Settings
Provider selection and server-side configuration presence. Secret values are never rendered.
Runtime Credentials
Server credentials are used for downstream calls. A browser-session PlatPhorm key authenticates explicit operator actions when no Authorization header is present.
Downstream PlatPhorm credential is present server-side; browser operator auth is still explicit.
Used for model routing checks, future gateway-backed model calls.
Used for future sandbox job creation when server OIDC is unavailable.
{
"ok": true,
"data": {
"credentials": [
{
"id": "platform",
"label": "PlatPhorm API key",
"envName": "PLATPHORM_API_KEY",
"envAliases": [],
"runtimeHeader": "x-pentest-runtime-platform-key",
"serverConfigured": true,
"runtimeProvided": false,
"acceptedFor": [
"real-run setup",
"protected integration previews",
"downstream PlatPhorm handoff"
],
"rawValueExposed": false
},
{
"id": "aiGateway",
"label": "Vercel AI Gateway key",
"envName": "AI_GATEWAY_API_KEY",
"envAliases": [
"VERCEL_AI"
],
"runtimeHeader": "x-pentest-runtime-ai-gateway-key",
"serverConfigured": true,
"runtimeProvided": false,
"acceptedFor": [
"model routing checks",
"future gateway-backed model calls"
],
"rawValueExposed": false
},
{
"id": "anthropic",
"label": "Anthropic API key",
"envName": "ANTHROPIC_API_KEY",
"envAliases": [],
"runtimeHeader": "x-pentest-runtime-anthropic-key",
"serverConfigured": false,
"runtimeProvided": false,
"acceptedFor": [
"future direct Anthropic model calls"
],
"rawValueExposed": false
},
{
"id": "openai",
"label": "OpenAI API key",
"envName": "OPENAI_API_KEY",
"envAliases": [],
"runtimeHeader": "x-pentest-runtime-openai-key",
"serverConfigured": false,
"runtimeProvided": false,
"acceptedFor": [
"future direct OpenAI model calls"
],
"rawValueExposed": false
},
{
"id": "vercel",
"label": "Vercel token",
"envName": "VERCEL_TOKEN",
"envAliases": [],
"runtimeHeader": "x-pentest-runtime-vercel-token",
"serverConfigured": true,
"runtimeProvided": false,
"acceptedFor": [
"future sandbox job creation when server OIDC is unavailable"
],
"rawValueExposed": false
}
]
}
}PlatPhorm exposes 22 configured platform service surfaces.
Current production target. Keep provider-specific behavior behind adapters and config.
Primary persistent backend for run, finding, scorecard, event, and audit state.
Local function state remains honest and ephemeral; protected artifact upload can hand off to PlatPhorm Files.
Selected platform handoff target for replay, schema validation, and safe execution workflows.
Current webhook receiver/delivery surface for the Next.js app.
Current provider-neutral model gateway for Vercel-hosted and local pulled environments. VERCEL_AI is accepted as the deployed PlatPhorm alias for AI_GATEWAY_API_KEY presence.