Connectors.
Mount brokered credentials for ClickHouse, OpenAI, Anthropic, GitHub, or Slack into a dev box without writing the real value to its disk.
Connect a service
Open Connectors in the dashboard, choose a provider, pick a box, and paste the credential. Prized creates an encrypted secret allowlisted to the provider's hosts and mounts it under the conventional env name. A connector is a workspace secret, so a contractor's role does not include it.
| Connector | Default env name | Allowed host |
|---|---|---|
| ClickHouse | CLICKHOUSE_PASSWORD | The HTTPS endpoint you enter |
| OpenAI | OPENAI_API_KEY | api.openai.com |
| Anthropic | ANTHROPIC_API_KEY | api.anthropic.com |
| GitHub | GITHUB_TOKEN | api.github.com, github.com |
| Slack | SLACK_BOT_TOKEN | slack.com |
The box sees a placeholder in that variable. The broker substitutes the real value only when an HTTPS request sends the placeholder unchanged in a header to the allowed host; plain HTTP is refused.
ClickHouse
Enter the HTTPS endpoint (for example https://abc.clickhouse.cloud:8443) and the password. Keep the endpoint, username, and database in your project's normal non-secret config; the connector mounts only the password, and the secret it creates is granted to the box you picked alone: widen it from Dashboard → Workspace → Secrets when another box should have it.
curl -sS "$CLICKHOUSE_URL/?database=$CLICKHOUSE_DATABASE" -H "X-ClickHouse-User: $CLICKHOUSE_USER" -H "X-ClickHouse-Key: $CLICKHOUSE_PASSWORD" --data-binary 'SELECT 1'Client compatibility
The client must send the env value unchanged in an HTTPS request header, as most bearer-token SDKs do. A client that transforms the value first (a Basic-auth base64 string, say) defeats the substitution: prefer a raw token header, or store the transformed header value as the credential when the upstream accepts it.
Rotate or remove
Connectors use the same broker as Secrets. Rotate or delete the credential under Secrets; the box's Secrets tab shows and removes its env binding.
Something unclear or out of date?
Credentials
Prized does not store your dev credentials. setup hands your agents' sign-ins from your machine straight to the box over the SSH tunnel; the control plane never sees them, and they stay on the box.
CLI
Every prized command, flag, and exit code, on macOS, Linux, and Windows. Add --help to any command; every non-interactive command also takes --json and prints exactly one JSON object.