Authentication precedence, environment variables, defaults, and secret-handling boundaries.
On this page
The stable CLI has a small but meaningful environment contract for scan authentication, integrations, and local operations. Keep secret values in your shell or CI secret store; never commit them to .fendix.yaml or place them in target URLs.
Authentication precedence
An explicit --auth value wins. FENDIX_AUTH is the next fallback. A profile selected by --profile or auth.profile is used only when neither supplies a credential. --auth-type and --auth-header describe an explicit CLI credential; their environment equivalents describe FENDIX_AUTH.
--auth→FENDIX_AUTH→profile
Scan authentication
Variable
Required / default
Purpose
FENDIX_AUTH
No
Credential fallback after explicit --auth; takes precedence over a named profile.
FENDIX_AUTH_TYPE
No
Authentication type used with FENDIX_AUTH.
FENDIX_AUTH_HEADER
No
Header or query-parameter name used with FENDIX_AUTH.
Engine resolution
Variable
Required / default
Purpose
FENDIX_ENGINE
No
Path to the Python engine when it is not bundled.
Jira integration
Variable
Required / default
Purpose
FENDIX_JIRA_URL
Yes
Jira base URL.
FENDIX_JIRA_PROJECT_KEY
Yes
Destination project key.
FENDIX_JIRA_EMAIL
Yes
Account email used for Jira authentication.
FENDIX_JIRA_API_TOKEN
Yes
Jira API token; keep it in the CI secret store.
FENDIX_JIRA_MIN_SEVERITY
No (HIGH)
Minimum severity synchronized to Jira.
FENDIX_JIRA_ISSUE_TYPE
No (Bug)
Jira issue type created by the command.
Notifications
Variable
Required / default
Purpose
FENDIX_SLACK_WEBHOOK_URL
One webhook
Slack incoming-webhook URL.
FENDIX_TEAMS_WEBHOOK_URL
One webhook
Microsoft Teams webhook URL.
FENDIX_NOTIFY_MIN_SEVERITY
No (CRITICAL)
Minimum severity sent to notification channels.
FENDIX_NOTIFY_DEDUP_WINDOW
No (1h)
Duplicate-notification suppression window.
Metrics and benchmarks
Variable
Required / default
Purpose
FENDIX_METRICS
No
Enables local command metrics when set to a supported truthy value.
