---
title: "Auth Service Configuration"
description: "Configuration areas and environment variables for Auth Service."
source: "Guardian Platform"
---
Auth Service configuration is supplied through deployment values and customer secrets. Keep environment-specific values out of product documentation and store them in the customer's approved secret system.

## Configuration Areas

- Identity provider mode and provider metadata.
- Token validation and signing settings.
- Platform database connection for membership, API keys, service accounts, and key metadata.
- Key-management provider for DID and signing workflows.
- API key and service-account secret policy.
- Public service URLs used by Guardian and other platform services.
- Health, readiness, and operational settings.

## Environment Variables

The main variables Auth Service reads, by category:

| Category       | Variable                         | Default                                                                                                         |
| -------------- | -------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Server         | `PORT`                           | `8080`                                                                                                          |
| Server         | `HOST`                           | `localhost`, so only loopback is reachable; the chart sets `0.0.0.0`                                            |
| Server         | `AUTH_SERVICE_URL`               | `http://localhost:8080/api/v1/auth`; issuer of exchanged tokens, and must be reachable from Auth Service itself |
| Server         | `ENVIRONMENT`                    | `development`                                                                                                   |
| Server         | `CORS_ENABLED`                   | `false`                                                                                                         |
| Identity       | `IDP_PROVIDER`                   | none, required: `keycloak`, `entra`, `auth0`, or `generic`                                                      |
| Identity       | `IDP_ISSUER`                     | none, required; derived from `IDP_AUTH0_DOMAIN` (Auth0) or `IDP_ENTRA_TENANT_ID` (Microsoft Entra) when unset   |
| Identity       | `IDP_CLIENT_ID`                  | none, required                                                                                                  |
| Identity       | `IDP_CLIENT_SECRET`              | none                                                                                                            |
| Identity       | `IDP_SCOPES`                     | `openid,profile,email`                                                                                          |
| Identity       | `IDP_HTTP_TIMEOUT`               | `30s`                                                                                                           |
| Database       | `DATABASE_URL`                   | built from `DB_*`                                                                                               |
| Database       | `DB_HOST` / `DB_PORT`            | `localhost` / `5432`                                                                                            |
| Database       | `DB_USER` / `DB_PASSWORD`        | `postgres` / none                                                                                               |
| Database       | `DB_NAME`                        | `authservice`; the chart sets `governance`                                                                      |
| Database       | `DB_SSLMODE`                     | `disable`                                                                                                       |
| Database       | `MIGRATIONS_RUN_AT_STARTUP`      | `true`                                                                                                          |
| Security       | `API_SECRET`                     | none, required                                                                                                  |
| Security       | `JWT_SECRET`                     | none                                                                                                            |
| Security       | `SERVICE_ACCOUNT_ENCRYPTION_KEY` | falls back to `JWT_SECRET`; one of the two is required                                                          |
| Tokens         | `AUTH_SERVICE_PRIVATE_KEY`       | none; PEM RSA key that signs exchanged tokens                                                                   |
| Tokens         | `AUTH_SERVICE_KEY_ID`            | generated; set it alongside `AUTH_SERVICE_PRIVATE_KEY`, or each start uses a new ID                             |
| Tokens         | `AUTH_SERVICE_KEY_PATH`          | `/tmp/auth-service-key.pem`                                                                                     |
| Tokens         | `ACCESS_TOKEN_EXPIRY_SECONDS`    | `3600`, at most `86400`                                                                                         |
| Tokens         | `REFRESH_TOKEN_EXPIRY_DAYS`      | `30`                                                                                                            |
| Tokens         | `REFRESH_TOKEN_ROTATION`         | `true`                                                                                                          |
| Tokens         | `REFRESH_TOKEN_REUSE_WINDOW`     | `30` seconds                                                                                                    |
| Tokens         | `REFRESH_TOKEN_MAX_CHAIN_LENGTH` | `100`                                                                                                           |
| Tokens         | `REFRESH_TOKEN_BIND_TO_IP`       | `false`                                                                                                         |
| Key management | `KEY_MANAGEMENT_PROVIDER`        | `azure_key_vault`                                                                                               |
| Key management | `DID_KEY_ALGORITHM`              | `secp256k1`                                                                                                     |
| Key management | `DID_KEY_CACHE_TTL_MINUTES`      | `15`                                                                                                            |
| Key management | `OPENBAO_REQUEST_TIMEOUT`        | `5s`                                                                                                            |
| Logging        | `LOG_LEVEL`                      | `info`                                                                                                          |
| Logging        | `LOGGER_SKIP_PATHS`              | `/health`                                                                                                       |

## Provider Alignment

Guardian and all backend services must agree on the identity provider mode. A mismatch can allow sign-in to succeed while platform authorization fails.

## Production Guidance

Use managed keys, production identity-provider tenants, production-grade storage, and customer-approved secrets. Local or mock providers are for development and test environments only.

## Related

- [Identity Providers](./identity-providers.mdx) — provider modes and the operator checklist
- [Key Configuration](./key-configuration.mdx) — key-management providers and OpenBao requirements
- [Authentication](../deployment/authentication.mdx) — choosing an identity provider and its setup guide
- [Chart Values](../deployment/chart-values.mdx) — where these settings live in values.yaml and secrets.yaml
- [Auth Service Operations](./operations.mdx) — first checks when configuration breaks sign-in or signing