Configuration
Where every variable is read, and which zone holds it.
The control plane
Every KEYRING_* variable the api reads, with the rule it is validated by, is on the generated configuration reference. A value that fails its rule refuses to start the process, naming the variable. deploy/api/.env.example names the same set, and a CI spec fails when the two drift.
The variables that matter most:
| Variable | What it is |
|---|---|
KEYRING_APP_DATABASE_URL | The connection the api uses, as the keyring_app role, never as the schema owner. |
KEYRING_PEPPER_V1 | 32 bytes of hex. The HMAC key for the secret hash; never leaves the control plane. |
KEYRING_EMBED_SIGNING_KEY_V1 | 32 bytes of hex. Signs embed tokens; a _V2 allows a rotation. |
KEYRING_REDIS_URL | Rate-limit counters and idempotency records. Unset, in-memory stores run instead. |
KEYRING_BOOTSTRAP_TOKEN | Optional. Lets a provisioning job create a workspace with no human signed in. |
KEYRING_REVOKE_WAIT_TIMEOUT_MS | How long revoke?wait=true holds the response. 10 seconds. |
KEYRING_QUARANTINE_MS | The window a leaked live key gets. One hour. |
The data zone
The rollup worker in the data zone reads KEYRING_SMTP_HOST, KEYRING_SMTP_PORT, KEYRING_SMTP_USER and KEYRING_SMTP_PASSWORD from deploy/data/.env.example. With the host unset, every mail is rendered and logged and never sent; with it set, verification, invitation, password-reset and leaked-key mails go out. A mail rendered while SMTP was unset is marked sent and is not re-sent once SMTP is configured later.
The dashboard
Two variables: KEYRING_API_URL, fixed by the compose file to the api container over the shared network, and KEYRING_DASHBOARD_SESSION_SECRET, at least 32 characters, the input to the cookie seal. The session token itself never reaches a browser.
The SDK, in your process
| Variable | Option | What it is |
|---|---|---|
KEYRING_SECRET_KEY | secretKey | Your krsk_ secret key. Never a tenant's kr_ key. |
KEYRING_PROJECT_ID | projectId | The project this process serves. |
KEYRING_BASE_URL | baseUrl | The control plane it polls. Set it explicitly to your api domain, on the hosted product or your own. |
Everything else is an option on the client, with its default on the KeyringOptions reference: the poll interval, the staleness budget, the onUnavailable modes, the cache bound, the cache directory, telemetry.
The docs site
Nothing. It reads no variable and holds no secret.