Configuration Overview

Authara is configured entirely through environment variables.

Configuration is typically provided via:

.env files
container environments
orchestration platforms (Kubernetes, ECS, etc.)

Authara does not load configuration files directly.

Configuration categories

Authara configuration is organized into the following areas:

Runtime

Controls environment and logging behavior.

Examples:

APP_ENV
LOG_LEVEL

Database

Defines the PostgreSQL connection.

Examples:

POSTGRESQL_HOST
POSTGRESQL_DATABASE
POSTGRESQL_USERNAME
POSTGRESQL_PASSWORD

Cache

Configures the optional cache backend.

→ See: configuration/cache.md

Examples:

AUTHARA_CACHE_PROVIDER
AUTHARA_REDIS_HOST

Public URL

Defines the externally accessible base URL.

Used for:

redirects
OAuth callbacks

Example:

PUBLIC_URL

Token lifetimes

Controls expiration of access, refresh, and session tokens.

Examples:

AUTHARA_ACCESS_TOKEN_TTL_MINUTES
AUTHARA_SESSION_TTL_DAYS
AUTHARA_REFRESH_TOKEN_TTL_DAYS

Organizations

Controls organization mode, invitation expiry, and the server-to-server token for internal organization APIs.

AUTHARA_ORG_MODE is intended to be chosen before first production use. Changing it after users or organizations exist is currently unsupported.

Modes: - personal: direct signup creates a hidden personal org; invitations are disabled. - single: direct signup creates one team org; invite signup joins the invited org. - multi: direct signup creates a personal org; invite signup also joins the invited org.

Examples:

AUTHARA_ORG_MODE
AUTHARA_PUBLIC_ORGANIZATION_MANAGEMENT_ENABLED
AUTHARA_ORGANIZATION_INVITATION_TTL
AUTHARA_INTERNAL_API_TOKEN

AUTHARA_PUBLIC_ORGANIZATION_MANAGEMENT_ENABLED allows authenticated clients to manage their own organization directly through Authara. Disable it when organization changes must pass through the application backend for billing, seat limits, approval, or other business rules.

JWT

Controls token signing and verification.

See: JWT

Examples:

AUTHARA_JWT_ISSUER
AUTHARA_JWT_KEYS
AUTHARA_JWT_ACTIVE_KEY_ID

OAuth

Configures external identity providers.

See: OAuth

Examples:

AUTHARA_OAUTH_PROVIDERS
AUTHARA_OAUTH_GOOGLE_CLIENT_ID

Challenge & verification

Controls email verification and challenge flows.

See: Challenge

Examples:

AUTHARA_CHALLENGE_ENABLED
AUTHARA_CHALLENGE_TTL
AUTHARA_CHALLENGE_MAX_ATTEMPTS

Email

Controls email delivery via SMTP or other providers.

See: Email

Examples:

AUTHARA_EMAIL_PROVIDER
AUTHARA_EMAIL_FROM
AUTHARA_EMAIL_SMTP_HOST

Email worker

Controls background processing of email jobs.

See: Email

Examples:

AUTHARA_EMAIL_WORKER_COUNT
AUTHARA_EMAIL_WORKER_POLL_INTERVAL

Email cleanup

Controls retention of email job records.

See: Email

Examples:

AUTHARA_EMAIL_CLEANUP_SENT_AFTER
AUTHARA_EMAIL_CLEANUP_FAILED_AFTER

Rate limiting

Protects login, signup, and passkey challenge endpoints.

See: Rate Limiting

Examples:

AUTHARA_RATE_LIMIT_LOGIN_IP_LIMIT
AUTHARA_RATE_LIMIT_PASSKEY_LOGIN_IP_LIMIT
AUTHARA_RATE_LIMIT_SIGNUP_EMAIL_LIMIT

Webhooks

Configures event delivery to external systems.

Examples:

AUTHARA_WEBHOOK_URL
AUTHARA_WEBHOOK_SECRET
AUTHARA_WEBHOOK_WORKER_COUNT

Database connection pooling

Controls database performance and concurrency.

See: Database Connection

Examples:

AUTHARA_DB_MAX_OPEN_CONNS
AUTHARA_DB_MAX_IDLE_CONNS

Access policy

Restricts access via email allowlists.

See: Access Policy

Examples:

AUTHARA_ACCESS_POLICY_ALLOWLIST_ENABLED

Admin audit

Controls retention for admin audit events.

Examples:

AUTHARA_ADMIN_AUDIT_RETENTION_DAYS

Configuration reference

For the complete list of variables:

See: Reference