> ## Documentation Index > Fetch the complete documentation index at: https://keyring.docs.composio.dev/llms.txt > Use this file to discover all available pages before exploring further. # Runtime configuration > Reference for every environment variable, its default, validation, and runtime scope. Keyring validates runtime configuration before it handles Composio traffic. Invalid values prevent the Node server from starting or make a serverless request fail with a generic configuration error. ## Composio authentication For a production Keyring connected to Composio, three values answer most onboarding questions: ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} AUTH_JWKS_URL=https://backend.composio.dev/.well-known/jwks.json AUTH_ISSUER=https://backend.composio.dev AUTH_AUDIENCE= ``` Find the organization ID in [Composio Dashboard](https://dashboard.composio.dev/) under **Project Settings → General**. Do not substitute a project ID such as `pr_...`; projects are enabled separately against the organization-level Keyring. ## Required variables | Variable | Allowed value | Meaning | | ------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | `APP_ENV` | `local`, `staging`, `production` | Security environment. Non-local modes require HTTPS JWKS/provider targets and block local/private target addresses. | | `AUTH_AUDIENCE` | Non-empty string | Your Composio organization ID. Keyring requires the Composio JWT `aud` to match it exactly. | | `AUTH_ISSUER` | Non-empty string | Use `https://backend.composio.dev` for the Composio production backend. | | `AUTH_JWKS_URL` | URL | Use `https://backend.composio.dev/.well-known/jwks.json`. Must be public HTTPS in `staging` and `production`. | | `ENCRYPTION_CONFIG` | Non-empty string | Inline JSON or, on the long-lived Node target only, a path to a JSON/YAML file. See [encryption configuration](/configuration/encryption). | ## Optional variables with defaults | Variable | Default | Validation and behavior | | ------------------------------ | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `AUDIT_DURABILITY` | `required` | `required` gates sensitive success responses on collector acknowledgment; `best_effort` explicitly opts out. `required` also requires `OTEL_COLLECTOR_URL`. | | `AUTH_CLOCK_TOLERANCE_SECONDS` | `5` | Integer from 0–300 used for JWT time-claim clock skew. | | `AUTH_JWT_ALGORITHMS` | `RS256` | Comma-separated allowlist. Keep `RS256` for Composio unless Composio explicitly announces an issuer change. | | `LOG_LEVEL` | `info` | Minimum Keyring log level: `debug`, `info`, `warning`, or `error`. | | `OTEL_COLLECTOR_URL` | Unset | OTLP/HTTP base URL. Keyring exports Protobuf signals to `/v1/traces`, `/v1/logs`, and `/v1/metrics`. | | `OTEL_COLLECTOR_HEADERS` | Unset | Comma-separated, percent-encoded `Name=value` request headers for the OTLP collector. Blank values are treated as unset. | | `RUNTIME` | `node` | `node` for preferred ECS/Cloud Run deployments; `cloudflare_worker` or `vercel` only on those alternative targets. | ## Node-only variables | Variable | Default | Validation and behavior | | -------- | ----------- | ------------------------------------------------------------------------------------ | | `HOST` | `127.0.0.1` | Bind address: `127.0.0.1`, `0.0.0.0`, or `::1`. Containers use `0.0.0.0` internally. | | `PORT` | `7464` | Integer TCP port from 1–65,535. | `HOST` and `PORT` apply to container and Node deployments. Cloudflare and Vercel own their listeners. ## Provider identity variables These variables are read only when an AWS adapter uses `credential_source: runtime_environment`: | Variable | Purpose | | ---------------------------------------- | ------------------------------------------------------ | | `AWS_ACCESS_KEY_ID` | Static or platform-injected access-key ID | | `AWS_SECRET_ACCESS_KEY` | Matching secret access key | | `AWS_SESSION_TOKEN` | Optional session token | | `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` | ECS/Fargate task-credential path | | `AWS_CONTAINER_CREDENTIALS_FULL_URI` | EKS Pod Identity or compatible credential endpoint | | `AWS_CONTAINER_AUTHORIZATION_TOKEN` | Optional credential-endpoint bearer token | | `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` | Optional token file; supported only by the Node target | Resolution order is environment credentials, then a container credential endpoint. ECS/Fargate should supply the endpoint through its task role; do not set static AWS variables. EC2 IMDS and STS web identity/IRSA are intentionally unsupported. ## OTLP header examples ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} # Spaces are percent-encoded. OTEL_COLLECTOR_HEADERS=Authorization=Bearer%20token # Commas and equals signs inside a value must also be encoded. OTEL_COLLECTOR_HEADERS=Authorization=Basic%20abc%3D%3D,X-Scope=tenant%2Cproduction ``` Keyring rejects malformed percent encoding, invalid header names, control bytes, empty values, and attempts to override `content-type`. ## Runtime-specific loading | Runtime | How variables are read | Encryption config formats | | ----------------- | -------------------------------------------------------------------- | -------------------------------------------------- | | Node/Docker/Helm | `process.env` at startup | Inline JSON, `.json`, `.yaml`, or `.yml` file path | | Cloudflare Worker | Worker bindings per request/cold load | Inline JSON only | | Vercel | Project environment at function initialization and request cold load | Inline JSON only | On Cloud Run, `PORT` is injected by the platform and Keyring reads it automatically. Set `HOST=0.0.0.0`. On ECS, set `HOST=0.0.0.0` and `PORT=7464` in the task definition. Do not put secret values in `wrangler.jsonc`, a committed `.env`, Helm values stored in Git, or a container image layer. Use the deployment platform's secret mechanism.