Environment variables

API

• DATABASE_URL
• BETTER_AUTH_SECRET
• MANIFEST_KEY_ENC_KEY_HEX
• WORKER_API_TOKEN
• FX_BASE_URL
• FX_TRUSTED_ORIGINS
• DATABRICKS_HOST
• DATABRICKS_HTTP_PATH
• DATABRICKS_TOKEN
• DATABRICKS_CATALOG
• DATABRICKS_SCHEMA

For secretless test workloads, replace a PAT or client secret with Databricks OAuth token federation:

• DATABRICKS_AUTH_TYPE=env-oidc and DATABRICKS_OIDC_TOKEN_ENV (defaults to DATABRICKS_OIDC_TOKEN), or
• DATABRICKS_AUTH_TYPE=file-oidc and DATABRICKS_OIDC_TOKEN_FILEPATH.

Set DATABRICKS_CLIENT_ID for service-principal workload federation. The runner exchanges the short-lived IdP JWT at the workspace token endpoint and caches only the resulting short-lived Databricks token.

Studio

• FX_API_BASE_URL
• NEXT_PUBLIC_FX_API_BASE_URL

CLI hosted mode

Used by fx login, fx push, hosted fx preview, and fx test publish.

Interactive developers should prefer fx login; these variables are primarily for CI and ephemeral containers.

• FX_API_URL — hosted API base URL. Do not hard-code a Databricks Apps deployment hostname in developer documentation; fx login discovers it from https://studio.experiments.fabric.pro.
• FX_API_KEY — org API key created in Studio settings.
• FX_ORG_ID — immutable organization ID used as the hosted API tenant scope; do not use the display name or slug.
• FX_GATEWAY_BEARER_TOKEN — optional already-exchanged Databricks Apps token.
• FX_QUALITY_DATABRICKS_CLIENT_ID / FX_QUALITY_DATABRICKS_CLIENT_SECRET — recommended service-principal credentials for automatic Apps gateway exchange.

Equivalent flags:

fx push experiments/ --api-url "$FX_API_URL" --api-key "$FX_API_KEY" --tenant "$FX_ORG_ID"

Profiles are stored under the platform configuration directory ($XDG_CONFIG_HOME/fx on Linux, the standard application-data directory on Windows, or ~/.config/fx as the Linux fallback). Override only for automation or tests with FX_CONFIG_DIR.

Cloudflare manifest worker

• HMAC_SECRET — preferred /admin/publish auth; signs the request body with a timestamp + nonce.
• ADMIN_TOKEN — bearer-token fallback used when HMAC_SECRET is unset. Requests still require anti-replay headers (x-fx-timestamp, x-fx-nonce).
• ADMIN_TOKEN_TENANT — optional; confines an ADMIN_TOKEN publish to a single tenant (rejects others with 403).
• API_ORIGIN
• DEFAULT_TENANT — optional single-tenant compatibility alias. Leave unset on shared workers; a wrong value can cross-route manifests.

Provider tenant registration stores tenant-auth/{tenantId}/manifest-hmac and the SHA-256 digest of the customer's delivery token in the manifest KV. These are registered data records, not Worker environment variables. Customer workspaces never receive HMAC_SECRET or ADMIN_TOKEN.

Cloudflare exposure worker

• DEFAULT_TENANT — optional single-tenant compatibility alias. Leave unset on shared workers; a wrong value can cross-route telemetry.
• FLUSH_INTERVAL_MS
• MAX_BATCH_SIZE
• TENANT_AUTH — KV binding shared with the manifest worker's tenant registry; used only to validate tenant delivery tokens.

Audit export worker

• API_BASE_URL
• WORKER_API_TOKEN

Harness worker

• FX_HARNESS_RUNTIME
• TEMPORAL_ADDRESS
• TEMPORAL_NAMESPACE
• FX_API_BASE_URL
• FX_API_KEY
• WORKER_API_TOKEN
• FX_ORG_IDS
• FX_AGENT_CONTROL_PLANE
• FX_HARNESS_WORKER_BUILD_ID
• FX_DATABRICKS_APP_AUTH
• FX_DATABRICKS_APP_BASE_URL
• FX_AGENT_SERVICES_RECONCILE — set to 1 only on the eval worker that should reconcile signed customer-agent Unity Catalog Agent Service requests.
• FX_AGENT_SERVICES_RECONCILE_INTERVAL_MS — optional polling interval; defaults to 30 seconds.

WORKER_API_TOKEN authenticates the worker process but never selects an organization. FX_API_KEY must be write-scoped and binds all Harness control operations to exactly one organization. Deploy a separate worker and key per organization; cross-tenant and multi-tenant requests fail closed.

The reconciler uses the worker's DATABRICKS_* identity. It never accepts a public key from the enrollment request and never takes over an existing Agent Service whose connection or base path differs from the signed manifest.

Databricks workload certification

All live target packs use DBX_TEST_LIVE=1, DBX_TEST_PROFILE=live, workspace authentication, and a SQL warehouse. The advanced packs add these fixture bindings:

• MLflow 3 and AI Search: DBX_TEST_MLFLOW3_JOB_ID, DBX_TEST_MLFLOW3_TRACE_ASSERTION_SQL, DBX_TEST_MLFLOW3_EVAL_ASSERTION_SQL, DBX_TEST_MLFLOW3_SCORER_ASSERTION_SQL, DBX_TEST_MLFLOW3_MONITOR_ASSERTION_SQL, DBX_TEST_MLFLOW3_TIMEOUT_MS (defaults to two hours), and DBX_TEST_AI_SEARCH_EVAL_ASSERTION_SQL. Fixture provisioning accepts DBX_MLFLOW3_RUN_AS_SERVICE_PRINCIPAL and DBX_MLFLOW3_SCORER_MODEL; the latter falls back to databricks:/<DBX_TEST_SERVING_ENDPOINT> when that shared endpoint is configured. The notebook also accepts DATABRICKS_MLFLOW3_SCORER_MODEL for direct runs.
• Managed MCP and UC MCP Services: DBX_TEST_MCP_JOB_ID, DBX_TEST_MCP_MANAGED_ASSERTION_SQL, DBX_TEST_MCP_SERVICE_ASSERTION_SQL, and DBX_TEST_MCP_DENY_ASSERTION_SQL. Fixture provisioning accepts DBX_MCP_RUN_AS_SERVICE_PRINCIPAL plus the DATABRICKS_MCP_{MANAGED_SERVER,SERVICE,MANAGED_TOOL,SERVICE_ALLOWED_TOOL,SERVICE_DENIED_TOOL,EVIDENCE_TABLE} overrides.
• Data Quality Monitoring and Databricks Apps OpenTelemetry: DBX_TEST_TELEMETRY_APP_NAME, DBX_TEST_DQM_ASSERTION_SQL, DBX_TEST_APP_LOGS_ASSERTION_SQL, DBX_TEST_APP_SPANS_ASSERTION_SQL, and DBX_TEST_APP_METRICS_ASSERTION_SQL.
• Customer agent enrollment: DBX_TEST_AGENT_SERVICE_FULL_NAME, DBX_TEST_AGENT_SERVICE_CONNECTION, and DBX_TEST_AGENT_SERVICE_EXECUTE_PRINCIPAL.
• End-to-end agent evaluation: DBX_TEST_AGENT_EVAL_E2E_JOB_ID and DBX_TEST_AGENT_EVAL_ASSERTION_SQL. Fixture provisioning accepts DBX_AGENT_EVAL_RUN_AS_SERVICE_PRINCIPAL and the FX_AGENT_EVAL_{API_BASE_URL,SECRET_SCOPE,API_KEY_SECRET,DATASET_ID,SCORES_TABLE,EVIDENCE_TABLE} overrides.

The fixture Jobs must execute the native Databricks APIs; the SQL expressions must return a single truthy cell containing durable evidence. A successful Job without its corresponding assertions fails certification. See the Databricks support matrix for the release status of each workload.

Live smokes

• FX_LIVE_TEST
• FX_LIVE_API_BASE_URL
• FX_LIVE_API_KEY
• FX_LIVE_ORG_ID
• FX_LIVE_EXPERIMENT_ID
• FX_LIVE_WORKER_TOKEN