> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sphynx.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Connections

> The credentials your evals use

Every run needs a credential for its [harness](/evals/variants), because model usage is charged to your account. Add one under **Settings > Harnesses** before you start your first batch. The eval API does not accept raw model keys.

| Surface | Credential |
| - | - |
| Sphynx CLI and SDK | `SPHYNX_API_KEY` |
| Harness | Saved harness connection |
| Hosted sandbox | None. Uses Sphynx's account unless you add your own |
| Judge that calls a provider, or a simulated user | Saved model connection |
| Mock product MCP or CLI | None |
| [Sphynx MCP](/tools/mcp) | OAuth 2.1 |

## Add a connection

Choose **Add harness**, **Add provider** or **Add sandbox**, pick the integration and paste the key. Secrets are encrypted on arrival and never shown again. The [variants](/evals/variants) page lists the harnesses and sandboxes you can connect.

The first connection for an integration becomes its default. **Check it works** tests a stored credential without revealing it.

## From the terminal

```bash theme={null}
sphynx connectors integrations
sphynx connectors add codex
sphynx connectors list
```

`add` prompts for the secret instead of taking it as a flag, since a flag ends up in shell history and the process list. In a script, pipe it in:

```bash theme={null}
echo "$OPENAI_API_KEY" | sphynx connectors add codex --name ci
```

`--auth` picks the method when an integration accepts more than one. `--default` makes the new connection the one runs use. Methods that sign in through a browser, such as ChatGPT for Codex, can't be completed from the terminal, and the command says so.

`sphynx connectors remove <id>` deletes a connection. A run already holding the credential finishes.

## Judges and simulated users

A [judge](/evals/judges) that names a `harness` runs an agent with that harness connection. A judge declared with `provider: "openai"` needs an OpenAI model connection instead. Add it under **Settings > Models**.

A case that states a [human](/evals/conversations) needs a model to play them. `openai`, `anthropic`, `google`, `xai`, `moonshotai`, `deepseek`, `groq` and `openrouter` all serve the same chat-completions API, so the human runs on whichever you connected first. Provider judges call OpenAI's responses API, which the others don't serve, so a case scored by one needs `openai`.

On a self-hosted deployment, set `OPENAI_API_KEY` in the server and worker environment instead.

A missing model credential is not a startup error. The judge that needs it fails when a case reaches it, and names what was missing.

A ChatGPT subscription is not an OpenAI API key.

Keep credentials out of eval definitions and fixtures. Runs resolve everything they need from stored connections.

## Personal or shared

Organization connections are available to everyone. Personal ones (**Only me**) are yours alone and take precedence for the same integration, so you can run on your own account without changing what your team uses.

## Missing, rotated, removed

```text theme={null}
No credential configured for codex
```

When the harness credential is missing, nothing is charged and no sandbox opens. In the dashboard the run button stays disabled and names what is missing. A missing sandbox connection is not an error.

**Rotate secret** replaces the secret in place, keeps the id and default, and reactivates an `invalid` credential.

Removing a connection leaves past runs readable. Removing a default leaves the integration without one, so set another before your next batch.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.