Skip to main content

​
What the CLI can authenticate

The CLI uses endpoint-specific authentication. Dapp API transaction methods and JSON endpoints require an API key. Client-controlled Agentic API and RAMS writes use an API key when configured and otherwise fall back to x402; relayed writes use x402. KYC link creation requires an API key, while the BKN faucet, agent getters, and RAMS reads use an API key when configured and otherwise fall back to x402.
The CLI supports Dapp API transaction methods through brickken tx prepare --method <method> and Dapp API JSON endpoints through brickken dapp get or brickken dapp request. Multipart file uploads such as /patch-token-docs remain REST-only.Use the MCP server or REST API when you need multipart uploads or the full typed Dapp API surface.

​
Write authentication

Transaction authentication depends on the method and execution mode:
  1. In brickken-relayed mode, the CLI prepares for free and the send carries the full operation charge.
  2. Dapp API transaction methods use the configured API key at prepare and send; the operation is charged against the key’s credits.
  3. Client-controlled Agentic API and RAMS writes use the configured API key when present. Without a key, the CLI handles the x402 challenge at each priced step.
  4. When an x402 request responds 402 Payment Required, the CLI signs the payment locally and retries with an X-PAYMENT header.
In the recommended brickken-relayed mode the private key signs only the x402 payment — Brickken’s relayer signs and broadcasts the operation. In the default client-signed mode the same key also signs the blockchain transaction locally.

​
KYC and read authentication

KYC and Dapp API JSON endpoints always need an API key. Agent getters and RAMS read/typed-data endpoints send the key when configured and otherwise use the configured private key for x402.
BKN_API_KEY is accepted as an alias, or pass global --api-key. Offline rams sign --typed-data-file does not require a key.
Your private key never leaves your machine. Treat it as a secret: prefer an .env file or environment variable over passing --private-key inline.

​
Provide a private key

BKN_PRIVATE_KEY is accepted as an alias.

​
Environments and base URLs

Select the environment with --env or BRICKKEN_ENV (default: sandbox): Override the base URL directly with --base-url or BRICKKEN_BASE_URL when needed. An internal forge environment exists for Brickken pre-release QA — contact tech@brickken.com for its base URL.

​
Networks and chain IDs

Pass the target chain with --chain. Both decimal and hex forms are accepted, and common decimal IDs are normalized automatically — for example Base Sepolia can be passed as 84532 or 14a34.

​
RPC URL

Some commands (notably create-token) wait for the deployment receipt to read back the deployed tokenAddress. Set an RPC for the target chain:
BKN_RPC_URL is accepted as an alias, or use --rpc-url.

​
Configuration precedence

Configuration is resolved in this order (highest priority first):
  1. Command-line flags — --env, --base-url, --api-key, --private-key, --rpc-url, --env-file, --json
  2. Environment variables — BRICKKEN_* or BKN_*
  3. .env file in the current working directory (or the path given by --env-file)
  4. Defaults — sandbox environment, client-signed execution mode (pass --execution-mode brickken-relayed to opt into relayed)

​
Global flags

​
Environment variables

​
Budget note

Relayed preparation is free, while client-controlled modes split the write charge between prepare and send. Agent getters cost 0.000001 USDC per x402 call. On Base Sepolia and other non-production environments the write reference price is commonly 0.01 USDC per operation. Fund the wallet behind BRICKKEN_PRIVATE_KEY with the exact asset returned by the live challenge. See Pricing for the execution-mode matrix and mainnet write table.