Tokens and keys
Every credential SDODS can use, what it unlocks, and whether it is mandatory.
Which environment variables and CLI logins SDODS reads, what each one enables, and the exact
requirement level. Run sdods doctor for the same table with live status.
Nothing is mandatory for the platform itself: running suites, screenshots, HAR replay, SQLite, the MCP server over stdio, sdods analyze, lint, reports and the dashboard all work with no credential at all. SDODS's own API tokens are self-issued and free.
Requirement levels
| Level | Meaning |
|---|---|
| mandatory | required only when the feature next to it is used |
| one-of | agents need any one of the rows in the group |
| optional | turns on an integration |
Agents (one-of)
| Credential | Adapter | How to get it | Billing |
|---|---|---|---|
ANTHROPIC_API_KEY | claude | console.anthropic.com | Anthropic, per token |
| Claude Code login | claude-code | npm i -g @anthropic-ai/claude-code && claude login | your Claude subscription (or a key the CLI holds) |
| Codex login | codex | npm i -g @openai/codex && codex login | your ChatGPT plan (or OPENAI_API_KEY) |
OPENAI_API_KEY (+ OPENAI_BASE_URL) | openai-compatible | provider console; OPENAI_BASE_URL for Azure, vLLM, LM Studio | the provider |
| nothing | ollama | ollama serve && ollama pull qwen2.5-coder:7b | nothing — the model runs on your machine |
Auto-detection order when nothing is set: ANTHROPIC_API_KEY → claude CLI on PATH → codex CLI on PATH → OPENAI_API_KEY → a local Ollama → fake. --dry-run and --adapter fake never need a credential.
Platform
| Variable | Requirement | Used by |
|---|---|---|
SESSION_SECRET | mandatory for sdods serve | session cookie signing (≥ 32 characters; openssl rand -hex 32) |
DATABASE_URL | mandatory when DB_DRIVER=postgres | Kysely Postgres dialect; SQLite needs nothing |
SQLITE_PATH | optional | SQLite file (default .sdods/sdods.db) |
SDODS_TOKEN (+ SDODS_SERVER_URL) | optional, free | MCP over HTTP (/mcp), sdods report ingest --server; created with sdods tokens create --user <name> --scopes … |
AUTH_DISABLED=1 | optional, development only | makes every request a local admin |
Integrations (optional)
| Variable | Used by |
|---|---|
GITHUB_TOKEN | check runs, PR comments, issue creation (integrations.github.tokenEnv) |
JIRA_EMAIL + JIRA_API_TOKEN | Jira issues, links, transitions (integrations.jira.emailEnv/tokenEnv) |
Project YAML stores only the variable names; values stay in .env.<env> or the shell.
Uploading results from CI
To send results from a pipeline to a hosted SDODS server, set SDODS_SERVER_URL and SDODS_TOKEN
as CI secrets (created with sdods tokens create). Without them the upload step is skipped.
Checking status
bun run sdods doctor # rows cli:claude, cli:codex and a "Tokens and keys" section
bun run sdods doctor --json # { checks: [...], tokens: [{ name, requirement, present, ... }] }