--- title: Configure CLI settings description: The pingcli config command provides four subcommands for reading, writing, and removing configuration values stored in the Ping CLI configuration file. You can find a complete list of available configuration keys and their descriptions in the Configuration settings reference. component: pingcli version: 1.0 page_id: pingcli:using_pingcli:configure-settings canonical_url: https://developer.pingidentity.com/pingcli/1.0/using_pingcli/configure-settings.html revdate: June 8, 2026 section_ids: runtime-configuration-options: Runtime configuration options configuration-file-location: Configuration file location list-available-configuration-keys: List available configuration keys set-a-configuration-value: Set a configuration value read-a-configuration-value: Read a configuration value remove-a-configuration-value: Remove a configuration value working-with-sensitive-values: Working with sensitive values learn-more: Learn more --- # Configure CLI settings The `pingcli config` command provides four subcommands for reading, writing, and removing configuration values stored in the Ping CLI configuration file. You can find a complete list of available configuration keys and their descriptions in the [Configuration settings reference](../settings_reference/configuration-settings-reference.html). | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Configuration values are stored per-profile. All commands operate on the active profile unless you specify a profile with the `--profile` / `-P` flag. For information about creating and managing profiles, refer to [Managing Configuration Profiles](managing-configuration-profiles.html). | ## Runtime configuration options Ping CLI supports multiple ways to supply configuration values at runtime: * **Inline parameters**: Pass values directly when invoking a command. Refer to the [Command Reference](../command_reference/pingcli.html) for a full list of available parameters for each command. * **Configuration file**: Persist values in the Ping CLI configuration file, attached to a named configuration profile. Use the commands on this page to read, write, and remove configuration file values. * **Environment variables**: Set values in the shell before running a command. This is most useful in CI/CD environments. Variable names follow the pattern `PINGCLI_*`, for example `PINGCLI_OUTPUT_FORMAT`. When the same key is set in multiple places, inline parameters take precedence over environment variables, which take precedence over the configuration file. ## Configuration file location The Ping CLI configuration file is created at `.pingcli/config.yaml` in the user's home directory. Configuration is stored in a version-controlled format (configuration model version 2). When Ping CLI is run for the first time after upgrading from a previous major version, any existing configuration is automatically migrated to the current model version. ## List available configuration keys Before setting values, use the `pingcli config list-keys` command to see every key that Ping CLI can store: ```console pingcli config list-keys ``` To output the keys in YAML format (useful for scripting or comparing with a configuration file): ```console pingcli config list-keys --yaml ``` For descriptions of each key and its accepted values, see [Configuration settings reference](../settings_reference/configuration-settings-reference.html). ## Set a configuration value Use the `pingcli config set` command to persist a value for a configuration key. Set a value on the active profile: ```console pingcli config set outputFormat=json ``` Set a value on a named profile without changing the active profile: ```console pingcli config set --profile prod outputFormat=text ``` Set a service-specific setting, for example the PingOne endpoint root domain for a non-default region: ```console pingcli config set service.pingOne.endpoint.rootDomain=pingone.eu ``` ## Read a configuration value Use the `pingcli config get` command to retrieve a stored value. Read a single key from the active profile: ```console pingcli config get outputFormat ``` Read all configuration values under a namespace by passing a prefix. For example, to read all PingOne settings: ```console pingcli config get pingone ``` Read a key from a named profile: ```console pingcli config get --profile prod service.pingOne.endpoint.rootDomain ``` ## Remove a configuration value Use the `pingcli config unset` command to remove a stored value. After unsetting, the key reverts to its built-in default. Remove a value from the active profile: ```console pingcli config unset outputFormat ``` Remove a value from a named profile: ```console pingcli config unset --profile prod service.pingOne.endpoint.rootDomain ``` | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The `default` profile cannot be deleted, but any setting within it can be unset. To clear all credentials from the default profile, use `pingcli config unset` for each setting individually. | ## Working with sensitive values Ping CLI masks secret values (such as passwords and client secrets) in command output by default. To reveal the actual value, add the `--unmask-values` / `-U` flag. Read a client secret with its value unmasked: ```console pingcli config get --unmask-values service.pingOne.authentication.clientCredentials.clientSecret ``` Set a password and confirm the stored value in a single step: ```console pingcli config set --unmask-values service.pingFederate.authentication.basicAuth.password=mysecret ``` | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Unmasked output displays credentials in plain text in your terminal and shell history. Avoid using `--unmask-values` in shared sessions or CI/CD environments where output may be logged. | ## Learn more * [Configuration settings reference](../settings_reference/configuration-settings-reference.html) * [Managing Configuration Profiles](managing-configuration-profiles.html) * [pingcli config set](../command_reference/pingcli_config_set.html) * [pingcli config get](../command_reference/pingcli_config_get.html) * [pingcli config unset](../command_reference/pingcli_config_unset.html) * [pingcli config list-keys](../command_reference/pingcli_config_list-keys.html)