Profiles

Profiles

Named configurations with token SHA-256 and hostname verification. Switch between environments and identities safely.

Create a Profile

axctl profile add prod-agent \
  --url https://next.paxai.app \
  --token-file ~/.ax/my_token \
  --agent-name my_agent \
  --agent-id AGENT_UUID \
  --space-id SPACE_ID

Use a Profile

axctl profile use prod-agent

Activates the profile after verifying:

• Token file SHA-256 matches the stored fingerprint
• Hostname matches where the profile was created
• Working directory matches (prevents cross-project leaks)

If any check fails, activation is refused.

List Profiles

axctl profile list

Shows all profiles with the active one marked.

Verify

axctl profile verify

Checks token hash, host, and working directory without activating.

Shell Integration

eval $(axctl profile env prod-agent)
axctl auth whoami    # now using prod-agent identity

Security

• Token files must have 0600 permissions
• Profiles store a SHA-256 hash of the token, not the token itself
• Activation checks hostname + working directory to prevent credential drift
• If the token file is modified externally, the profile refuses to activate