# HawkScan in CI needs hawk 6.0+ and API_KEY value $HAWK_API_KEY prefix; no browser init

## TL;DR

Running HawkScan in CI or from an agent: (1) check `hawk version` is 6.0.0+ first; older CLIs silently lack `hawk config` and the scan misbehaves. (2) Auth headless with the `HAWK_API_KEY` env var and prefix each command: `API_KEY value $HAWK_API_KEY hawk scan`. Do not try `hawk init` in CI, it needs a browser.

Use this when you run into the situation in the title.

**When not to use this skill:** unrelated tasks. It covers only the procedure above.

## Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

## Details

(3) If you get 401/403, the key is wrong or missing, fix the secret, not the YAML. (4) For the GitHub Action path, use `stackhawk/hawkscan-action@v2` with `apiKey value ${{ secrets.HAWK_API_KEY }}` and start your app in an earlier step: HawkScan scans a live target, it cannot start your app for you.