# Connectors

> Mount brokered credentials for ClickHouse, OpenAI, Anthropic, GitHub, or Slack into a dev box without writing the real value to its disk.

URL: https://prized.dev/docs/connectors

## Connect a service [#connect-a-service]

Open **Connectors** in the dashboard, choose a provider, pick a box, and paste the credential. Prized creates an encrypted secret allowlisted to the provider's hosts and mounts it under the conventional env name. A connector is a workspace secret, so a [contractor](https://prized.dev/docs/teams#roles)'s role does not include it.

| Connector  | Default env name      | Allowed host                   |
| ---------- | --------------------- | ------------------------------ |
| ClickHouse | `CLICKHOUSE_PASSWORD` | The HTTPS endpoint you enter   |
| OpenAI     | `OPENAI_API_KEY`      | `api.openai.com`               |
| Anthropic  | `ANTHROPIC_API_KEY`   | `api.anthropic.com`            |
| GitHub     | `GITHUB_TOKEN`        | `api.github.com`, `github.com` |
| Slack      | `SLACK_BOT_TOKEN`     | `slack.com`                    |

The box sees a placeholder in that variable. The broker substitutes the real value only when an HTTPS request sends the placeholder unchanged in a header to the allowed host; plain HTTP is refused.

## ClickHouse [#clickhouse]

Enter the HTTPS endpoint (for example `https://abc.clickhouse.cloud:8443`) and the password. Keep the endpoint, username, and database in your project's normal non-secret config; the connector mounts only the password, and the secret it creates is granted to the box you picked alone: widen it from **Dashboard → Workspace → Secrets** when another box should have it.

```bash
curl -sS "$CLICKHOUSE_URL/?database=$CLICKHOUSE_DATABASE" -H "X-ClickHouse-User: $CLICKHOUSE_USER" -H "X-ClickHouse-Key: $CLICKHOUSE_PASSWORD" --data-binary 'SELECT 1'
```

## Client compatibility [#client-compatibility]

The client must send the env value unchanged in an HTTPS request header, as most bearer-token SDKs do. A client that transforms the value first (a Basic-auth base64 string, say) defeats the substitution: prefer a raw token header, or store the transformed header value as the credential when the upstream accepts it.

## Rotate or remove [#rotate-or-remove]

Connectors use the same broker as **Secrets**. Rotate or delete the credential under **Secrets**; the box's **Secrets** tab shows and removes its env binding.