Materialize CLI Configuration

mz is configured via a single TOML file stored at $HOME/.config/materialize/mz.toml.

You typically manage configuration via the following two commands:

  • mz config, which manages global configuration parameters.
  • mz profile, which manages authentication profiles.

You can also edit the file directly if you prefer. The format of the file is shown in the Example section.

Global parameters

mz supports several global configuration parameters, documented in the table below.

Name Type Description
profile string The name of the authentication profile to use by default.
Default: default.
vault string The default vault to use to store secret configuration parameters: inline or keychain. When set to inline, secrets are stored directly in the configuration file. When set to keychain, secrets are stored in the system keychain (macOS only).
Default (Linux): inline
Default (macOS): keychain

Use mz config set to set these parameters.

Authentication profiles

You can configure mz with multiple authentication profiles to seamlessly manage multiple Materialize user accounts. Each profile has a name, an associated app password, and a default region.

When invoking an mz command that requires authentication, you can explicitly choose which profile to use by passing the --profile flag. For example, to use the hooli profile with the mz sql command:

mz sql --profile=hooli

When the profile is not explicitly specified, mz uses the default profile specified in the configuration file. You can change the default profile using mz config. For example, to set the default profile to hooli:

mz config set profile hooli

Profile parameters

Field Type Description
app-password string Secret. The app password to use for this profile.
region string The default region to use for this profile.
vault string The vault to use for this profile. See Global parameters above.
cloud-endpoint string Internal use only. The Materialize API endpoint to use.
admin-endpoint string Internal use only. The Materialize administration endpoint to use.


The following is an example mz.toml configuration file with two authentication profiles.

# Activate the "acme-corp" authentication profile by default.
profile = "acme-corp"

# Store app passwords directly in the configuration file.
vault = "inline"

# Profile for Acme Corp.
# The app password that the CLI will use to authenticate.
app-password = "mzp_fg91g4fslgq329023..."
# The default region to use for the Acme Corp profile.
region = "aws/us-east-1"

# Profile for Hooli.
app-password = "mzp_a48df1039ecb2d94c..."
region = "aws/eu-west-1"
Back to top ↑