diff --git a/doc/development.md b/doc/development.md
index f071588a..b9447fa2 100644
--- a/doc/development.md
+++ b/doc/development.md
@@ -40,6 +40,32 @@ run `./bin/nextstrain` to test your local changes without installing them.
 `nextstrain`; that script is generated by the `entry_points` configuration in
 `setup.py`.)
 
+## External resources
+
+Environment variables can be used to change the location or identity of
+external resources/services used by some Nextstrain CLI commands.  This is
+helpful when performing manual integration testing against development or
+testing resources.
+
+When running the [nextstrain.org server][] locally, you can make the
+`nextstrain remote` family of commands talk to it instead of the real
+nextstrain.org by setting `NEXTSTRAIN_DOT_ORG`, e.g.:
+
+    NEXTSTRAIN_DOT_ORG=http://localhost:5000 \
+      nextstrain remote ls nextstrain.org/groups/test
+
+If you need authenticated access and the local server is using the AWS Cognito
+resources from our ["testing" configuration][], you can configure `nextstrain`
+with the same, e.g.:
+
+    export NEXTSTRAIN_DOT_ORG=http://localhost:5000
+    export NEXTSTRAIN_COGNITO_USER_POOL_ID="$(jq -r .COGNITO_USER_POOL_ID ../nextstrain.org/env/testing/config.json)"
+    export NEXTSTRAIN_COGNITO_CLI_CLIENT_ID="$(jq -r .COGNITO_CLI_CLIENT_ID ../nextstrain.org/env/testing/config.json)"
+    
+    nextstrain login
+    nextstrain whoami
+    nextstrain remote ls groups/test-private
+
 ## Releasing
 
 New releases are made frequently and tagged in git using a [_signed_ tag][].
@@ -109,6 +135,8 @@ Changes to source documentation files will be reflected automatically.
 
 
 [Semantic Versioning rules]: https://semver.org
+[nextstrain.org server]: https://github.com/nextstrain/nextstrain.org
+["testing" configuration]: https://github.com/nextstrain/nextstrain.org/tree/@/env/testing/
 [_signed_ tag]: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
 [CI workflow]: ../.github/workflows/ci.yaml
 [source distributions]: https://packaging.python.org/en/latest/glossary/#term-Source-Distribution
diff --git a/nextstrain/cli/authn.py b/nextstrain/cli/authn.py
index f3b46b05..95251caa 100644
--- a/nextstrain/cli/authn.py
+++ b/nextstrain/cli/authn.py
@@ -1,6 +1,18 @@
 """
 Authentication routines.
+
+
+Environment variables
+=====================
+
+.. warning::
+    For development only.  You don't need to set these during normal operation.
+
+.. envvar:: NEXTSTRAIN_COGNITO_USER_POOL_ID
+
+.. envvar:: NEXTSTRAIN_COGNITO_CLI_CLIENT_ID
 """
+import os
 from functools import partial
 from sys import stderr
 from typing import Dict, List, Optional
@@ -14,8 +26,11 @@
 CONFIG_SECTION = "authn"
 
 # Public ids.  Client id is specific to the CLI.
-COGNITO_USER_POOL_ID = "us-east-1_Cg5rcTged"
-COGNITO_CLIENT_ID    = "2vmc93kj4fiul8uv40uqge93m5"
+COGNITO_USER_POOL_ID = os.environ.get("NEXTSTRAIN_COGNITO_USER_POOL_ID") \
+                    or "us-east-1_Cg5rcTged"
+
+COGNITO_CLIENT_ID = os.environ.get("NEXTSTRAIN_COGNITO_CLI_CLIENT_ID") \
+                 or "2vmc93kj4fiul8uv40uqge93m5"
 
 CognitoSession = partial(cognito.Session, COGNITO_USER_POOL_ID, COGNITO_CLIENT_ID)