# shdctl configure command

> Manage registry credentials for shdctl

Use the `configure` command group to manage the registry credentials that shdctl uses to pull releases. shdctl stores them in `~/.shdctl/config.json` in your home directory, readable only by your user but not encrypted.

## configure (interactive)

Set credentials interactively. The command prompts you for your username and password, and doesn't show the password as you type it:

```sh
shdctl configure
```

If `SHDCTL_USERNAME` or `SHDCTL_PASSWORD` is set, the command uses that value instead of prompting for it.

By default, shdctl uses `uccmpprivatecloud.azurecr.io` as the registry. To set credentials for a different registry, run `shdctl configure set <registry-url>`.

## configure get

View your current configuration:

```sh
shdctl configure get
```

The command reports where the credential file is and whether it exists. It never prints the credentials themselves.

## configure set

Set credentials non-interactively. The registry argument is positional and defaults to `uccmpprivatecloud.azurecr.io`. You can provide the password by using one of the following methods, listed from most to least secure for automation:

Use **`--password-stdin`**, which is recommended for CI/CD, to read the password from standard input. This method prevents the password from appearing in your shell history or the process list:

```sh
echo "$REGISTRY_PASSWORD" | shdctl configure set <registry-url> --username "$REGISTRY_USERNAME" --password-stdin
```

Use the `SHDCTL_PASSWORD` environment variable together with `SHDCTL_USERNAME` to supply the credentials through environment variables when piping isn't convenient:

```sh
export SHDCTL_USERNAME=<username>
export SHDCTL_PASSWORD=<password>
shdctl configure set <registry-url>
```

Use **`--password`** to pass the password as a flag. This option is available only for backward compatibility and isn't recommended:

```sh
shdctl configure set <registry-url> --username <username> --password <password>
```

> **Warning:**
>
> Passing `--password` on the command line exposes the password in your shell history (such as `.bash_history` or `.zsh_history`) and in the process list (`ps aux`). shdctl also writes a warning to `stderr` when you use this option. For automation, use `--password-stdin` or `SHDCTL_PASSWORD`, or run the interactive `shdctl configure` command instead.

You can't use `--password` and `--password-stdin` together. If you pass neither and `SHDCTL_PASSWORD` isn't set, shdctl prompts you for the password, or, when stdin isn't a terminal, exits with an error instead of hanging. The username works the same way: `--username`, then `SHDCTL_USERNAME`, then a prompt.

## configure delete

Remove stored credentials. The registry argument is positional and defaults to `uccmpprivatecloud.azurecr.io`:

```sh
shdctl configure delete <registry-url>
```

It removes the entry from `~/.shdctl/config.json` only. If vpctl left a `~/.vpctl/config.json`, `release pull` still finds the credential there until you delete that file.