SAService Architect Back to designer
SAService ArchitectDocumentation
Codex & MCPValidation and Security
Codex integration guide

Credentials and trust boundaries

Most MCP operations are local; only generated code requests require a Service Architect API credential.

When to use

Review these boundaries before enabling the plugin in a repository or CI environment.

Behavior

  • Inspection, cached resource reads, validation, and YAML export operate locally.
  • Capability and validation contracts are public read-only metadata and are fetched only through explicit refresh tools.
  • Code generation uses the configured Service Architect API key and returns a short-lived ZIP artifact.
  • The API key is sent only to the Service Architect API and is never forwarded to the presigned artifact URL.

Environment properties

Preferred generation configuration.

PropertyTypeDescription
SERVICE_ARCHITECT_API_KEYSecret

Personal revocable key used for asynchronous generation jobs.

SERVICE_ARCHITECT_API_URLConfiguration

Selected beta or production API root.

.envLocal file

Optional ignored development configuration loaded by the Python client.

Example

SERVICE_ARCHITECT_API_KEY=sa_live_...
SERVICE_ARCHITECT_API_URL=https://<api-id>.execute-api.<region>.amazonaws.com/production