Configuration

The .dino.yml reference: endpoint, protocol, spec URL, and the auth union (none, header, oauth2). Secrets are referenced by env var, never written to the file.

Dino reads a flat .dino.yml from the current directory. dino init generates it; you can also write it by hand. Every field is optional. The minimum is an endpoint and protocol, and even those can be passed as flags for an ad-hoc scan.

.dino.yml

# yaml-language-server: $schema=https://usedino.dev/schema.json
# Generated by dino init: see https://docs.usedino.dev for all options

endpoint: https://your-api.com/graphql
protocol: graphql

Fields

Field	Type	Meaning
`endpoint`	URL	The API to scan. Equivalent to `--endpoint`.
`protocol`	`graphql` \| `rest`	Target protocol. Default `graphql`.
`specUrl`	URL \| path	OpenAPI spec. Required when `protocol: rest`.
`auth`	union	Auth for the target API (see below).
`format`	`markdown` \| `json`	Default output format.
`snapshotDir`	path	Where schema snapshots are stored (for `diff`, `changelog`).
`autonomy`	`{ level: observe \| enforce }`	Shadow Mode default for `watch`.
`aiKey`	string	Anthropic API key for `--reasoning` (prefer the `ANTHROPIC_API_KEY` env var).
`tenant`	string	Advanced: use a `tenants/<id>.yml` config instead of the flat fields.
`environment`	string	Advanced: default environment within a tenant.

Authentication

auth is a union: pick the arm that matches your API. Secrets are never written to the file: header and OAuth2 arms reference an environment variable name, and Dino reads the value at runtime.

auth:
  type: none

Public API, or auth supplied ad-hoc via --header / --token.

REST configuration

REST works from the flat config: point specUrl at an OpenAPI document (URL or local path). No tenant file required.

.dino.yml

endpoint: https://your-api.com
protocol: rest
specUrl: https://your-api.com/openapi.json

Advanced: tenants

For multi-environment or cloud setups, set tenant: and keep a tenants/<id>.yml with per-environment endpoints, auth adapters, and roles. This is the advanced path; the flat config above covers single-target scanning, including REST.

Security & credentials

Secrets stay out of the file. dino init never writes a token or client secret, only the env-var name (valueEnv, clientIdEnv, clientSecretEnv) is stored. Keep .dino.yml in version control safely.
Secrets stay out of output. Evidence is off by default in JSON output; when enabled, secret-shaped values redact to [REDACTED], and error envelopes are sanitized. See machine contracts.
Cloud credentials from dino login are stored in ~/.dino/credentials.json; dino logout clears them.