Runtime configuration

Keyring validates runtime configuration before it handles Composio traffic. Invalid values prevent the Node server from starting or make a serverless request fail with a generic configuration error.

Composio authentication

For a production Keyring connected to Composio, three values answer most onboarding questions:

AUTH_JWKS_URL=https://backend.composio.dev/.well-known/jwks.json
AUTH_ISSUER=https://backend.composio.dev
AUTH_AUDIENCE=<COMPOSIO_ORG_ID>

Find the organization ID in Composio Dashboard under Project Settings → General. Do not substitute a project ID such as pr_...; projects are enabled separately against the organization-level Keyring.

Required variables

Variable	Allowed value	Meaning
`APP_ENV`	`local`, `staging`, `production`	Security environment. Non-local modes require HTTPS JWKS/provider targets and block local/private target addresses.
`AUTH_AUDIENCE`	Non-empty string	Your Composio organization ID. Keyring requires the Composio JWT `aud` to match it exactly.
`AUTH_ISSUER`	Non-empty string	Use `https://backend.composio.dev` for the Composio production backend.
`AUTH_JWKS_URL`	URL	Use `https://backend.composio.dev/.well-known/jwks.json`. Must be public HTTPS in `staging` and `production`.
`ENCRYPTION_CONFIG`	Non-empty string	Inline JSON or, on the long-lived Node target only, a path to a JSON/YAML file. See encryption configuration.

Optional variables with defaults

Variable	Default	Validation and behavior
`AUDIT_DURABILITY`	`required`	`required` gates sensitive success responses on collector acknowledgment; `best_effort` explicitly opts out. `required` also requires `OTEL_COLLECTOR_URL`.
`AUTH_CLOCK_TOLERANCE_SECONDS`	`5`	Integer from 0–300 used for JWT time-claim clock skew.
`AUTH_JWT_ALGORITHMS`	`RS256`	Comma-separated allowlist. Keep `RS256` for Composio unless Composio explicitly announces an issuer change.
`LOG_LEVEL`	`info`	Minimum Keyring log level: `debug`, `info`, `warning`, or `error`.
`OTEL_COLLECTOR_URL`	Unset	OTLP/HTTP base URL. Keyring exports Protobuf signals to `<base>/v1/traces`, `/v1/logs`, and `/v1/metrics`.
`OTEL_COLLECTOR_HEADERS`	Unset	Comma-separated, percent-encoded `Name=value` request headers for the OTLP collector. Blank values are treated as unset.
`RUNTIME`	`node`	`node` for preferred ECS/Cloud Run deployments; `cloudflare_worker` or `vercel` only on those alternative targets.

Node-only variables

Variable	Default	Validation and behavior
`HOST`	`127.0.0.1`	Bind address: `127.0.0.1`, `0.0.0.0`, or `::1`. Containers use `0.0.0.0` internally.
`PORT`	`7464`	Integer TCP port from 1–65,535.

HOST and PORT apply to container and Node deployments. Cloudflare and Vercel own their listeners.

Provider identity variables

These variables are read only when an AWS adapter uses credential_source: runtime_environment:

Variable	Purpose
`AWS_ACCESS_KEY_ID`	Static or platform-injected access-key ID
`AWS_SECRET_ACCESS_KEY`	Matching secret access key
`AWS_SESSION_TOKEN`	Optional session token
`AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`	ECS/Fargate task-credential path
`AWS_CONTAINER_CREDENTIALS_FULL_URI`	EKS Pod Identity or compatible credential endpoint
`AWS_CONTAINER_AUTHORIZATION_TOKEN`	Optional credential-endpoint bearer token
`AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE`	Optional token file; supported only by the Node target

Resolution order is environment credentials, then a container credential endpoint. ECS/Fargate should supply the endpoint through its task role; do not set static AWS variables. EC2 IMDS and STS web identity/IRSA are intentionally unsupported.

OTLP header examples

# Spaces are percent-encoded.
OTEL_COLLECTOR_HEADERS=Authorization=Bearer%20token

# Commas and equals signs inside a value must also be encoded.
OTEL_COLLECTOR_HEADERS=Authorization=Basic%20abc%3D%3D,X-Scope=tenant%2Cproduction

Keyring rejects malformed percent encoding, invalid header names, control bytes, empty values, and attempts to override content-type.

Runtime-specific loading

Runtime	How variables are read	Encryption config formats
Node/Docker/Helm	`process.env` at startup	Inline JSON, `.json`, `.yaml`, or `.yml` file path
Cloudflare Worker	Worker bindings per request/cold load	Inline JSON only
Vercel	Project environment at function initialization and request cold load	Inline JSON only

On Cloud Run, PORT is injected by the platform and Keyring reads it automatically. Set HOST=0.0.0.0. On ECS, set HOST=0.0.0.0 and PORT=7464 in the task definition.

Do not put secret values in wrangler.jsonc, a committed .env, Helm values stored in Git, or a container image layer. Use the deployment platform’s secret mechanism.

Get started

How Keyring works

Security

Deploy

Configure

Operate

Runtime configuration

Composio authentication

Required variables

Optional variables with defaults

Node-only variables

Provider identity variables

OTLP header examples

Runtime-specific loading

​Composio authentication

​Required variables

​Optional variables with defaults

​Node-only variables

​Provider identity variables

​OTLP header examples

​Runtime-specific loading

Composio authentication

Required variables

Optional variables with defaults

Node-only variables

Provider identity variables

OTLP header examples

Runtime-specific loading