```
`langsmith auth login` chooses the profile name in this order:
1. `--profile`, if passed.
2. `LANGSMITH_PROFILE`, if set.
3. `current_profile` in the profile file, if set.
4. `default`.
It chooses the API URL in this order:
1. `--api-url`, if passed.
2. `LANGSMITH_ENDPOINT`, if set.
3. The selected profile's `api_url`, if present.
4. The default LangSmith Cloud endpoint.
After login, the CLI and SDKs can use the saved profile. The CLI refreshes OAuth tokens when needed and writes refreshed token fields back to the profile file. SDKs also use the OAuth access token from the profile when environment or constructor API-key auth is not set.
## Override profile values
Explicit client constructor arguments and environment variables take precedence over profile values.
| Setting | Precedence |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| Endpoint | Constructor `api_url` or `apiUrl`, then `LANGSMITH_ENDPOINT`, then profile `api_url`, then the default LangSmith Cloud endpoint. |
| Authentication | Constructor API key, then `LANGSMITH_API_KEY`, then profile OAuth access token, then profile `api_key`. |
| Workspace | Constructor `workspace_id` or `workspaceId`, then `LANGSMITH_WORKSPACE_ID`, then profile `workspace_id`. |
The older `LANGCHAIN_API_KEY`, `LANGCHAIN_ENDPOINT`, and `LANGCHAIN_WORKSPACE_ID` aliases still work, but prefer the `LANGSMITH_*` names for new configuration.
If a profile contains both `oauth.access_token` and `api_key`, SDKs use the OAuth access token first. If an OAuth refresh token is present and the access token is expired or close to expiring, SDKs can refresh the token and write the updated token fields back to the profile file.
If you mount a profile file as read-only, OAuth token refresh cannot persist updated tokens. Read-only mounts are appropriate for API-key profiles. Use a writable mount only when you intentionally rely on OAuth token refresh.
## Use profiles in code
When the profile file is present, create the client normally:
```python Python theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
from langsmith import Client
client = Client()
```
```typescript TypeScript theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
import { Client } from "langsmith";
const client = new Client();
```
To override a profile in code, pass the value explicitly:
```python Python theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
from langsmith import Client
client = Client(api_key="")
```
```typescript TypeScript theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
import { Client } from "langsmith";
const client = new Client({ apiKey: "" });
```
## Mount profiles in remote runtimes
For remote runtimes, mount the profile file as a secret file and set `LANGSMITH_CONFIG_FILE` to the mounted path. Do not copy the file into the image or repository.
### Docker
Mount your local profile directory into the container:
```shell theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
docker run --rm \
-e LANGSMITH_CONFIG_FILE=/home/app/.langsmith/config.json \
-e LANGSMITH_PROFILE=prod \
-v "$HOME/.langsmith:/home/app/.langsmith:ro" \
my-image
```
Use a read-write mount only when the profile uses OAuth refresh tokens:
```shell theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
docker run --rm \
-e LANGSMITH_CONFIG_FILE=/home/app/.langsmith/config.json \
-e LANGSMITH_PROFILE=prod \
-v "$HOME/.langsmith:/home/app/.langsmith" \
my-image
```
### Kubernetes
Create a Kubernetes secret from the profile file:
```shell theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
kubectl create secret generic langsmith-profile \
--from-file=config.json="$HOME/.langsmith/config.json"
```
Mount the secret and point the SDK to it:
```yaml theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
apiVersion: apps/v1
kind: Deployment
metadata:
name: app
spec:
template:
spec:
containers:
- name: app
image: my-image
env:
- name: LANGSMITH_CONFIG_FILE
value: /var/run/langsmith/config.json
- name: LANGSMITH_PROFILE
value: prod
volumeMounts:
- name: langsmith-profile
mountPath: /var/run/langsmith
readOnly: true
volumes:
- name: langsmith-profile
secret:
secretName: langsmith-profile
```
Kubernetes secret volumes are read-only. Use API-key profiles for this pattern, or use a writable secret-sync mechanism if your OAuth profile must refresh and persist tokens.
### Remote development and CI
In remote development environments or CI jobs, store the profile JSON in the platform's secret store, write it to a temporary file at runtime, and set `LANGSMITH_CONFIG_FILE` to that file path.
```shell theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}}
mkdir -p "$RUNNER_TEMP/langsmith"
printf '%s' "$LANGSMITH_PROFILE_JSON" > "$RUNNER_TEMP/langsmith/config.json"
chmod 600 "$RUNNER_TEMP/langsmith/config.json"
export LANGSMITH_CONFIG_FILE="$RUNNER_TEMP/langsmith/config.json"
export LANGSMITH_PROFILE=prod
```
For hosted LangSmith Cloud deployments, configure these values as deployment environment variables or workspace secrets unless the platform explicitly supports mounting secret files.
***
[Connect these docs](/use-these-docs) to Claude, VSCode, and more via MCP for real-time answers.
[Edit this page on GitHub](https://github.com/langchain-ai/docs/edit/main/src/langsmith/profile-configuration.mdx) or [file an issue](https://github.com/langchain-ai/docs/issues/new/choose).