Connector credentials

This list is extracted from the connector manifests. Names have to match exactly. A key with a different name produces the same symptom as a missing key: the connector drops out of the served set silently, with a connector not served line in the boot log as the only signal.

No credential is needed for the runner to boot. Every connector is lazy: a missing key only makes those operations answer auth_error.

This page covers which keys to create, not with what permissions

For the scopes of each one (including the ready-made AWS IAM policy, Datadog’s scopes, and the RBAC that EKS requires on top of IAM), see Scopes and permissions.

Observability

datadog, grafana and signoz are mutually exclusive. See Observability backend.

datadog

Key	Required
DD_API_KEY	yes
DD_APP_KEY	yes
DD_SITE	no. datadoghq.eu, us3, us5, ap1 depending on the org

grafana

Key	Required
GRAFANA_CLOUD_TOKEN	yes
GRAFANA_PROM_URL	yes. Mimir is the backbone
GRAFANA_PROM_USER	no. The instance’s numeric ID; without it the token is sent as Bearer
GRAFANA_LOKI_URL, GRAFANA_LOKI_USER	no
GRAFANA_TEMPO_URL, GRAFANA_TEMPO_USER	no
GRAFANA_STACK_URL	no. Alerting API
GRAFANA_SYNTHETICS_URL	no
GRAFANA_SERVICE_LABEL, GRAFANA_ENV_LABEL, GRAFANA_NAMESPACE_LABEL, GRAFANA_HOST_LABEL, GRAFANA_ROUTE_LABEL	no, but adjust them if your labels don’t follow the convention

signoz

Self-hosted: the endpoint is usually internal, reachable because the runner runs inside your network. Requires the v5 query_range API. Serves metrics, logs, traces, topology and monitors — it does not serve rum or synthetics.

Key	Required
SIGNOZ_ENDPOINT	yes. e.g. http://signoz.observability.svc.cluster.local:8080
SIGNOZ_API_KEY	yes. Service account, SIGNOZ-API-KEY header
SIGNOZ_SERVICE_FIELD, SIGNOZ_ENV_FIELD, SIGNOZ_NAMESPACE_FIELD, SIGNOZ_HOST_FIELD, SIGNOZ_ROUTE_FIELD	no. OTel semconv defaults; adjust if your instrumentation differs

checkly

A synthetics specialist. When present, it takes the capability over from whichever general provider is configured.

Key	Required
CHECKLY_API_KEY	yes
CHECKLY_ACCOUNT_ID	in practice, for a user token. Without it the API answers 401 without saying why. Unnecessary for an account or service token.

Cloud

aws

Key	Required
AWS_ACCESS_KEY_ID	yes, in static mode
AWS_SECRET_ACCESS_KEY	yes, in static mode
AWS_SESSION_TOKEN	no. Temporary STS credentials
AWS_REGION	not by the manifest, but required for aws-sts attestation

With RUNNER_AWS_CRED_MODE=chain, no key is injected: the default chain resolves it. See Cloud credentials.

kubernetes

AWS-coupled: it reuses exactly the same AWS_* keys. There is no separate credential.

Additionally, EKS_CLUSTER, outside the manifest, read from the environment. Without it, the health check answers skipped: no cluster configured.

gcp

Key	Required
GCP_SA_KEY	yes in static mode. The service account JSON on one line. Unnecessary in chain.
GCP_PROJECT_ID	no
GCP_REGION	no
GCP_BILLING_EXPORT_TABLE	no. Without it, the GCP cost operation fails explicitly

Code and deployment

github

Key	Required
GITHUB_TOKEN	yes. Read is enough; the write scope is optional (see below)

GitHub is the only code connector with a write operation: create_github_issue, which opens an issue in your repository. It is optional, and the credential is what decides — a read-only token makes the operation fail inside your infrastructure, and the tool disappears from the agent’s surface. There is no flag because none is needed: the token scope is already the switch. No other write exists on GitHub — no pull request, no branch, no workflow, no secret. See What the agent writes.

vercel

Orthogonal to GitHub: it creates its own operations and doesn’t contend for ownership.

Key	Required
VERCEL_TOKEN	yes. Use a read-only token scoped to the team
VERCEL_TEAM_ID	in practice, for a team token. Without it the API answers 403 without explaining. Absent on a personal account.

argocd

Orthogonal to both GitHub and Vercel: it creates its own operations and doesn’t contend for ownership with either. The server is usually internal to your cluster, and RootPilot reaches it by running in there.

Key	Required
ARGOCD_SERVER_URL	yes. E.g. https://argocd-server.argocd.svc.cluster.local
ARGOCD_TOKEN	yes. Local account with read-only RBAC, via argocd account generate-token

RootPilot reads rollbacks, it never triggers them — no sync, no rollback, no terminate, no delete. It also never asks for refresh, which is a read parameter of the Argo CD API with a write effect: it forces reconciliation in your cluster. A read-only RBAC token is the switch that guarantees this from your side; see Scopes and permissions.

sonarqube

Key	Required
SONARQUBE_HOST	yes
SONARQUBE_TOKEN	yes

Data and product

amplitude

Key	Required
AMPLITUDE_API_KEY	yes
AMPLITUDE_SECRET_KEY	yes
AMPLITUDE_TZ_OFFSET_MINUTES	no

AMPLITUDE_TZ_OFFSET_MINUTES is the Amplitude project’s timezone offset from UTC, in minutes (BRT = -180). The API reads window dates as YYYYMMDD in the project’s timezone, and does not expose which one that is — without the offset, a project in BRT has every reading between 21:00 and 00:00 local time landing on the next day: the number comes back correct for the wrong question. Absent = UTC.

Amplitude’s user and session-replay operations are the ones that go through the structural PII redaction layer. See PII redaction.

mixpanel

An alternative to Amplitude, not an addition: both serve the same operations, so RUNNER_ANALYTICS=amplitude|mixpanel decides (default amplitude). See Observability backend.

Key	Required
MIXPANEL_SERVICE_ACCOUNT	yes. Project service account, shaped <name>.<id>.mp-service-account
MIXPANEL_SERVICE_SECRET	yes
MIXPANEL_PROJECT_ID	yes. With a service account it is not optional
MIXPANEL_REGION	no. eu or in for data residency — it changes the host
MIXPANEL_ACTIVE_USER_EVENT	no, but without it “active users” has no answer — see below

Mixpanel serves 8 of the 16 analytics operations. The others are not pending: there is no Boards API, and Insights only answers by saved-report bookmark. The matching tools disappear from the agent surface rather than answering empty.

“Active users” needs your convention

Mixpanel’s Query API does not measure active users across events: segmentation requires one event and accepts no wildcard, and Insights only answers by saved report. Declare in MIXPANEL_ACTIVE_USER_EVENT which event means “active user” in your instrumentation (e.g. App Open). Without it the read returns null with the reason — never zero, which in a number like this would read as “nobody used the product”.

Three operations use endpoints Mixpanel declares in maintenance mode (segmentation, funnels and the activity stream). They stay served, and the answer says so — the alternative Mixpanel itself recommends, Insights, only answers by saved report and so does not cover ad-hoc queries.

The Query API is capped at 60 queries per hour and 5 concurrent, per project.

mongo

Key	Required
MONGO_URI	yes

Network

cloudflare

Key	Required
CLOUDFLARE_API_TOKEN	yes

azion

Key	Required
AZION_TOKEN	yes. Note: not AZION_API_TOKEN

Ticketing and chat

The only connectors with write operations: six in total, all covered by human confirmation in two layers. See Security model.

jira

Key	Required
JIRA_HOST	yes
JIRA_EMAIL	yes
JIRA_API_TOKEN	yes

slack

Key	Required
SLACK_BOT_TOKEN	yes

When adding a connector

The key has to go into two lists, or it will never reach the container:

1. docker-compose.yml, in the environment: list (pass-through, bare name with no =).
2. runner.secrets.env.example, for anyone using the file fallback.

The test apps/runner/tests/connectors/env-surface.test.ts fails if you forget either one.