, by platform
~/.config/configstore/snyk.json
CLI config JSON with auth and defaults. Manage it with snyk config commands. Project .snyk policy files live in repos, not here.
~/.config/configstore/snyk.json
Respects XDG config home. CI should use SNYK_TOKEN env rather than files. Config commands edit this file safely.
Frequently asked questions
How do I move Snyk auth to a new machine?
Run snyk auth again on the new machine. The token lives in the configstore file, which you can also copy over. Prefer SNYK_TOKEN env in CI over copying files.
Does the config file hold ignore rules?
No. The config file holds CLI defaults and auth. Project policy lives in the repo .snyk file managed by policy commands. Keep the two concepts apart when debugging.
Notice an outdated path? Let us know.