config
Environment variables
The runner reads a small set of env vars at startup. None of them leave your machine — the cloud control plane never sees your Anthropic key.
Required
| Variable | Purpose |
|---|---|
ANTHROPIC_API_KEY | BYO Claude API key. The runner reads it once per invocation and forwards on each agent call. Format: sk-ant-… |
Optional
| Variable | Default | Purpose |
|---|---|---|
PIPEMASON_API_BASE | https://api.pipemason.com | Override the control-plane URL. Useful for staging. |
PIPEMASON_WS_BASE | wss://api.pipemason.com | Override the live-update WS base. |
PIPEMASON_RUNNER_DIR | ~/.pipemason | Runner cache + credentials directory. |
PIPEMASON_LOG_LEVEL | info | debug | info | warn | error. |
ANTHROPIC_MODEL_OVERRIDE | (none) | Force every phase to use this model. Overrides config.yml model tiering. Use with care — defeats cost control. |
Where to set them
Most users put ANTHROPIC_API_KEY in their shell profile (~/.zshrc, ~/.bashrc) or a secret manager (1Password CLI, direnv, doppler). The runner inherits whatever's in the env when you invoke it.
# Common pattern: 1Password CLI export ANTHROPIC_API_KEY="$(op read 'op://Personal/Anthropic API Key/credential')" # Or just a hardcoded export (dev only) export ANTHROPIC_API_KEY="sk-ant-…"
Heads-up
Never commit
ANTHROPIC_API_KEY to git. The runner has no way to redact it from iterations.log if it leaks into a tool call.