Skip to main content
Every run needs a key for its harness, because model usage is charged to your account. Set one under Settings > Environment before you start your first batch. The eval API does not accept raw model keys.

​
Variables

Settings > Environment holds one table of variables and subscriptions. Choose Add variable and enter NAME=value pairs. You can paste a whole .env file into any name field, and known names autocomplete as you type. Adding a name that already exists replaces its value. Values are encrypted on arrival. A secret is never shown again, only its last four characters, such as ••••7f2a, and a short secret shows none. A plain value, such as a URL, stays readable. Names starting with SPHYNX_ are reserved.

​
Known names

Sphynx picks these up on its own. You don’t name them anywhere. A harness gets only its own key. Judge and sandbox keys stay on the server and never enter the agent’s sandbox. Without a sandbox key, trials run on Sphynx’s hosted account.

​
Subscriptions

Choose Add subscription to run a harness on a plan instead of a key. Codex uses a ChatGPT subscription over OPENAI_API_KEY when both are set. A ChatGPT subscription is not an OpenAI API key, so OpenAI judges still need OPENAI_API_KEY.

​
Your own variables

Any other name is yours. It reaches a run only when the variant’s profile names it:
profile.json
A named variable reaches the profile’s process, the install command, the case’s prepare step and code checks. A hosted batch whose profile names a variable that is not set is refused before it starts:

​
From the terminal

set prompts for the value instead of taking it as an argument, since an argument ends up in shell history and the process list. In a script, pipe it in:
See the CLI for every flag. Subscriptions are added in the dashboard.

​
Judges and simulated people

A judge that names a harness runs on that harness’s key or subscription. A judge declared with provider: "openai" needs OPENAI_API_KEY. A case that states a human needs a model to play them. openai, anthropic, google, xai, moonshotai, deepseek, groq and openrouter all serve the same chat-completions API, so the human runs on the first of their keys it finds. Provider judges call OpenAI’s responses API, which the others don’t serve, so a case scored by one needs OPENAI_API_KEY. On a self-hosted deployment, OPENAI_API_KEY in the server and worker environment works as a fallback. A missing judge key is not a startup error. The judge that needs it fails when a case reaches it, and names what was missing. Keep keys out of eval definitions and fixtures. Runs read everything they need from Settings > Environment.

​
Everyone or only me

A variable for Everyone in the organization reaches every run in it. One for Only me reaches only your runs, and overrides the organization’s value of the same name, so you can run on your own account without changing what your team uses. An API key acts for the organization, so it uses only the organization’s values.

​
Missing or removed

When the harness key is missing, the batch is refused, nothing is charged and no sandbox opens. Removing a variable leaves past runs readable. A run already holding the value finishes.