chore(cli): document FACTORY_API_KEY instead of FACTORY_TOKEN for CI auth

[lukealvoeiro]

Gap

The CLI security page tells users to set the FACTORY_TOKEN environment variable for CI/CD. The CLI never reads FACTORY_TOKEN. The variable it uses for API-key authentication is FACTORY_API_KEY. The Japanese mirror says the same thing.

Evidence

• Docs:
  • docs/cli/account/security.mdx:73: - Use the FACTORY_TOKEN environment variable for CI/CD
  • docs/jp/cli/account/security.mdx:73: - CI/CDではFACTORY_TOKEN環境変数を使用する
• Code (Factory-AI/factory-mono, dev):
  • The CLI reads the API key from FACTORY_API_KEY in apps/cli/src/environmentResolution.ts:228-231.
  • The variable is defined in packages/environment/src/constants/index.ts:99 (FACTORY_API_KEY: 'FACTORY_API_KEY', // API key authentication).
  • The auth order is documented in packages/runtime/auth/src/auth/source.ts:99 ("1. FACTORY_API_KEY env var -> api-key").
  • rg -n FACTORY_TOKEN apps/cli/src packages finds only an unrelated local constant DISPLAY_FACTORY_TOKEN.
• Live run of a source-built CLI with an isolated HOME and the API base blocked:

  $ FACTORY_TOKEN=fk-dummy droid exec "hi"; echo EXIT=$?
  Error during droid execution: Authentication failed. Please log in using /login or set a valid FACTORY_API_KEY environment variable.
  EXIT=1
  
  $ FACTORY_API_KEY=fk-dummy droid exec "hi"; echo EXIT=$?
  Error during droid execution: Connection error.
  EXIT=1
  

  With only FACTORY_TOKEN set, the CLI sees no credential. With FACTORY_API_KEY set, it accepts the credential and tries the network, which fails only because the API base is blocked.
• Other pages already use FACTORY_API_KEY for CI and headless auth, for example docs/cli/droid-exec/overview.mdx:110 and docs/reference/cli-reference.mdx:460-468,572.

Why it matters

A user who follows the security page and sets FACTORY_TOKEN in their CI secrets gets a failing pipeline with an authentication error. The page also contradicts the droid exec and CLI reference pages.

Fix

In docs/cli/account/security.mdx and docs/jp/cli/account/security.mdx, line 73 now names FACTORY_API_KEY instead of FACTORY_TOKEN. Nothing else changed. After the change, rg -n FACTORY_TOKEN across the docs repo (EN and JP) finds no matches.

Validation

• git diff --check: clean. 2 files changed, 2 insertions, 2 deletions.
• rg -n FACTORY_TOKEN . in the docs repo: no matches.
• The repo has no runnable lint script; each edit replaces one token inside an existing bullet, so the MDX structure is unchanged.

Found by the scheduled CLI arguments audit (gap DOC-U1 / ROOT-U3).

[factory-droid]

Droid finished @lukealvoeiro's task —— View job

---

LGTM. The English and Japanese security pages now name the API-key environment variable used by the CLI; no actionable issues found.

0 inline comments posted