# grr configuration — the only file grr reads.
#
# You probably do not need this file. Release binaries (GitHub Releases,
# Homebrew, winget) are built with an OAuth client already compiled in, so
# `grr auth login` works immediately after install. This file exists only to
# OVERRIDE that built-in client — with your own, or when you built from
# source and have no embedded client at all.
#
# The easy way to write it: grr auth setup
# It validates the client id, writes this file (mode 0600 on unix), and
# refuses to clobber an existing one without --force.
#
# To write it by hand, copy to ~/.grr/config.toml
# (Windows: %USERPROFILE%\.grr\config.toml) and paste your OAuth client ID.
#
# Full Google Cloud walkthrough: docs/gcp-setup.md
# GRR_CONFIG_PATH overrides the file location.
# Both snake_case and kebab-case key spellings are accepted.
#
# Resolution order: GRR_OAUTH__CLIENT_ID / GRR_OAUTH__CLIENT_SECRET in the
# environment (wins over the file) > this file > the client compiled into the
# binary. The device keys below resolve the same way
# (GRR_OAUTH__DEVICE_CLIENT_ID / GRR_OAUTH__DEVICE_CLIENT_SECRET).
[oauth]
# Desktop-app OAuth client ID (ends in .apps.googleusercontent.com).
# Create one at https://console.cloud.google.com/apis/credentials
# (Create credentials -> OAuth client ID -> Application type: Desktop).
client_id = ""
# Optional: Google shows a client secret next to the client ID even for
# Desktop clients. Sent at the token endpoint only when present;
# PKCE is always on. Leave commented out for PKCE-only providers.
# client_secret = ""
# Device-flow client (optional; only `grr auth login --device` uses it).
# Google's device endpoint accepts one application type only — "TVs and
# Limited Input devices" — and rejects the Desktop client above with
# `invalid_client: Invalid client type`, so the two flows cannot share a
# client. Create a second one with that application type and uncomment.
# device-client-id = ""
# device-client-secret = ""
# [systemone]
# Optional: the System One model behind `grr ask` (plain English -> a typed
# plan). Release builds target the hosted service; set this only to point
# the call at your own endpoint/model. TYPESAFE_API_KEY in the environment
# maps here and is preferred over an api-key in this file — a committed or
# shared file can leak a key.
# endpoint = ""
# model = ""
# api-key = "" # sent as `Authorization: Bearer`
# confidence-threshold = 0.6 # below this method-choice confidence, ask
# # flags the answer (the model still chooses)