Environment variables
A small set of environment variables control how the CLI authenticates and which Claude Code executable the runner uses. They are most useful in CI and on locked-down machines.
Variables
| Variable | Effect |
|---|---|
ANTHROPIC_API_KEY | Your Anthropic API key. Used when a run is started with --use-api-key, so the runner bills agent work to your own Anthropic account rather than your Claude subscription. |
PIPEMASON_CLAUDE_PATH | Absolute path to the Claude Code executable the runner should invoke. Override this when Claude Code is installed somewhere off your PATH, or to pin a specific build. |
CURSOR_API_KEY | Your Cursor API key. Required when running with --provider cursor; inference and billing run through your Cursor account. Read from the environment and never sent to our cloud. |
PIPEMASON_NO_UPDATE_CHECK | Set to any value to disable the automatic update check that runs on each invocation. Equivalent to passing --no-update-check on every command. |
ANTHROPIC_API_KEY
Set this when you want to run with the --use-api-key flag. The runner reads the key from the environment and uses it for agent execution.
export ANTHROPIC_API_KEY="sk-ant-..." pipemason start "add a /healthz endpoint" --use-api-key
PIPEMASON_CLAUDE_PATH
Point the runner at a specific Claude Code executable. Useful when the binary lives outside your PATH or you maintain several installs.
export PIPEMASON_CLAUDE_PATH="/opt/claude/bin/claude" pipemason start "..."
CURSOR_API_KEY
Required when you select the Cursor backend with --provider cursor (or provider: cursor in config). The runner reads it from the environment and uses it with Cursor's cursor-agent CLI; all inference and billing run through your Cursor account, not a BYO Anthropic key. Run pipemason doctor to verify it is set.
export CURSOR_API_KEY="..." pipemason start "add a /healthz endpoint" --provider cursor
PIPEMASON_NO_UPDATE_CHECK
On every invocation the CLI checks (at most once a day) whether a newer pipemason version is available and, if so, offers to update. The check is fail-open and only prompts in an interactive terminal, so it never blocks CI or scheduled runs. Set this variable to disable it entirely; use --no-update-check to skip a single run. (PIPEMASON_FORCE_UPDATE_CHECK=1 bypasses the once-a-day throttle.)
export PIPEMASON_NO_UPDATE_CHECK=1
Credentials
Account credentials are not configured through environment variables. After you pair a runner with pipemason login, the resulting token is written to ~/.pipemason/credentials.json. That file stays on your machine; the cloud only stores a hash of the token.
Note
~/.pipemason/credentials.json out of version control and shared images. To rotate the token, run pipemason login again.