Tokens and keys

What you'll learn

Which environment variables and CLI logins AutoMax reads, what each one enables, and the exact requirement level. Run automax doctor for the same table with live status.

Nothing is mandatory for the platform itself: running suites, screenshots, HAR replay, SQLite, the MCP server over stdio, automax analyze, lint, reports and the dashboard all work with no credential at all. AutoMax's own API tokens are self-issued and free.

Requirement levels

Level	Meaning
mandatory	required only when the feature next to it is used
one-of	agents need any one of the rows in the group
optional	turns on an integration
ci-only	GitHub Actions secrets, never needed locally

Agents (one-of)

Credential	Adapter	How to get it	Billing
`ANTHROPIC_API_KEY`	`claude`	console.anthropic.com	Anthropic, per token
Claude Code login	`claude-code`	`npm i -g @anthropic-ai/claude-code && claude login`	your Claude subscription (or a key the CLI holds)
Codex login	`codex`	`npm i -g @openai/codex && codex login`	your ChatGPT plan (or `OPENAI_API_KEY`)
`OPENAI_API_KEY` (+ `OPENAI_BASE_URL`)	`openai-compatible`	provider console; `OPENAI_BASE_URL` for Azure, Ollama, vLLM	the provider

Auto-detection order when nothing is set: ANTHROPIC_API_KEY → claude CLI on PATH → codex CLI on PATH → OPENAI_API_KEY → fake. --dry-run and --adapter fake never need a credential.

Platform

Variable	Requirement	Used by
`SESSION_SECRET`	mandatory for `automax serve`	session cookie signing (≥ 32 characters; `openssl rand -hex 32`)
`DATABASE_URL`	mandatory when `DB_DRIVER=postgres`	Kysely Postgres dialect; SQLite needs nothing
`SQLITE_PATH`	optional	SQLite file (default `.automax/automax.db`)
`AUTOMAX_TOKEN` (+ `AUTOMAX_SERVER_URL`)	optional, free	MCP over HTTP (`/mcp`), `automax report ingest --server`; created with `automax tokens create --user <name> --scopes …`
`AUTH_DISABLED=1`	optional, development only	makes every request a local admin

Integrations (optional)

Variable	Used by
`GITHUB_TOKEN`	check runs, PR comments, issue creation (`integrations.github.tokenEnv`)
`JIRA_EMAIL` + `JIRA_API_TOKEN`	Jira issues, links, transitions (`integrations.jira.emailEnv/tokenEnv`)

Project YAML stores only the variable names; values stay in .env.<env> or the shell.

CI-only GitHub secrets

Secret	Workflow
`FIREBASE_SERVICE_ACCOUNT_AUTOMAX_DOCS`	`docs.yml`, deploys the documentation site
`NPM_TOKEN`	`release.yml`, publishes `@automax/*` (skipped when absent)
`AUTOMAX_SERVER_URL` + `AUTOMAX_TOKEN`	`ci.yml`, uploads results to a hosted AutoMax server (skipped when absent)
`DATABASE_URL`	`ci.yml` fallback ingest straight into Postgres (skipped when absent)

Checking status

bun run automax doctor            # rows cli:claude, cli:codex and a "Tokens and keys" section
bun run automax doctor --json     # { checks: [...], tokens: [{ name, requirement, present, ... }] }