Reference

Environment variables

Every environment variable SI Fabrik reads, sets for agents and hooks, or keeps to itself.

Credentials SI Fabrik reads#

Set these in Settings → Credentials or Settings → Environment on the Mac, in secrets.env on a server, or in a project's environment to override them for one project.

Name	Purpose	Reaches
`ANTHROPIC_API_KEY`	Anthropic API key for Claude Code	The agent process only
`CLAUDE_CODE_OAUTH_TOKEN`	Token from `claude setup-token`	The agent process only
`OPENAI_API_KEY`	OpenAI key for Codex	The agent process only
`HARNESS_GATEWAY_API_KEY`	Model gateway key	The agent process only
`LITELLM_API_KEY`	Gateway key (alternative name; Codex reads it from its provider config)	The agent process only
`CLICKUP_API_TOKEN`	ClickUp tracker (default for `provider.api_token`)	SI Fabrik's host-side tools only
`GITHUB_TOKEN`	GitHub tracker (default for `provider.token`)	SI Fabrik's host-side tools only
`HARNESS_GITHUB_TOKEN`	Push, PRs and cloning on GitHub	SI Fabrik's own git, through a credential helper
`HARNESS_GITLAB_TOKEN`	Push, MRs and cloning on GitLab	SI Fabrik's own git, through a credential helper
`HARNESS_CLOUDFLARE_TOKEN`	The bridge Worker's `HARNESS_BRIDGE_TOKEN`	SI Fabrik only
`GH_HOST`	GitHub Enterprise host for `gh pr create`	SI Fabrik's own `gh`

Variables set for hooks#

Name	Value
`SYMPHONY_WORKSPACE`	The workspace path (`/workspace` in a sandbox)
`SYMPHONY_WORKSPACE_KEY`	The workspace key
`SYMPHONY_WORKFLOW_DIR`	The folder of `WORKFLOW.md` (host hooks only)
`SYMPHONY_HOOK`	`after_create`, `before_run`, `after_run` or `before_remove`
`SYMPHONY_ISSUE_ID`	The task id
`SYMPHONY_ISSUE_IDENTIFIER`	The task identifier
`SYMPHONY_ISSUE_TITLE`	The task title
`SYMPHONY_ISSUE_STATE`	The task state
`SYMPHONY_ISSUE_BRANCH`	The task branch, `symphony/<key>`

Variables set for agents#

Depending on the project, agents get:

Name	When
`ANTHROPIC_BASE_URL`, `ANTHROPIC_AUTH_TOKEN` or `ANTHROPIC_API_KEY`, `ANTHROPIC_DEFAULT_OPUS_MODEL`, `ANTHROPIC_DEFAULT_SONNET_MODEL`, `ANTHROPIC_DEFAULT_HAIKU_MODEL`, `CLAUDE_CODE_SUBAGENT_MODEL`, `ANTHROPIC_CUSTOM_HEADERS`, `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`	With a model gateway (Claude Code)
`ANTHROPIC_BASE_URL` (the relay) and a placeholder in `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN` or `CLAUDE_CODE_OAUTH_TOKEN`	Claude Code in Docker or Cloudflare: the relay adds the real credential
`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, `NODE_USE_ENV_PROXY`	In Docker (allowlist and open mode)
`NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `CURL_CA_BUNDLE`, `GIT_SSL_CAINFO`, `REQUESTS_CA_BUNDLE`, `PIP_CERT`, `CARGO_HTTP_CAINFO`	In Docker: the egress proxy's CA, for the read-only hosts
`CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`, `HOME=/home/node`	In Docker
`NPM_CONFIG_USERCONFIG`	With a registry package link that has a token
Each service link's `env` name	With service links (the service's address)
Each `docker.env` name	Always, by name, except model credentials
`HARNESS_MODEL_KEY`	Codex in Docker or Cloudflare: a placeholder the relay swaps for the real key
`IS_SANDBOX=1`, `CLAUDE_CODE_DISABLE_AUTOUPDATER=1`	Set in the agent image

Variables for SI Fabrik itself#

Name	Effect
`HARNESSD_CONFIG`	`harnessd`'s configuration file when `--config` isn't given
`HARNESS_SANDBOX_SUBNET`	The Docker sandbox subnet, instead of the one chosen per data folder
`HARNESS_PREVIEW_PORT_BASE`	Fixed loopback ports for Docker previews, starting here (default: free ports Docker picks)

Variables for the test suite#

Some tests need real infrastructure and only run when you opt in:

Name	Runs
`HARNESS_DOCKER_TESTS=1`	Sandbox network policy, live browser and linked services (Docker and the images)
`HARNESS_CF_BRIDGE_URL`, `HARNESS_CF_BRIDGE_TOKEN`	The same against a deployed Cloudflare bridge
`HARNESS_LINKS_PLAYGROUND=<path>`	Checks a multi-project links playground's workflows link up

Previews use free loopback ports, so the tests, the app and a harnessd can share one Docker.