Configuration.

Project config: .briar.toml

Flags that repeat on every run (company, store, repo, model, git identity) can live in a .briar.toml file, or under [tool.briar] in pyproject.toml. Briar uses the nearest one, searching from the current directory up to the filesystem root. Create one with briar init; check what each setting resolves to with briar config show.

$ company = "acme"
$ store   = "postgres"        # knowledge store: file | postgres
$ root    = "./knowledge"     # file-store root
$ tracker = "jira"
$ repos   = ["acme/widgets", "acme/api"]   # optional, feeds extract --repo
 
$ [repo]
$ owner    = "acme"
$ repo     = "widgets"
$ provider = "github"
 
$ [agent]
$ model          = "claude-sonnet-4-6"
$ git_user_name  = "acme-bot"
$ git_user_email = "[email protected]"

Precedence, highest first: CLI flag, then env var (BRIAR_COMPANY for company, BRIAR_STORE for store), then the project config, then the git origin remote (for owner / repo only), then the built-in default. A value found this way also makes a normally required flag (like extract --company) optional. For briar extract, --repo takes repos when set, else owner/repo from [repo].

Per-company credential env vars

Most providers ship a single account per developer. Briar multi-tenants on top of that by interpolating a {company} token into the env var name. --company acme reads JIRA_ACME_TOKEN; the same flow with --company widgets reads JIRA_WIDGETS_TOKEN. The company token is uppercased and dashes become underscores. GitHub PATs are the exception — they're workspace-wide, so the var is just GITHUB_TOKEN with no company segment.

Tracker credentials

Cloud credentials

Meeting transcripts

Chat and notifications

LLM providers

Briar runtime env vars

These influence how the CLI runs, where it persists state, and which features are enabled.

Credential stores

Briar reads credentials from one store at a time, picked with --cred-store on auth / secrets commands (the old spelling --store still works there). Four stores ship:

• envfile: text file at ~/.config/briar/secrets.env (see BRIAR_SECRETS_FILE above). Default.
• aws-secretsmanager — AWS Secrets Manager.
• ssm — AWS Systems Manager Parameter Store.
• vault: HashiCorp Vault (KV v2). Reads VAULT_ADDR and VAULT_TOKEN; needs pip install "briar-cli[vault]".

$ briar auth login github-pat --cred-store vault --company acme
$ briar auth list --cred-store aws-secretsmanager --company acme

Bootstrap on startup

Bootstraps run before every command and pre-populate os.environ from a remote source. Onlyenvfile ships today (loads secrets.env).

$ briar secrets bootstrap --kind envfile      # one-off
$ briar secrets bootstrap --dry-run             # print keys only

Where to go next

• briar auth · secrets · telemetry — the commands that consume everything on this page.
• briar extract — the first command you'll run that needs credentials.