Auth Service Configuration
Configuration areas and environment variables for Auth Service.
Auth Service configuration is supplied through deployment values and customer secrets. Keep environment-specific values out of product documentation and store them in the customer’s approved secret system.
Configuration Areas
- Identity provider mode and provider metadata.
- Token validation and signing settings.
- Platform database connection for membership, API keys, service accounts, and key metadata.
- Key-management provider for DID and signing workflows.
- API key and service-account secret policy.
- Public service URLs used by Guardian and other platform services.
- Health, readiness, and operational settings.
Environment Variables
The main variables Auth Service reads, by category:
| Category | Variable | Default |
|---|---|---|
| Server | PORT | 8080 |
| Server | HOST | localhost, so only loopback is reachable; the chart sets 0.0.0.0 |
| Server | AUTH_SERVICE_URL | http://localhost:8080/api/v1/auth; issuer of exchanged tokens, and must be reachable from Auth Service itself |
| Server | ENVIRONMENT | development |
| Server | CORS_ENABLED | false |
| Identity | IDP_PROVIDER | none, required: keycloak, entra, auth0, or generic |
| Identity | IDP_ISSUER | none, required; derived from IDP_AUTH0_DOMAIN (Auth0) or IDP_ENTRA_TENANT_ID (Microsoft Entra) when unset |
| Identity | IDP_CLIENT_ID | none, required |
| Identity | IDP_CLIENT_SECRET | none |
| Identity | IDP_SCOPES | openid,profile,email |
| Identity | IDP_HTTP_TIMEOUT | 30s |
| Database | DATABASE_URL | built from DB_* |
| Database | DB_HOST / DB_PORT | localhost / 5432 |
| Database | DB_USER / DB_PASSWORD | postgres / none |
| Database | DB_NAME | authservice; the chart sets governance |
| Database | DB_SSLMODE | disable |
| Database | MIGRATIONS_RUN_AT_STARTUP | true |
| Security | API_SECRET | none, required |
| Security | JWT_SECRET | none |
| Security | SERVICE_ACCOUNT_ENCRYPTION_KEY | falls back to JWT_SECRET; one of the two is required |
| Tokens | AUTH_SERVICE_PRIVATE_KEY | none; PEM RSA key that signs exchanged tokens |
| Tokens | AUTH_SERVICE_KEY_ID | generated; set it alongside AUTH_SERVICE_PRIVATE_KEY, or each start uses a new ID |
| Tokens | AUTH_SERVICE_KEY_PATH | /tmp/auth-service-key.pem |
| Tokens | ACCESS_TOKEN_EXPIRY_SECONDS | 3600, at most 86400 |
| Tokens | REFRESH_TOKEN_EXPIRY_DAYS | 30 |
| Tokens | REFRESH_TOKEN_ROTATION | true |
| Tokens | REFRESH_TOKEN_REUSE_WINDOW | 30 seconds |
| Tokens | REFRESH_TOKEN_MAX_CHAIN_LENGTH | 100 |
| Tokens | REFRESH_TOKEN_BIND_TO_IP | false |
| Key management | KEY_MANAGEMENT_PROVIDER | azure_key_vault |
| Key management | DID_KEY_ALGORITHM | secp256k1 |
| Key management | DID_KEY_CACHE_TTL_MINUTES | 15 |
| Key management | OPENBAO_REQUEST_TIMEOUT | 5s |
| Logging | LOG_LEVEL | info |
| Logging | LOGGER_SKIP_PATHS | /health |
Provider Alignment
Guardian and all backend services must agree on the identity provider mode. A mismatch can allow sign-in to succeed while platform authorization fails.
Production Guidance
Use managed keys, production identity-provider tenants, production-grade storage, and customer-approved secrets. Local or mock providers are for development and test environments only.
Related
- Identity Providers — provider modes and the operator checklist
- Key Configuration — key-management providers and OpenBao requirements
- Authentication — choosing an identity provider and its setup guide
- Chart Values — where these settings live in values.yaml and secrets.yaml
- Auth Service Operations — first checks when configuration breaks sign-in or signing