HashiConf 2025 Don't miss the live stream of HashiConf Day 2 happening now View live stream
Terraform Home

tfctl CLI configuration

This topic describes how to configure the tfctl CLI, including configuration file locations, environment variables, and telemetry settings.

Configuration directories

The tfctl CLI stores its configuration in the following directories:

  • Linux and MacOS: ~/.config/tfctl
  • Windows: %USERPROFILE%\.config\tfctl

tfctl stores configuration for individual profiles in the profiles subdirectory. For example, profiles/default.hcl stores the configuration for your default profile.

Environment variables

You can set the following variables to configure the active profile. Corresponding profile configuration flags take precedence over these variables. Configure tfctl with environment variables when you use it in automation, such as CI/CD pipelines.

  • TFCTL_ORGANIZATION: The organization to use for commands that require an organization
  • TFCTL_HOSTNAME: The Terraform Enterprise or HCP Terraform hostname. Defaults to app.terraform.io
  • TFCTL_TOKEN: An HCP Terraform API token for the default profile
  • TFCTL_TOKEN_<profile>: An HCP Terraform API token for a named profile
  • TF_TOKEN_<hostname>: An HCP Terraform API token with hostname in Punycode format, for example TF_TOKEN_app_terraform_io

Set the following variables to configure CLI behavior:

  • TFCTL_CONFIG_DIR: Change the location of the tfctl config directory. Default is ~/.config/tfctl
  • TFCTL_SKIP_MIGRATE: Set to true to prevent the installed skill files from migrating to the latest version
  • CHECKPOINT_DISABLE: Set to true to prevent tfctl from checking for newer versions

Telemetry

By default, HashiCorp collects anonymous, redacted trace telemetry for each command invocation, including the command name, exit status, network metrics, and basic process information.

You can disable telemetry using any of these methods:

  • Set TFCTL_TELEMETRY environment variable to disabled
  • Set DO_NOT_TRACK environment variable to true
  • Configure in your profile: tfctl profile set telemetry disabled

To view the telemetry that is transmitted, set profile telemetry to log:

$ tfctl profile set telemetry log

Related

Edit this page on GitHub