SUME_API_AUTH_MODE: make the Sume CLI send Bearer instead of x-api-key

Set SUME_API_AUTH_MODE=bearer and the Sume CLI sends Authorization: Bearer <key>. Leave it unset, or set it to x-api-key, and the CLI sends the x-api-key header. The docs call x-api-key the current CLI default. The variable accepts exactly those two values, and a request carries one credential header, never both.

You only need this when something between your shell and api.sume.com is built around one header style: an egress proxy rule, an API gateway policy, or a log filter that redacts Authorization but not x-api-key. In that case you pick the mode once in the environment and every sume command follows it.

The CLI environment variables

These are the variables the CLI reads, from the CLI configuration page.

Why one header, not both

The API accepts either header on its own, but rejects a request that has both. A request with Authorization: Bearer and x-api-key together fails with 401 unauthorized and the message Send only one API key credential. There is no precedence rule, so neither header wins.

The CLI picks one for you, which means the failure shows up only if a layer in front of it adds a second credential. A proxy or interceptor that injects its own Authorization header is one way this happens. If you see that 401 from the CLI while the key is correct, set the mode to match what the proxy leaves alone, or remove the injected header.

A quick check sequence

Run read-only commands first. sume auth status shows the CLI's current auth state. sume doctor --agent --json checks local readiness without a call to the API, so it cannot confirm that the header reaches Sume. For that, run one read such as sume account get --json.

The sample sets the mode to Bearer and runs the checks. The key comes from the environment, never from a file in the repository.

export SUME_API_KEY="sume_live_..."          # from your secret store
export SUME_API_BASE_URL="https://api.sume.com/v1"
export SUME_API_AUTH_MODE="bearer"            # or "x-api-key" (default)

sume auth status
sume doctor --agent --json
sume account get --json

Where the config lives

Unless you set SUME_CONFIG_DIR, the CLI keeps its local config in ~/.sume-com/config.json. Browser login stores a CLI-scoped key there. Environment variables are meant for CI, server automation and advanced local flows, per the CLI authentication page. If a command behaves differently in CI than on your laptop, compare the two environments for SUME_API_AUTH_MODE first, then for SUME_API_BASE_URL.

What this does not change

The auth mode changes the header name, not the key and not its scopes. Scopes are fixed when you create the key. A key without the right scope still fails with 403 insufficient_scope in either mode, and a wrong base URL fails regardless of the header. When you report a problem to Sume, include the command and flags with secrets redacted, the output of sume version, the sanitized error code, the request id and the job id if there is one, and whether the credential came from the environment or from the local config. Those are the items the CLI troubleshooting page asks for, and the auth mode is worth adding to the list.