Configuration
Nothing has to be configured. This page is for when something does.
Environment variables
| Variable | What it does |
|---|---|
STATABLE_API_KEY | The key to use. Beats the keyring, loses to --key |
STATABLE_API_URL | The API address. For a self-hosted or staging deployment |
STATABLE_CONFIG_DIR | Where settings and the fallback key file live. Set it when there is no home directory |
STATABLE_FORMAT | The default output format: human, json or csv. A value it does not understand is reported, not silently ignored |
STATABLE_NO_INPUT | Never prompt. Same as --no-input |
STATABLE_AGENT | Declare that an agent is running this, for harnesses the binary does not recognise on its own |
NO_COLOR, CLICOLOR | Turn colour off. Any non-empty NO_COLOR wins over everything |
FORCE_COLOR, CLICOLOR_FORCE | Keep colour on through a pipe |
CI systems are detected without being told: CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL and others switch the binary out of anything that would block on a human.
A project file
A repository can pin its own site and period in .statable.yml, or .statable.yaml. The search starts in the working directory and walks upward until it finds one or reaches the root, so the file at the top of a monorepo covers every package under it.
Only those two keys are honoured, and that is a security control rather than a shortcut. A file that lives in a repository is written by whoever can open a pull request. If it could set the API address, a checkout would send your credentials wherever that person chose; if it could set a key, it would silently swap whose data you are reading. Any other key present is refused out loud, so a setting that is not taking effect says so instead of looking applied.
The key and the API address come from the environment only.
Where the key is stored
statable auth login puts the key in the system keyring: Keychain on macOS, Secret Service on Linux, Credential Manager on Windows. statable auth status names the source of the key in use, so there is never a question of which one won.
Without a keyring the command refuses and names --insecure-storage, which writes a 0600 file under the config directory instead. It never falls back silently.
On Windows that file is not protected. Windows maps a file mode onto the read-only attribute and nothing else, so a file written 0600 is readable by every account on the machine. The command says so as it writes one.
The escape hatch
Any endpoint, including the ones no command wraps and the ones that write:
statable api call GET /sites
statable api call POST /query --var metrics='["visitors"]' --var date_range='"7d"'
statable api search funnel # search the OpenAPI spec
statable api describe /query # what one endpoint takes
The response passes through untouched: no reformatting, no re-encoding.
--var values are parsed as JSON, so --var limit=25 sends a number. --raw-var always sends a string, which is how to send the literal text 25.
api search and api describe read the API's own OpenAPI document, so the tool can teach its own surface without a second window open on the endpoint reference.
Ready to take control of your web analytics? Try Statable free for 30 days. No credit card required, full feature access, built for GDPR. Start your free trial or view a live demo.