Environment Variables for User Management Package Services
This page describes the environment variables used across all services in the User Management Pack. Each service organizes its variables into three categories:
Generated variables — values produced automatically by the initialization script, based on user‑provided inputs.
Default variables — values predefined from the start and not influenced by user input.
Configurable variables — values initially set by the initialization script but designed to be updated later by the user without rerunning the script.
SSI Wallet API
Generated variables
WALLET_API_HOST
Description: Sets the FQDN of the server on which the Wallet API service runs.
Values: String (URL)
Example: wallet-api.demo.oceanenterprise.io
Default Value: null
WALLET_UI_HOST
Description: Sets the FQDN of the server on which the Wallet UI service runs.
Values: String (URL)
Example: wallet-ui.demo.oceanenterprise.io
Default Value: null
Default variables
WALLET_API_TAG
Description: Sets the Wallet API Docker image tag.
Values: String
Example: gaiax-0.1.1-OE
Default Value: null
WALLET_BACKEND_PORT
Description: Sets the TCP port on which the Wallet API service listens. The configured port is 7001.
Values: Integer
Example: 7001
Default Value: null
DB_NAME
Description: Sets the database name used by the Wallet API service for data persistence. The configured database name is waltid.
Values: String
Example: waltid
Default Value: null
DB_USERNAME
Description: Sets the username used by the Wallet API service to access the database. The configured username is waltid.
Values: String
Example: waltid
Default Value: null
DATABASE_ENGINE
Description: Sets the database type used for data persistence. The configured database is postgres.
Values: String
Example: postgres
Default Value: null
POSTGRES_DB_PORT
Description: Sets the port on which the database listens. The configured port is 5432.
Values: Integer
Example: 5432
Default Value: null
POSTGRES_DB_HOST
Description: Sets the hostname of the server on which the database runs. The configured value is the container's hostname used in the internal Docker network postgres).
Values: String
Example: postgres
Default Value: null
POSTGRES_DB_DATA
Description: Sets the directory where the Wallet API database files are located. The configured value is /waltid-wallet-api/data/ .
Values: String
Example: postgres
Default Value: null
SERVICE_HOST
Description: Determines the hostname or IP address at which the service container or its dependencies can be discovered internally or externally across the network. The configured value is localhost .
Values: String
Example: localhost
Default Value: null
Configurable variables
DB_PASSWORD
Description: Sets the password of the database user used by the Wallet API service to access the database.
Values: String
Example: setastrongpassword
Default Value: null
SSI Wallet UI
Generated variables
NUXT_PUBLIC_REDIRECT_URI
Description: Specifies the redirect URI used during the OIDC user authentication flow, telling the identity provider where to securely send the user and return tokens or authorization codes after authentication finishes.
Values: String (URL)
Example: https://waltid-ui.oceanenterprise.io/auth/callback
Default Value: null
NUXT_PUBLIC_ISSUER_CALLBACK_URL
Description: Specifies the callback URI used during the OIDC user authentication flow, telling the identity provider where to send the user back after they finish logging in.
Values: String (URL)
Example: https://waltid-ui.oceanenterprise.io
Default Value: null
NUXT_PUBLIC_DEV_WALLET_URL
Description: Specifies the URL where the SSI Wallet UI application is available.
Values: String (URL)
Example: https://waltid-ui.oceanenterprise.io
Default Value: null
WALLET_UI_HOST
Description: Specifies the FQDN of the server where the SSI Wallet UI application runs.
Values: String
Example: waltid-ui.oceanenterprise.io
Default Value: null
Default variables
DEV_WALLET_TAG
Description: Sets the Wallet UI Docker image tag.
Values: String
Example: gaiax-0.1.4-OE
Default Value: null
NUXT_WALLET_API_INTERNAL
Description: Sets the URL where the SSI Wallet API is available, which is based on the internal SSI Wallet API container hostname.
Values: String (URL)
Example: http://wallet-api:7001/wallet-api
Default Value: null
SERVICE_HOST
Description: Determines the hostname or IP address at which the service container or its dependencies can be discovered internally or externally across the network. The configured value is localhost .
Values: String
Example: localhost
Default Value: null
Configurable variables
NUXT_PUBLIC_ISSUER
Description: Sets the OIDC issuer URL used to authenticate users to the SSI Wallet UI service.
Values: String (URL)
Example: https://ocean-node-vm1-stage.oceanenterprise.io:9443/application/o/oe-market/
Default Value: null
NUXT_TOKEN_URL
Description: Sets the OIDC token URL used to authenticate users to the SSI Wallet UI service.
Values: String (URL)
Example: https://ocean-node-vm1-stage.oceanenterprise.io:9443/application/o/token/
Default Value: null
NUXT_PUBLIC_LOGOUT_REDIRECT_URI
Description: Sets the URL where users are redirected when they log out from the SSI Wallet UI application.
Values: String (URL)
Example: https://waltid-ui.oceanenterprise.io
Default Value: null
NUXT_PUBLIC_CLIENT_ID
Description: Sets the client ID of the OIDC provider used to authenticate users to the SSI Wallet UI application.
Values: String
Example: 370ax8pyoamtbfc70ml1tmcgmbnwq0dq
Default Value: null
NUXT_CLIENT_SECRET
Description: Sets the client secret of the OIDC provider used to authenticate users to the SSI Wallet UI application.
Values: String
Example: astrongsecretkey
Default Value: null
NUXT_ADMIN_USER_GROUP_NAME
Description: Defines the name of the administrator group whose members are permitted to access the SSI Wallet user interface.
If set to
null, all authenticated users can access the graphical interface.If set to a specific group name, only users belonging to that group are granted access.
Values: String
Example: Admins
Default Value: null
Signer Server
Generated variables
UPSTREAM_IDP
Description: Specifies the identifier of the Authentik server — either the Central IDP or the Federated IDP — whose registered users are permitted to access the Signer Server’s API endpoints.
Values: String
Example: tvl-participant
Default Value: null
HTTP_CERT_PATH
Description: Specifies the filesystem path where the digital certificate file used by the Signer Server to enable HTTPS communication is located.
Values: String
Example: /etc/ssl/certs/fullchain.pem
Default Value: null
HTTP_KEY_PATH
Description: Specifies the filesystem path to the private key file associated with the digital certificate used by the Signer Server to enable HTTPS communication.
Values: String
Example: /etc/ssl/certs/fullchain.pem
Default Value: null
NODE_URI_MAP
Description: Sets the list of blockchains in which the Signer Server component provisioned by the User Management Pack signs transactions. For each blockchain, the following details are specified:
the RPC endpoint used to access the blockchain
gas multiplier: Scales the per‑unit gas price that the Signer Server uses when submitting blockchain transactions. The network‑estimated fee is multiplied by this value, and the result becomes the effective gas price paid per gas unit. Increasing the multiplier raises the transaction’s competitiveness and helps ensure timely inclusion during periods of network congestion. Note: We recommend using the default values for each blockchain. If the multiplier is not set for a blockchain, the default value is used, which is as follows:
Ethereum Sepolia (chain no. 11155111) = 3
OP Sepolia (chain no. 11155420) = 2
OP Mainnet (chain no. 10) = 1.5
Ethereum Mainnet (chain no. 1) = 2.
Value: Array of objects
Example:
Here's the same value in a structured format.
Default Value: null
Default variables
SIGNER_MODE
Description: Sets the operation mode of the Signer Server, which can be local (with the private keys loaded into the signer server's environment, recommended for demo environments) or vault (with the private keys stored in a secrets vault, recommended for production environments).
Value: string (local/vault)
Example: vault
Default Value: null
SIGNER_SERVER_TAG
Description: Sets the Signet Server Docker image tag.
Values: String
Example: v0.5.3
Default Value: null
PORT
Description: Sets the internal TCP port on which the Signer Server container runs.
Values: Integer
Example: 3001
Default Value: null
OPENBAO_PORT
Description: Sets the TCP port on OpenBao container listens for requests.
Values: Integer
Example: 8200
Default Value: null
VAULT_URL
Description: Sets the URL where the OpenBao service is available, which is based on the internal OpenBao container hostname.
Values: String (URL)
Example: https://openbao:8200
Default Value: null
VAULT_ETHEREUM_MOUNT
Description: Sets the vault path where the private keys used by Signer Server to sign transactions are located.
Values: String
Example: ethereum
Default Value: null
VAULT_KV_STORE_PATH
Description: Sets the vault path where the walletID-to-wallet address mappings are located.
Values: String
Example: secret
Default Value: null
VAULT_TIMEOUT_MS
Description: Sets the timeout of the vault requests (in miliseconds)
Values: Integer
Example: 10000
Default Value: null
Configurable variables
ALLOWED_ORIGINS
Description: Specifies the list of permitted origins (URLs) from which requests to Signer Server's endpoints are allowed. Only requests originating from the values defined in this variable will pass the validation and be accepted by the server.
Values: Array of strings (URL)
Example: ["https://market2.demo.oceanenterprise.io/", "https://waltid-ui.oceanenterprise.io"]
Default Value: null
AUTHENTIK_ISSUER
Description: Sets the OIDC issuer URL used to authenticate users to the SSI Wallet UI service.
Values: String (URL)
Example: https://ocean-node-vm1-stage.oceanenterprise.io:9443/application/o/oe-market/
Default Value: null
AUTHENTIK_JWKS_URI
Description: Sets the OIDC provider JWKS URL used to verify the signatures of the users' JWTs.
Values: String (URL)
Example: https://ocean-node-vm1-stage.oceanenterprise.io:9443/application/o/oe-market/jwks/
Default Value: null
AUTHENTIK_AUDIENCE
Description: Sets the client ID of the OIDC provider used to authenticate users to the SSI Wallet UI application.
Values: String
Example: 370ax8pyoamtbfc70ml1tmcgmbnwq0dq
Default Value: null
AUTHENTIK_CLIENT_SECRET
Description: Sets the client secret of the OIDC provider used to authenticate users to the SSI Wallet UI application.
Values: String
Example: astrongsecretkey
Default Value: null
Authentik Server
Generated variables
AUTHENTIK_APP_SLUG
Description: Specifies the slug of the Authentik application created during this deployment. The value is used exclusively by the blueprint initialization script, which loads the provider’s redirect configuration into the Authentik deployment.
Values: String
Example: oe-market
Default Value: null
AUTHENTIK_PROVIDER_NAME
Description: Specifies the name of the Authentik provider associated with the Authentik application created during this deployment. It defines key OIDC configuration details such as the client ID, client secret, authentication endpoints, and the scopes requested during user authentication. The value is used exclusively by the blueprint initialization script, which loads the provider’s redirect configuration into the Authentik deployment.
Values: String
Example: oe-market-provider
Default Value: null
AUTHENTIK_BASE_URL
Description: Defines the root URL of the Authentik server instance. This value is used exclusively by the blueprint initialization script, which loads configuration settings into the Authentik deployment.
Values: String
Example: https://ocean-node-vm3.oceanenterprise.io:9443
Default Value: null
AUTHENTIK_REDIRECT_URIS
Description: Specifies the list of permitted Redirect URIs for the Authentik provider created during this deployment. These URIs define where Authentik is allowed to send users after successful authentication. The value is used exclusively by the blueprint initialization script, which loads the provider’s redirect configuration into the Authentik deployment.
Values: String
Example: ['https://market-git-feat-stage-ocean-enterprise.vercel.app/auth/callback', 'https://market-git-feat-stage-ocean-enterprise.vercel.app/auth/login', 'https://wallet-ui-smc.oceanenterprise.io/auth/callback', 'https://wallet-ui-smc
.oceanenterprise.io/auth/login']
Default Value: null
AUTHENTIK_LOGOUT_URI
Description: Defines the endpoint where to send a logout request to clear the user's active session inside the connected application. This value is used exclusively by the blueprint initialization script, which loads configuration settings into the Authentik deployment.
Values: String
Example: https://market-git-feat-stage-ocean-enterprise.vercel.app/auth/callback/logout
Default Value: null
PARTICIPANT_IDP_WELL_KNOWN_URL
Description: Specifies the URL of the well‑known endpoint of the Authentik provider configured on the Federated Identity Provider.
Values: String
Example: https://vm1-test.oceanenterprise.io:9443/application/o/tvl-participant/.well-known/openid-configuration
Default Value: null
AUTHENTIK_OUTPUT_FILE
Description: Defines the blueprint file that will be executed the first time the Authentik containers are created to load the configuration settings into the Authentik deployment. This value is used exclusively by the blueprint initialization script.
Values: String
Example: dataspace-operator-authentik-blueprint.yaml
Default Value: null
Default variables - Docker image
AUTHENTIK_IMAGE
Description: Sets the Docker image for the Suthentik server.
Values: String
Example: ghcr.io/goauthentik/server
Default Value: null
Default variables - TCP Ports
AUTHENTIK_PORT_HTTP
Description: Sets the container's TCP port for HTTP connections.
Values: Integer
Example: 9000
Default Value: null
AUTHENTIK_PORT_HTTPS
Description: Sets the container's TCP port for HTTPS connections.
Values: Integer
Example: 9443
Default Value: null
Default variables - SMTP settings
AUTHENTIK_EMAIL__USE_SSL
Description: Hostname or IP address of the PostgreSQL server.
Values: Boolean
Example: false
Default Value: null
AUTHENTIK_EMAIL__TIMEOUT
Description: Sets the SMTP connection timeout limit in seconds for Authentik email delivery, in seconds.
Values: Integer
Example: 10
Default Value: null
Default variables - Postgres connection settings
AUTHENTIK_POSTGRESQL__NAME
Description: Name of the PostgreSQL database to use.
Values: String
Example: authentik
Default Value: null
AUTHENTIK_POSTGRESQL__USER
Description: PostgreSQL username used by authentik to authenticate.
Values: String
Example: authentik
Default Value: null
AUTHENTIK_POSTGRESQL__HOST
Description: Hostname or IP address of the PostgreSQL server.
Values: String
Example: postgres
Default Value: null
Configurable variables - TCP Ports
COMPOSE_PORT_HTTP
Description: Sets the host's TCP port for HTTP connection.
Values: Integer
Example: 9000
Default Value: null
COMPOSE_PORT_HTTPS
Description: Sets the host's TCP port for HTTPS connection.
Values: Integer
Example: 9000
Default Value: null
Configurable variables - SMTP settings
AUTHENTIK_EMAIL__HOST
Description: SMTP server hostname or IP address
Values: String
Example: postgres
Default Value: localhost
AUTHENTIK_EMAIL__PORT
Description: SMTP server port number.
Values: Integer
Example: 465
Default Value: 25
AUTHENTIK_EMAIL__USERNAME
Description: SMTP username. If empty, Authentik will not attempt SMTP authentication.
Values: String
Example: support@oceanenterprise.io
Default Value: ''
AUTHENTIK_EMAIL__PASSWORD
Description: SMTP password. If empty, Authentik will not attempt SMTP authentication.
Values: String
Example: astrongpassword
Default Value: ''
AUTHENTIK_EMAIL__FROM
Description: Email address that Authentik will send emails from. This should be a valid address for your domain. To include a display name, use the format Name <account@domain>.
Values: String
Example: support@oceanenterprise.io
Default Value: ''
Configurable variables - PostgreSQL connection settings
AUTHENTIK_POSTGRESQL__PASSWORD
Description: PostgreSQL password used by authentik to authenticate.
Values: String
Example: astrongpassword
Default Value: null
Configurable variables - Cookie signing
AUTHENTIK_SECRET_KEY
Description: Secret key used for cookie signing. Changing this will invalidate active sessions.
Values: String
Example: astrongkey
Default Value: null
PostgreSQL server
Generated variables
AUTHENTIK_POSTGRESQL__NAME
Description: PostgreSQL database name for the Authentik server. This variable is used by the initialization script that runs after the PostgreSQL container is started.
Values: String
Example: authentik
Default Value: null
AUTHENTIK_POSTGRESQL__USER
Description: PostgreSQL database user for the Authentik database. This variable is used by the initialization script that runs after the PostgreSQL container is started.
Values: String
Example: authentik
Default Value: null
AUTHENTIK_POSTGRESQL__PASSWORD
Description: The password of the PostgreSQL database user for the Authentik database. This variable is used by the initialization script that runs after the PostgreSQL container is started.
Values: String
Example: astrongpassword
Default Value: null
DB_NAME
Description: PostgreSQL database name for the Wallet API service. This variable is used by the initialization script that runs after the PostgreSQL container is started.
Values: String
Example: waltid
Default Value: null
DB_USERNAME
Description: PostgreSQL database user for the Wallet API service. This variable is used by the initialization script that runs after the PostgreSQL container is started.
Values: String
Example: waltid
Default Value: null
DB_PASSWORD
Description: The password of the PostgreSQL database user for the Wallet API service. This variable is used by the initialization script that runs after the PostgreSQL container is started.
Values: String
Example: astrongpassword
Default Value: null
Default variables
POSTGRES_DB
Description: It explicitly defines the name of the default database that is automatically created when the container is initialized for the first time
Values: String
Example: postgres
Default Value: null
POSTGRES_USER
Description: It explicitly defines the name of the default database superuser that is automatically created when the container is initialized for the first time.
Values: String
Example: postgres
Default Value: null
POSTGRES_PASSWORD
Description: Sets the superuser password for the PostgreSQL database instance during its initial container startup
Values: String
Example: astrongpassword
Default Value: null
Last updated