> ## Documentation Index > Fetch the complete documentation index at: https://docs.basemode.ai/llms.txt > Use this file to discover all available pages before exploring further. # Configuration and secrets > Reading and changing base's configuration, the toggles worth knowing about, and storing an API key where a plugin can read it without it ever being typed into a chat. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} base config list base config get graph.auto_compact base config set devmode.enabled true ``` Configuration lives in `base.toml` and is addressed with dot-notation keys. Start with `list`, because it shows you the keys that exist and what they are currently set to, which beats guessing at a key name. **Why it works.** `base.toml` layers the same way everything else does: the workspace file overlays the global one by key, and inherits everything it does not override. So `base config list` inside a workspace shows you the merged result rather than one file. ## The toggles worth knowing about | Key | Default | What it does | | ------------------------------ | ------- | ------------------------------------------------------------------------------------------------------ | | `devmode.enabled` | off | Adds a diagnostic block to hook output naming which domains matched and what was suppressed. | | `multimodal.enabled` | off | Lets `base graph extract` read PDFs, images, audio and video, not just markdown. | | `grounding.enabled` | off | Makes every prompt-time injection carry a block instructing the agent to source-verify factual claims. | | `graph.auto_compact` | on | Auto-compacts a tier graph at session start once it passes the size threshold. | | `graph.compact_threshold_mb` | 12 | The size that triggers it. | | `graph.compact_cooldown_hours` | 24 | The minimum gap between compactions. | | `signal.max_chars` | 2000 | The character budget for session-start output, which handoffs, forks and reminders are exempt from. | **The gotcha.** `devmode.enabled` is for tuning, not for living in. Turn it back off, because it adds output to every hook event and the noise stops being informative quickly. **Next rung.** `grounding.enabled` is the one people do not know about. If you are using base to hold facts you will act on, having every injection carry an instruction to verify claims against a source is worth the tokens it costs. ## Secrets ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} base secret set GEMINI_API_KEY base secret list base secret rm GEMINI_API_KEY ``` **Why it works.** `base secret set` prompts with echo off. You paste the value, it is masked as you type, and it is never printed back. It lands in `~/.base-gbl/.env` with `0600` permissions, and plugins read it from their environment. The point is the thing that does *not* happen: the key is never an argument, so it never reaches your shell history, and it is never typed into a chat, so it never reaches a transcript. **The gotcha.** `base secret list` shows key names with masked values and never the full secret, which is what makes it safe to run while someone is watching your screen. `base secret rm` is a hard delete with no preview. **Next rung.** `.env` is the one file in the global tier that should never be copied to another machine. Everything else there is either policy you wrote or state about this install. See [Where things live](/how-it-works/where-things-live#what-is-portable). ## Your identity ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} base operator init --name "Chris" base operator show ``` The operator profile lives at `~/.base-gbl/operator.toml` and is loaded alongside everything else, so an agent knows who it is working for without being told each session. ## Next Adding commands to base, and checking one before you trust it. Every config, secret and operator command.