> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/commands/profile.md).

# profile

Manage named CLI profiles — each profile bundles an API token, base URL, and per-profile defaults so one binary can target multiple accounts or regions.

**Note**: `profile` commands are LOCAL and modify `~/.celigo/config`. The one exception is [`whoami`](#celigo-profile-whoami), which makes a read-only API call to resolve the active token's identity.

Supports all [global flags](/cli/getting-started/global-flags.md).

## Subcommands

| Command                            | Purpose                                                                                                                           |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| [`list`](#celigo-profile-list)     | List every profile with active marker, mode, base URL, and redacted token.                                                        |
| [`show`](#celigo-profile-show)     | Print one profile's config (tokens redacted). Defaults to the selected profile (`--profile`, else `CELIGO_PROFILE`, else active). |
| [`whoami`](#celigo-profile-whoami) | Resolve the selected profile's token to the user it authenticates as (live API call).                                             |
| [`use`](#celigo-profile-use)       | Switch the active profile — machine-wide.                                                                                         |
| [`add`](#celigo-profile-add)       | Create a new profile.                                                                                                             |
| [`delete`](#celigo-profile-delete) | Delete a profile.                                                                                                                 |
| [`rename`](#celigo-profile-rename) | Rename a profile without re-entering credentials.                                                                                 |

## celigo profile list

List every profile stored in `~/.celigo/config.json`. The active profile is marked; non-default modes are flagged; tokens are redacted.

```bash
celigo profile list
```

Output respects `--format` / `--jq`; when JSON is requested each entry exposes `name`, `active`, `mode`, `base_url`, and a redacted `api_token`.

## celigo profile show

Print a single profile's configuration with the token redacted. When `[name]` is omitted it defaults to the *selected* profile: `--profile`, else `CELIGO_PROFILE`, else the active profile (since celigo-cli 2026.9.1; earlier releases always showed the active profile).

| Argument | Type   | Required | Description                                                                                             |
| -------- | ------ | -------- | ------------------------------------------------------------------------------------------------------- |
| `[name]` | string | No       | Profile to inspect. Defaults to the selected profile (`--profile`, else `CELIGO_PROFILE`, else active). |

```bash
celigo profile show
celigo profile show prod
CELIGO_PROFILE=eu celigo profile show     # the profile this session is bound to
```

## celigo profile whoami

Resolve the selected profile's API token (`--profile`, else `CELIGO_PROFILE`, else the active profile) to the user it authenticates as. Unlike the other `profile` commands, this makes a live, read-only API call — and unlike them it checks that the selected profile exists. Use it to confirm which account and user a token belongs to: right after `profile use`, or before the first write of a session or agent run.

```bash
celigo profile whoami
celigo profile whoami --profile prod
```

Returns the `_userId` the token resolves to. Respects `--format` / `--jq`.

**Corresponds to**: [`GET /v1/tokenInfo`](https://developer.celigo.com/api/api-reference/account-and-admin/account#get-v1-tokeninfo) (operationId: `getTokenInfo`).

## celigo profile use

Switch the active profile. The name must already exist — use [`add`](#celigo-profile-add) first.

The switch is **machine-wide**: the active profile is one value in `~/.celigo/config.json`, read fresh by every invocation, so every terminal and agent session on this machine that does not pin a profile follows the switch. Since celigo-cli 2026.9.1 the command says so on stderr and prints the `export CELIGO_PROFILE=<name>` line that binds one session instead. To keep a shell, an agent session, or a CI job on one account, set `CELIGO_PROFILE` there rather than switching the active profile.

| Argument | Type   | Required | Description          |
| -------- | ------ | -------- | -------------------- |
| `<name>` | string | Yes      | Profile to activate. |

```bash
celigo profile use eu                # every un-pinned session on this machine now targets eu
export CELIGO_PROFILE=eu             # this session only
```

## celigo profile add

Create a new profile. If `--api-token` is omitted and stdin is a TTY, the CLI prompts for the token with echo disabled. If the new profile is the only one in the file it is automatically marked active.

| Argument | Type   | Required | Description   |
| -------- | ------ | -------- | ------------- |
| `<name>` | string | Yes      | Profile name. |

| Flag                        | Type                          | Default                     | Description                                                                                                                                                                                                                                                                                                      |
| --------------------------- | ----------------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--api-token <token>`       | string                        | —                           | API token for the profile. If omitted, prompted on TTY; falls back to the root `--token` flag when provided.                                                                                                                                                                                                     |
| `--api-base-url <url>`      | string                        | `https://api.integrator.io` | API base URL. Use your region's API host. See [Profiles & regions](/cli/getting-started/profiles.md#regions).                                                                                                                                                                                                    |
| `--default-format <format>` | `json` \| `table`             | —                           | Default output format for this profile.                                                                                                                                                                                                                                                                          |
| `--mode <mode>`             | `read` \| `operate` \| `full` | `full`                      | Permission mode. See [profiles guide](/cli/getting-started/profiles.md#permission-modes).                                                                                                                                                                                                                        |
| `--account-alias <alias>`   | string                        | —                           | This account's MCP alias — the segment in `https://api.…/mcp/<alias>/<server>` (5–15 alphanumeric characters). No API returns it, so the local tree needs it to tell this account's MCP servers from another account's with the same name. Sets the profile's `account_alias` key. Added in celigo-cli 2026.9.1. |

```bash
celigo profile add prod --api-token "$CELIGO_TOKEN"
celigo profile add eu --api-token "$EU_TOKEN" --api-base-url https://api.eu.integrator.io
celigo profile add au --api-token "$AU_TOKEN" --api-base-url https://api.au.integrator.io
celigo profile add ca --api-token "$CA_TOKEN" --api-base-url https://api.ca.integrator.io
celigo profile add ci --api-token "$CI_TOKEN" --default-format json --mode read
celigo profile add acme --api-token "$ACME_TOKEN" --account-alias acmecorp
```

## celigo profile delete

Delete a profile. Cannot delete the active profile — switch first with [`use`](#celigo-profile-use). Prompts for confirmation unless `-y` is passed.

> ⚠️ **Deleting a profile removes its stored token and settings.** This cannot be undone from the CLI; re-adding the profile requires the API token again.

| Argument | Type   | Required | Description        |
| -------- | ------ | -------- | ------------------ |
| `<name>` | string | Yes      | Profile to remove. |

| Flag        | Type    | Default | Description                   |
| ----------- | ------- | ------- | ----------------------------- |
| `-y, --yes` | boolean | `false` | Skip the confirmation prompt. |

```bash
celigo profile delete staging
celigo profile delete staging -y
```

## celigo profile rename

Rename a profile. If the profile being renamed is the active one, the active pointer is updated to the new name.

| Argument    | Type   | Required | Description                       |
| ----------- | ------ | -------- | --------------------------------- |
| `<oldName>` | string | Yes      | Existing profile name.            |
| `<newName>` | string | Yes      | New name. Must not already exist. |

```bash
celigo profile rename prod production
```

## Gotchas

* **Tokens are stored in plaintext.** `~/.celigo/config.json` is created with mode `0600` on Unix; the CLI redacts tokens on output but anyone with file read access to your home directory can read them. Prefer `CELIGO_API_TOKEN` for CI.
* **Region is encoded in `base_url`, not the token.** A token authenticates only against its own region's base URL. Any other base URL returns `401 Unauthorized`. Keep one profile per region. See [Profiles & regions](/cli/getting-started/profiles.md#regions).
* **No `profile edit`.** To change a field on an existing profile use [`celigo config set`](/cli/commands/config.md#celigo-config-set) against that profile (combine with `--profile <name>` to target a non-active profile) or delete and re-add.
* **Mode is enforced at every command.** `read` blocks all mutations; `operate` allows a narrow allow-list of fields (`disabled`, `debugUntil`, `debugDate`, `schedule`, `autoResolveAt`, `logging.debugUntil`); `full` is unrestricted. See [profiles guide](/cli/getting-started/profiles.md#permission-modes).
* **Precedence.** A command resolves its profile as `--profile` > `CELIGO_PROFILE` > the active profile (`profile use`). `--profile` and `CELIGO_PROFILE` bind one invocation or one session; the active profile is machine-wide. `CELIGO_API_TOKEN` and `--token` override the token regardless of the profile in use — but they do not excuse a profile name that does not exist (next bullet).
* **An unknown profile name is an error, not an empty profile.** Since celigo-cli 2026.9.1 a `--profile` or `CELIGO_PROFILE` value that names no profile fails before any request — `Profile 'x' does not exist. Available: a, b (run 'celigo profile list').` — even when `CELIGO_API_TOKEN` or `--token` would supply a token. The NAME is wrong, not the token: pick one from `celigo profile list`, and never answer the error with `config set api_token`, which would create the misspelled profile or overwrite another profile's token. Exempt: `config set … --profile <new>` (which bootstraps a profile), `profile`, `config`, `skills`, and the offline tree verbs `status`, `lint`, and `resolve`; `profile whoami` does check.
* **Every write names its target on stderr.** Since celigo-cli 2026.9.1 every command that writes to the account prints `celigo: profile '<name>' → <host>` before the write (no opt-out); confirmation prompts carry the same label (`[profile 'acme-sandbox' → api.integrator.io] Delete flow 123? [y/N]`). Stdout is untouched, so `--jq` and JSON pipes see only the response. Read that line — or run `profile whoami` — before the first mutating command of a session.
* **First profile auto-activates.** When the config file is empty, `profile add` marks the new profile active. Subsequent adds do not.

## Related

* [`config`](/cli/commands/config.md) — read and write individual keys on a profile without delete/re-add.
* [profiles guide](/cli/getting-started/profiles.md) — conceptual overview, region matrix, CI recipes, and permission modes.
* [global flags](/cli/getting-started/global-flags.md) — `--profile <name>` for per-invocation overrides.