Checkov

Record your Checkov connection as infrastructure evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Checkov:

   1. Checkov itself is an open-source CLI and issues no API token; it uses a Prisma Cloud access key (passed as --bc-api-key or the BC_API_KEY environment variable).
   2. Sign in to Prisma Cloud as a System Admin, or as an administrator whose role has API access enabled (by default only the System Admin has API access).
   3. Go to Settings › Access Control › Access Keys and select Add › Access Key.
   4. Enter a descriptive Name for the key.
   5. Optionally select Key Expiry and set a date and time (unchecked means the key never expires).
   6. Click Create.
   7. Copy or download the Access Key ID and Secret Key as CSV; after you close the window you cannot view the secret key again.
   8. Combine the two values as access_key_id::secret_key when pasting the token.

   Where to find the other values:

   • Base URL (optional): The Prisma Cloud API URL for your tenant (Checkov's --prisma-api-url), which must be a *.prismacloud.io, *.prismacloud.cn or *.bridgecrew.cloud domain.
   • Account / Org / Workspace (optional): Checkov's --repo-id uses the form repo_owner/repo_name.

   Checkov shows the secret only once, so copy it before you leave the page.

   Checkov's public documentation does not cover every step.

   Checkov results reach a platform only through Prisma Cloud (formerly Bridgecrew). Prisma Cloud does not document a read-only role for access keys; access follows the creating administrator's role. Using the Account/Org field for repo_id is an interpretation, not a vendor statement.

   Source: checkov.io, docs.prismacloud.io, docs.prismacloud.io, checked 2026-10-07.

2. On Compliance › Connectors, open Checkov, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Checkov yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks