Installation & Profiles

Install the Directus CLI, define a profile for each instance you sync with, and store credentials safely outside your repository.

Environment Sync connects to your instances through profiles: named entries like staging or production that pair an instance URL with a credential. The URLs are project configuration you commit; the credentials never are.

Install the CLI

npm install -g @directus/cli

Verify the install:

d6s --version

The project file

Profiles live in directus.config.json in your project root, next to the directories a pull writes. Adding a profile records its name and URL there. The credential is stored separately.

Safe to commitdirectus.config.json never contains tokens, so committing it cannot leak credentials. Commit it so everyone on the project resolves the same profile names.

Because the URL is the part of a profile that gets committed, one rule is enforced:

Credential-bearing URLs are refused A URL like https://admin:secret@staging.example.com embeds a credential in a value that lands in directus.config.json. The CLI refuses it. Tokens belong in the credential store or the environment, never in a committed file.

Where credentials live

When a command needs to authenticate against a profile, the credential resolves in order:

  1. A --token flag, on the commands that accept one (profile add and profile test).
  2. A DIRECTUS_<PROFILE>_TOKEN environment variable. For a profile named staging, that's DIRECTUS_STAGING_TOKEN.
  3. The saved credential store at ~/.directus/credentials.json, written with owner-only file permissions (mode 0600).

In CI (any environment where the CI variable is set) the credential store is never consulted. The sync commands take no --token flag, so in CI their tokens come from the environment variables.

Adding a profile

d6s profile add

The prompts walk you through it: name the profile, give it a URL, and authenticate by pasting a static token or logging in with your email and password to save a session. Saved sessions are refreshed automatically before requests when they are close to expiring.

You can also pass everything directly:

d6s profile add staging --url https://staging.example.com --token <your-token>

Testing a profile

d6s profile test staging

This connects to the instance and prints who you are on it, confirming the URL is reachable and the credential works. Like the sync commands, it refreshes an expiring saved session.

Next step

With a profile added and tested, snapshot your first instance: Pulling.

Get once-a-month release notes & real‑world code tips...no fluff. 🐰