Configuration reference

API credentials resolve in this order:

1. CLI-incompatible: the environment variable FRONTIER_API_KEY (optional FRONTIER_API_URL, FRONTIER_PROJECT)
2. OS keychain item written by frontier login --api-key
3. 0600 fallback file (~/.config/frontier/credentials, or FRONTIER_CREDENTIALS_FILE)
4. FRONTIER_DEMO_API_KEY only in explicit local/demo mode (FRONTIER_ALLOW_LOCAL_MANIFEST set, and never when GITHUB_ACTIONS is set)

If none of those exist, commands that need SaaS fail with AUTH_REQUIRED: Run `frontier login --api-key`. API URL for assessment commands is --api-url, then FRONTIER_API_URL, then the stored credential URL, then frontier.yml / .frontier/config.yml.

Never put real keys in examples. Use placeholders such as frn_your_project_key and https://example.invalid.

• dbt project with dbt_project.yml and compiled target/manifest.json for discover/inspect/prove
• .frontier/config.yml from frontier init (project name, API URL, dbt target, default branch)
• dbt profiles.yml (default ~/.dbt/profiles.yml) for Snowflake connections
• An active SaaS semantic manifest before CI

version: 1
project: YOUR_DBT_PROJECT
api_url: https://YOUR_FRONTIER_ORIGIN
dbt:
  project_dir: .
  target: dev
git:
  provider: github
  default_branch: main

• FRONTIER_API_URL — public HTTPS origin, not localhost
• FRONTIER_API_KEY
• FRONTIER_ENTITY_HASH_KEY unless you explicitly pass --include-entity-ids (do not do that in customer CI)
• SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, SNOWFLAKE_PASSWORD on warehouse jobs only
• GITHUB_TOKEN is provided by Actions for the comment step and is not a Frontier secret

• FRONTIER_BLOCKING / upload --blocking
• FRONTIER_SKIP_PR_COMMENT / --skip-pr-comment
• FRONTIER_PULL_REQUEST, FRONTIER_BASE_SHA
• FRONTIER_WAREHOUSE_DATABASE, FRONTIER_WAREHOUSE_SCHEMA (isolated work schema; default schema DBT_CI)
• FRONTIER_SQL_CHANGE_REBUILD_PCT (recommended-rebuild threshold; default 75)
• FRONTIER_HIDE_UPDATE_NOTICE=1
• FRONTIER_REQUIRE_ARTIFACT_SHA to enforce artifact binding outside GitHub Actions
• FRONTIER_DRY_RUN / --dry-run — fixture counts only. Forbidden in customer CI prove.
• --allow-local-manifest / FRONTIER_ALLOW_LOCAL_MANIFEST — local override; not used by the generated workflow
• Snowflake extras: SNOWFLAKE_DATABASE, SNOWFLAKE_SCHEMA, SNOWFLAKE_WAREHOUSE, SNOWFLAKE_ROLE, SNOWFLAKE_AUTHENTICATOR, timeout variables FRONTIER_SNOWFLAKE_LOGIN_TIMEOUT, FRONTIER_SNOWFLAKE_NETWORK_TIMEOUT, FRONTIER_SNOWFLAKE_QUERY_TIMEOUT

frontier-cdc.yml in the dbt project. Provider must be snowflake_stream. Credentials are rejected if present in the file. Relations are database.schema.table.

version: 1
provider: snowflake_stream
sources:
  - source_model: stg_orders
    base_relation: DEV.DBT_DEV.STG_ORDERS
    stream_relation: DEV.FRONTIER_CDC.STG_ORDERS_STREAM
    primary_key: order_id
    target_entity: customer
    target_key: customer_id
    require_before_image_for:
      - DELETE

Billing is not currently enabled. Usage in the dashboard is informational only.