Environment Variables

Environment Variables

All environment variables across AgentSec components.

Proxy (Required)

VariableDescription
AGENTSEC_ENCRYPTION_KEY64 hex chars (32 bytes). Used for HMAC-SHA256 agent key hashing. Generate with openssl rand -hex 32
TELEGRAM_BOT_TOKENTelegram bot token from @BotFather
TELEGRAM_CHAT_IDTelegram chat ID for approval messages

Proxy (Per-Agent)

VariableDescription
AGENTSEC_AGENT_KEY_{NAME}API key for each agent. Name is uppercased with hyphens replaced by underscores. Generate with openssl rand -hex 32

Example: Agent research-bot → AGENTSEC_AGENT_KEY_RESEARCH_BOT

Proxy (Per-Credential)

VariableDescription
AGENTSEC_CRED_{NAME}Secret value for each credential. Same naming convention as agent keys

Example: Credential twitter-holonym → AGENTSEC_CRED_TWITTER_HOLONYM

Proxy (Optional)

VariableDefaultDescription
AGENTSEC_CONFIG./agentsec.yamlPath to config file
AGENTSEC_AUDIT_LOG./audit.jsonlPath to audit log file
AGENTSEC_LISTEN_ADDR0.0.0.0:3100Listen address
AGENTSEC_FORWARD_TIMEOUT_SECS30Timeout for upstream API requests (seconds)

OAuth 1.0a Signer (Per-Credential)

VariableDescription
OAUTH_CRED_{NAME}_CONSUMER_KEYOAuth consumer key
OAUTH_CRED_{NAME}_CONSUMER_SECRETOAuth consumer secret
OAUTH_CRED_{NAME}_ACCESS_TOKENOAuth access token
OAUTH_CRED_{NAME}_ACCESS_TOKEN_SECRETOAuth access token secret

Example: Credential twitter → OAUTH_CRED_TWITTER_CONSUMER_KEY, etc.

The signer auto-discovers credentials by scanning for OAUTH_CRED_*_CONSUMER_KEY env vars at startup.

OAuth 1.0a Signer (Optional)

VariableDefaultDescription
OAUTH_SIGNER_PORT8080Signer listen port

Naming Convention

For both AGENTSEC_AGENT_KEY_* and AGENTSEC_CRED_*:

  1. Take the name from agentsec.yaml (e.g., twitter-holonym)
  2. Convert to uppercase (TWITTER-HOLONYM)
  3. Replace hyphens with underscores (TWITTER_HOLONYM)
  4. Prepend the prefix (AGENTSEC_CRED_TWITTER_HOLONYM)
OAuth 1.0a Signer