> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hitheo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> Configuration via environment variables.

## Variables

| Variable               | Required | Default                 | Used By       | Description                                                                                                                                                                                                                                           |
| ---------------------- | -------- | ----------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `THEO_API_KEY`         | ✅        | —                       | CLI, SDK, MCP | Your `theo_sk_...` API key                                                                                                                                                                                                                            |
| `THEO_BASE_URL`        | —        | `https://www.hitheo.ai` | CLI, SDK, MCP | Override API base URL                                                                                                                                                                                                                                 |
| `THEO_ALLOW_JS_CONFIG` | —        | unset                   | MCP           | When `1`, allows the MCP server to load `theo.config.js` / `theo.config.ts` instead of `theo.config.json`. Off by default for [safety](/mcp/security#the-json-only-config-sandbox) — JS/TS config executes arbitrary code from the working directory. |

<Warning>
  `THEO_BASE_URL` defaults to the canonical `www` host. Pointing it at `https://hitheo.ai` (without `www`) causes the apex to 307-redirect to `www`, which some HTTP clients handle by stripping the `Authorization` header — first-time 401. See [401 Troubleshooting](/troubleshooting/401-errors).
</Warning>

## Where They're Used

* **CLI** — `theo complete`, `theo status`, `theo verify`, `theo skill publish` all read `THEO_API_KEY`. `theo status` also probes both apex and `www` regardless of which one `THEO_BASE_URL` points at, so a misconfigured env var is surfaced as a warning.
* **MCP Server** — The `@hitheo/mcp` server reads `THEO_API_KEY` on startup and injects it into every tool call. `THEO_BASE_URL` defaults to `https://www.hitheo.ai` as of `@hitheo/mcp@0.2.0`.
* **SDK** — For programmatic use, pass the key directly:

```typescript theme={null}
const theo = new Theo({ apiKey: process.env.THEO_API_KEY! });
```

## Setting Variables

<CodeGroup>
  ```bash Shell theme={null}
  export THEO_API_KEY=theo_sk_live_a1b2c3d4e5f6...
  ```

  ```bash .env file theme={null}
  THEO_API_KEY=theo_sk_live_a1b2c3d4e5f6...
  THEO_BASE_URL=https://www.hitheo.ai
  ```
</CodeGroup>

## Precedence

1. Explicit constructor parameter (SDK) or CLI flag
2. Environment variable
3. `.env` file in the current directory
   Explicit values always override environment variables.