Connector credentials

This list is extracted from the connector manifests. Names have to match exactly. A key with a different name produces the same symptom as a missing key: the connector drops out of the served set silently, with a connector not served line in the boot log as the only signal.

No credential is needed for the runner to boot. Every connector is lazy: a missing key only makes those operations answer auth_error.

Observability

datadog and grafana are mutually exclusive. See Observability backend.

`datadog`

Key	Required
`DD_API_KEY`	yes
`DD_APP_KEY`	yes
`DD_SITE`	no. `datadoghq.eu`, `us3`, `us5`, `ap1` depending on the org

`grafana`

Key	Required
`GRAFANA_CLOUD_TOKEN`	yes
`GRAFANA_PROM_URL`	yes. Mimir is the backbone
`GRAFANA_PROM_USER`	no. The instance’s numeric ID; without it the token is sent as Bearer
`GRAFANA_LOKI_URL`, `GRAFANA_LOKI_USER`	no
`GRAFANA_TEMPO_URL`, `GRAFANA_TEMPO_USER`	no
`GRAFANA_STACK_URL`	no. Alerting API
`GRAFANA_SYNTHETICS_URL`	no
`GRAFANA_SERVICE_LABEL`, `GRAFANA_ENV_LABEL`, `GRAFANA_NAMESPACE_LABEL`, `GRAFANA_HOST_LABEL`, `GRAFANA_ROUTE_LABEL`	no, but adjust them if your labels don’t follow the convention

`checkly`

A synthetics specialist. When present, it takes the capability over from whichever general provider is configured.

Key	Required
`CHECKLY_API_KEY`	yes
`CHECKLY_ACCOUNT_ID`	in practice, for a user token. Without it the API answers 401 without saying why. Unnecessary for an account or service token.

Cloud

`aws`

Key	Required
`AWS_ACCESS_KEY_ID`	yes, in `static` mode
`AWS_SECRET_ACCESS_KEY`	yes, in `static` mode
`AWS_SESSION_TOKEN`	no. Temporary STS credentials
`AWS_REGION`	not by the manifest, but required for `aws-sts` attestation

With RUNNER_AWS_CRED_MODE=chain, no key is injected: the default chain resolves it. See Cloud credentials.

`kubernetes`

AWS-coupled: it reuses exactly the same AWS_* keys. There is no separate credential.

Additionally, EKS_CLUSTER, outside the manifest, read from the environment. Without it, the health check answers skipped: no cluster configured.

`gcp`

Key	Required
`GCP_SA_KEY`	yes in `static` mode. The service account JSON on one line. Unnecessary in `chain`.
`GCP_PROJECT_ID`	no
`GCP_REGION`	no
`GCP_BILLING_EXPORT_TABLE`	no. Without it, the GCP cost operation fails explicitly

Code and deployment

`github`

Key	Required
`GITHUB_TOKEN`	yes

`vercel`

Orthogonal to GitHub: it creates its own operations and doesn’t contend for ownership.

Key	Required
`VERCEL_TOKEN`	yes. Use a read-only token scoped to the team
`VERCEL_TEAM_ID`	in practice, for a team token. Without it the API answers 403 without explaining. Absent on a personal account.

`sonarqube`

Key	Required
`SONARQUBE_HOST`	yes
`SONARQUBE_TOKEN`	yes

Data and product

`amplitude`

Key	Required
`AMPLITUDE_API_KEY`	yes
`AMPLITUDE_SECRET_KEY`	yes

Amplitude’s user and session-replay operations are the ones that go through the structural PII redaction layer. See PII redaction.

`mongo`

Key	Required
`MONGO_URI`	yes

Network

`cloudflare`

Key	Required
`CLOUDFLARE_API_TOKEN`	yes

`azion`

Key	Required
`AZION_TOKEN`	yes. Note: not `AZION_API_TOKEN`

Ticketing and chat

The only connectors with write operations: five in total, all covered by human confirmation in two layers. See Security model.

`jira`

Key	Required
`JIRA_HOST`	yes
`JIRA_EMAIL`	yes
`JIRA_API_TOKEN`	yes

`slack`

Key	Required
`SLACK_BOT_TOKEN`	yes

When adding a connector

The key has to go into two lists, or it will never reach the container:

docker-compose.yml, in the environment: list (pass-through, bare name with no =).
runner.secrets.env.example, for anyone using the file fallback.

The test apps/runner/tests/connectors/env-surface.test.ts fails if you forget either one.