Running HawkScan in CI or from an agent: (1) check `hawk version` is 6.0.0+ first; older CLIs silently lack `hawk config` and the scan misbehaves. (2) Auth headless with the `HAWK_API_KEY` env var and prefix each command: `API_KEY value $HAWK_API_KEY hawk scan`. Do not try `hawk init` in CI, it needs a browser. (3) If you get 401/403, the key is wrong or missing, fix the secret, not the YAML. (4) For the GitHub Action path, use `stackhawk/hawkscan-action@v2` with `apiKey value ${{ secrets.HAWK_API_KEY }}` and start your app in an earlier step: HawkScan scans a live target, it cannot start your app for you.