Every setting in the on-disk YAML configuration can also be supplied via an AUTHPLANE_* environment variable. Env vars are evaluated after the YAML file is loaded and override matching YAML keys, making them the recommended channel for secrets and per-environment overrides (Docker -e, Kubernetes env:, systemd Environment=). See the configuration reference for the full YAML schema and the deploy guides for environment-specific examples.
| Env var | YAML key | Type | Default | Required when | Source |
|---|---|---|---|---|---|
AUTHPLANE_ADMIN_ADDRESS |
admin.address |
string |
:9001 |
— | internal/config/loader.go:545 |
AUTHPLANE_ADMIN_API_KEY |
admin.api_key |
string |
— | admin is enabled and server.issuer is not localhost | internal/config/loader.go:546 |
AUTHPLANE_ADMIN_AUDIT_DEFAULT_LOOKBACK |
admin.audit_default_lookback |
duration |
24h |
— | internal/config/loader.go:551 |
AUTHPLANE_ADMIN_AUDIT_MAX_LOOKBACK |
admin.audit_max_lookback |
duration |
720h |
— | internal/config/loader.go:556 |
AUTHPLANE_ADMIN_ENABLED |
admin.enabled |
bool |
true |
— | internal/config/loader.go:544 |
AUTHPLANE_AGENTS_ENABLE_JWKS_LISTING |
agents.enable_jwks_listing |
bool |
— | — | internal/config/loader.go:429 |
AUTHPLANE_BROKER_PROVIDER_AUTHORIZE_URL |
— | — | — | — | internal/config/loader.go:716 |
AUTHPLANE_BROKER_PROVIDER_CLIENT_ID |
— | — | — | — | internal/config/loader.go:706 |
AUTHPLANE_BROKER_PROVIDER_CLIENT_SECRET_ENV |
— | — | — | — | internal/config/loader.go:711 |
AUTHPLANE_BROKER_PROVIDER_CLIENT_SECRET_REF |
— | — | — | — | internal/config/loader.go:709 |
AUTHPLANE_BROKER_PROVIDER_DISPLAY_NAME |
— | — | — | — | internal/config/loader.go:700 |
AUTHPLANE_BROKER_PROVIDER_PROTOCOL |
— | — | — | — | internal/config/loader.go:701 |
AUTHPLANE_BROKER_PROVIDER_RESPONSE_FORMAT |
— | — | — | — | internal/config/loader.go:722 |
AUTHPLANE_BROKER_PROVIDER_SLUG |
— | — | — | — | internal/config/loader.go:693 |
AUTHPLANE_BROKER_PROVIDER_TOKEN_URL |
— | — | — | — | internal/config/loader.go:719 |
AUTHPLANE_CIMD_ALLOW_PRIVATE_ADDRESSES |
cimd.allow_private_addresses |
bool |
false |
— | internal/config/loader.go:492 |
AUTHPLANE_CIMD_CACHE_TTL |
cimd.cache_ttl |
duration |
1h |
— | internal/config/loader.go:493 |
AUTHPLANE_CIMD_ENABLED |
cimd.enabled |
bool |
true |
— | internal/config/loader.go:490 |
AUTHPLANE_CIMD_FETCH_TIMEOUT |
cimd.fetch_timeout |
duration |
10s |
— | internal/config/loader.go:494 |
AUTHPLANE_CIMD_REQUIRE_HTTPS |
cimd.require_https |
bool |
true |
— | internal/config/loader.go:491 |
AUTHPLANE_CLIENT_CREDENTIALS_ENABLED |
client_credentials.enabled |
bool |
true |
— | internal/config/loader.go:410 |
AUTHPLANE_CLIENT_CREDENTIALS_TOKEN_EXPIRY |
client_credentials.token_expiry |
duration |
1h |
— | internal/config/loader.go:411 |
AUTHPLANE_CLIENT_SECRET_PEPPER |
client_secret_pepper |
string |
— | — | internal/config/loader.go:405 |
AUTHPLANE_CONNECT_ALLOWED_RETURN_URLS |
connect.allowed_return_urls |
[]string |
— | — | internal/config/loader.go:682 |
AUTHPLANE_CONNECT_REDIRECT_BASE_URL |
connect.redirect_base_url |
string |
— | — | internal/config/loader.go:681 |
AUTHPLANE_CONNECT_STATE_SECRET |
connect.state_secret |
string |
— | — | internal/config/loader.go:680 |
AUTHPLANE_DATA_ENCRYPTION_DRIVER |
data_encryption.driver |
string |
— | — | internal/config/loader.go:433 |
AUTHPLANE_DATA_ENCRYPTION_KEY_ENV |
data_encryption.aes_master.key_env |
string |
— | — | internal/config/loader.go:434 |
AUTHPLANE_DATA_ENCRYPTION_VAULT_ADDRESS |
data_encryption.vault_transit_encrypt.address |
string |
— | driver is vault_transit_encrypt | internal/config/loader.go:435 |
AUTHPLANE_DATA_ENCRYPTION_VAULT_AUTH_METHOD |
data_encryption.vault_transit_encrypt.auth_method |
string |
— | — | internal/config/loader.go:436 |
AUTHPLANE_DATA_ENCRYPTION_VAULT_KEY_NAME |
data_encryption.vault_transit_encrypt.key_name |
string |
— | driver is vault_transit_encrypt | internal/config/loader.go:439 |
AUTHPLANE_DATA_ENCRYPTION_VAULT_MOUNT_PATH |
data_encryption.vault_transit_encrypt.mount_path |
string |
— | — | internal/config/loader.go:438 |
AUTHPLANE_DATA_ENCRYPTION_VAULT_ROLE_ID_ENV |
data_encryption.vault_transit_encrypt.approle.role_id_env |
string |
— | auth_method is approle | internal/config/loader.go:440 |
AUTHPLANE_DATA_ENCRYPTION_VAULT_SECRET_ID_ENV |
data_encryption.vault_transit_encrypt.approle.secret_id_env |
string |
— | auth_method is approle | internal/config/loader.go:441 |
AUTHPLANE_DATA_ENCRYPTION_VAULT_TOKEN_ENV |
data_encryption.vault_transit_encrypt.token_env |
string |
— | — | internal/config/loader.go:437 |
AUTHPLANE_DCR_APPROVED_REDIRECTS |
dcr.approved_redirects |
[]string |
— | — | internal/config/loader.go:482 |
AUTHPLANE_DCR_DEFAULT_REFRESH_EXPIRY |
dcr.default_refresh_expiry |
duration |
168h |
— | internal/config/loader.go:486 |
AUTHPLANE_DCR_DEFAULT_TOKEN_EXPIRY |
dcr.default_token_expiry |
duration |
15m |
— | internal/config/loader.go:485 |
AUTHPLANE_DCR_MODE |
dcr.mode |
string |
open |
— | internal/config/loader.go:481 |
AUTHPLANE_DCR_RATE_LIMIT |
dcr.rate_limit |
float64 |
10 |
— | internal/config/loader.go:483 |
AUTHPLANE_DCR_RATE_LIMIT_BURST |
dcr.rate_limit_burst |
int |
20 |
— | internal/config/loader.go:484 |
AUTHPLANE_DPOP_ENABLED |
dpop.enabled |
bool |
true |
— | internal/config/loader.go:415 |
AUTHPLANE_DPOP_NONCE_TTL |
dpop.nonce_ttl |
duration |
60s |
— | internal/config/loader.go:416 |
AUTHPLANE_DPOP_PROOF_LIFETIME |
dpop.proof_lifetime |
duration |
60s |
— | internal/config/loader.go:417 |
AUTHPLANE_DPOP_REQUIRE_NONCE |
dpop.require_nonce |
bool |
— | — | internal/config/loader.go:418 |
AUTHPLANE_LOG_ADD_SOURCE |
observability.logging.add_source |
bool |
— | — | internal/config/loader.go:592 |
AUTHPLANE_LOG_FORMAT |
observability.logging.format |
string |
json |
— | internal/config/loader.go:591 |
AUTHPLANE_LOG_LEVEL |
observability.logging.level |
string |
info |
— | internal/config/loader.go:590 |
AUTHPLANE_LOG_OTEL |
observability.logging.outputs.otel |
bool |
— | — | internal/config/loader.go:594 |
AUTHPLANE_LOG_OTEL_ENDPOINT |
observability.logging.outputs.otel_endpoint |
string |
— | logging outputs otel is enabled | internal/config/loader.go:595 |
AUTHPLANE_LOG_OTEL_INSECURE |
observability.logging.outputs.insecure |
bool |
— | — | internal/config/loader.go:596 |
AUTHPLANE_LOG_STDOUT |
observability.logging.outputs.stdout |
bool |
true |
— | internal/config/loader.go:593 |
AUTHPLANE_METRICS_INSECURE |
observability.metrics.insecure |
bool |
— | — | internal/config/loader.go:600 |
AUTHPLANE_METRICS_OTEL_ENDPOINT |
observability.metrics.otel_endpoint |
string |
— | metrics provider is otel or both | internal/config/loader.go:599 |
AUTHPLANE_METRICS_PATH |
observability.metrics.path |
string |
/metrics |
— | internal/config/loader.go:598 |
AUTHPLANE_METRICS_PROVIDER |
observability.metrics.provider |
string |
prometheus |
— | internal/config/loader.go:597 |
AUTHPLANE_OAUTH_DEFAULT_CLIENT_SCOPE |
oauth.default_client_scope |
string |
— | — | internal/config/loader.go:565 |
AUTHPLANE_OAUTH_REQUIRE_SCOPE |
oauth.require_scope |
bool |
true |
— | internal/config/loader.go:564 |
AUTHPLANE_OAUTH_STATE_MAX_AGE |
oauth.state_max_age |
duration |
10m |
— | internal/config/loader.go:568 |
AUTHPLANE_OIDC_CLIENT_ID |
oidc.client_id |
string |
— | oidc is enabled | internal/config/loader.go:579 |
AUTHPLANE_OIDC_CLIENT_SECRET |
oidc.client_secret |
string |
— | — | internal/config/loader.go:580 |
AUTHPLANE_OIDC_CONNECTOR_ID |
oidc.connector_id |
string |
— | — | internal/config/loader.go:586 |
AUTHPLANE_OIDC_DISPLAY_NAME |
oidc.display_name |
string |
— | — | internal/config/loader.go:581 |
AUTHPLANE_OIDC_ENABLED |
oidc.enabled |
bool |
— | — | internal/config/loader.go:577 |
AUTHPLANE_OIDC_INCLUDE_GROUPS_SCOPE |
oidc.include_groups_scope |
bool |
true |
— | internal/config/loader.go:585 |
AUTHPLANE_OIDC_ISSUER |
oidc.issuer |
string |
— | oidc is enabled | internal/config/loader.go:578 |
AUTHPLANE_OIDC_REDIRECT_URI |
oidc.redirect_uri |
string |
— | oidc is enabled | internal/config/loader.go:583 |
AUTHPLANE_OIDC_SCOPES |
oidc.scopes |
[]string |
— | — | internal/config/loader.go:582 |
AUTHPLANE_OIDC_SHOW_LOCAL_LOGIN |
oidc.show_local_login |
bool |
true |
— | internal/config/loader.go:584 |
AUTHPLANE_RATE_LIMIT_AUTH_FAIL_MAX |
rate_limit.auth_fail_max |
int |
10 |
— | internal/config/loader.go:537 |
AUTHPLANE_RATE_LIMIT_AUTH_FAIL_WINDOW |
rate_limit.auth_fail_window |
duration |
10m |
— | internal/config/loader.go:538 |
AUTHPLANE_RATE_LIMIT_AUTH_LOCKOUT |
rate_limit.auth_lockout |
duration |
15m |
— | internal/config/loader.go:539 |
AUTHPLANE_RATE_LIMIT_BURST |
rate_limit.burst |
int |
200 |
— | internal/config/loader.go:536 |
AUTHPLANE_RATE_LIMIT_ENABLED |
rate_limit.enabled |
bool |
true |
— | internal/config/loader.go:534 |
AUTHPLANE_RATE_LIMIT_MAX_TRACKED_IDENTITIES |
rate_limit.max_tracked_identities |
int |
250000 |
— | internal/config/loader.go:540 |
AUTHPLANE_RATE_LIMIT_RPS |
rate_limit.requests_per_second |
float64 |
100 |
— | internal/config/loader.go:535 |
AUTHPLANE_RESOURCE_SCOPES |
— | — | — | — | internal/config/loader.go:786 |
AUTHPLANE_RESOURCE_URI |
— | — | — | — | internal/config/loader.go:778 |
AUTHPLANE_SERVER_ADDRESS |
server.address |
string |
:9000 |
— | internal/config/loader.go:446 |
AUTHPLANE_SERVER_ALLOWED_ORIGINS |
server.allowed_origins |
[]string |
— | — | internal/config/loader.go:451 |
AUTHPLANE_SERVER_IDLE_TIMEOUT |
server.idle_timeout |
duration |
120s |
— | internal/config/loader.go:449 |
AUTHPLANE_SERVER_ISSUER |
server.issuer |
string |
http://localhost:9000 |
— | internal/config/loader.go:445 |
AUTHPLANE_SERVER_READ_TIMEOUT |
server.read_timeout |
duration |
30s |
— | internal/config/loader.go:447 |
AUTHPLANE_SERVER_SHUTDOWN_WAIT |
server.shutdown_wait |
duration |
10s |
— | internal/config/loader.go:450 |
AUTHPLANE_SERVER_WRITE_TIMEOUT |
server.write_timeout |
duration |
30s |
— | internal/config/loader.go:448 |
AUTHPLANE_SESSION_COOKIE_NAME |
session.cookie_name |
string |
authserver_session |
— | internal/config/loader.go:515 |
AUTHPLANE_SESSION_FAIL_CLOSED |
session.fail_closed |
bool |
true |
— | internal/config/loader.go:529 |
AUTHPLANE_SESSION_MAX_AGE |
session.max_age |
duration |
24h |
— | internal/config/loader.go:521 |
AUTHPLANE_SESSION_SAME_SITE |
session.same_site |
string |
lax |
— | internal/config/loader.go:527 |
AUTHPLANE_SESSION_SECRET |
session.secret |
string |
— | server.issuer is not localhost | internal/config/loader.go:528 |
AUTHPLANE_SESSION_SECURE |
session.secure |
bool |
false |
— | internal/config/loader.go:526 |
AUTHPLANE_SIGNING_ALGORITHM |
signing.algorithm |
string |
ES256 |
— | internal/config/loader.go:466 |
AUTHPLANE_SIGNING_KEY_PATH |
signing.key_path |
string |
data/keys |
key_store is keyfile | internal/config/loader.go:468 |
AUTHPLANE_SIGNING_KEY_STORE |
signing.key_store |
string |
keyfile |
— | internal/config/loader.go:467 |
AUTHPLANE_SIGNING_PG_ENCRYPTION_KEY_ENV |
signing.postgres_key.encryption_key_env |
string |
— | — | internal/config/loader.go:477 |
AUTHPLANE_STORAGE_DRIVER |
storage.driver |
string |
sqlite |
— | internal/config/loader.go:455 |
AUTHPLANE_STORAGE_POSTGRES_DSN |
storage.postgres.dsn |
string |
— | driver is postgres | internal/config/loader.go:458 |
AUTHPLANE_STORAGE_POSTGRES_MAX_CONNS |
storage.postgres.max_conns |
int |
25 |
— | internal/config/loader.go:459 |
AUTHPLANE_STORAGE_POSTGRES_MAX_CONN_IDLE_TIME |
storage.postgres.max_conn_idle_time |
duration |
30m |
— | internal/config/loader.go:462 |
AUTHPLANE_STORAGE_POSTGRES_MAX_CONN_LIFETIME |
storage.postgres.max_conn_lifetime |
duration |
1h |
— | internal/config/loader.go:461 |
AUTHPLANE_STORAGE_POSTGRES_MIN_CONNS |
storage.postgres.min_conns |
int |
5 |
— | internal/config/loader.go:460 |
AUTHPLANE_STORAGE_SQLITE_PATH |
storage.sqlite.path |
string |
data/authserver.db |
driver is sqlite | internal/config/loader.go:456 |
AUTHPLANE_STORAGE_SQLITE_WAL |
storage.sqlite.wal |
bool |
true |
— | internal/config/loader.go:457 |
AUTHPLANE_TOKEN_EXCHANGE_ALLOW_SELF_EXCHANGE |
token_exchange.allow_self_exchange |
bool |
— | — | internal/config/loader.go:423 |
AUTHPLANE_TOKEN_EXCHANGE_ENABLED |
token_exchange.enabled |
bool |
true |
— | internal/config/loader.go:422 |
AUTHPLANE_TOKEN_EXCHANGE_MAX_CHAIN_DEPTH |
token_exchange.max_chain_depth |
int |
5 |
— | internal/config/loader.go:424 |
AUTHPLANE_TOKEN_EXCHANGE_TOKEN_EXPIRY |
token_exchange.token_expiry |
duration |
1h |
— | internal/config/loader.go:425 |
AUTHPLANE_TRACING_ENABLED |
observability.tracing.enabled |
bool |
false |
— | internal/config/loader.go:601 |
AUTHPLANE_TRACING_ENDPOINT |
observability.tracing.endpoint |
string |
— | tracing is enabled | internal/config/loader.go:602 |
AUTHPLANE_TRACING_INSECURE |
observability.tracing.insecure |
bool |
— | — | internal/config/loader.go:603 |
AUTHPLANE_TRACING_SAMPLE_RATE |
observability.tracing.sample_rate |
float64 |
1.0 |
— | internal/config/loader.go:604 |
AUTHPLANE_VAULT_ADDR |
signing.vault_transit.address |
string |
— | key_store is vault_transit | internal/config/loader.go:469 |
AUTHPLANE_VAULT_APPROLE_MOUNT |
signing.vault_transit.approle.mount |
string |
— | — | internal/config/loader.go:476 |
AUTHPLANE_VAULT_APPROLE_ROLE_ID |
signing.vault_transit.approle.role_id |
string |
— | — | internal/config/loader.go:474 |
AUTHPLANE_VAULT_APPROLE_SECRET_ID |
signing.vault_transit.approle.secret_id |
string |
— | role_id is set | internal/config/loader.go:475 |
AUTHPLANE_VAULT_TIMEOUT |
signing.vault_transit.timeout |
duration |
10s |
— | internal/config/loader.go:473 |
AUTHPLANE_VAULT_TOKEN |
signing.vault_transit.token |
string |
— | — | internal/config/loader.go:470 |
AUTHPLANE_VAULT_TRANSIT_KEY_NAME |
signing.vault_transit.key_name |
string |
authserver-signing |
— | internal/config/loader.go:472 |
AUTHPLANE_VAULT_TRANSIT_MOUNT |
signing.vault_transit.mount |
string |
transit |
— | internal/config/loader.go:471 |
AUTHPLANE_XAA_ENABLED |
xaa.enabled |
bool |
true |
— | internal/config/loader.go:506 |
AUTHPLANE_XAA_JWKS_CACHE_TTL |
xaa.jwks_cache_ttl |
duration |
1h |
— | internal/config/loader.go:511 |
AUTHPLANE_XAA_MAX_ASSERTION_AGE |
xaa.max_assertion_age |
duration |
5m |
— | internal/config/loader.go:508 |
AUTHPLANE_XAA_REQUIRE_RESOURCE |
xaa.require_resource |
bool |
false |
— | internal/config/loader.go:509 |
AUTHPLANE_XAA_SUBJECT_MODE |
xaa.subject_mode |
string |
auto_map |
— | internal/config/loader.go:510 |
AUTHPLANE_XAA_TOKEN_EXPIRY |
xaa.token_expiry |
duration |
1h |
— | internal/config/loader.go:507 |