Environment variables

This reference lists all 86 environment variables consumed by the product-neutral getaip-server gateway and separates them from connector control-plane, standalone host, product connector, and getaip settings. Use it to identify which process owns a value, how it combines with command-line configuration, and whether it activates an optional subsystem.

The inventory reflects source revision d7cce13d1d555644d04a4d73c66c95b113737635. It does not include variables used only by the migration-only bundled binary or by non-public development modules.

Choose the correct owner

Do not copy provider credentials from a standalone host into a GETAIP_SERVER_ variable. The AIP_CAL_DIY_ prefix is owned by the standalone Cal.diy host; it does not make Cal.diy part of the product-neutral gateway.

Resolution and parsing rules

For most scalar getaip-server settings, an explicit CLI value wins and the environment is the fallback. These variables are exceptions:

• GETAIP_SERVER_NATIVE_PRINCIPAL overrides the CLI principal, including an explicit --native-principal value;
• GETAIP_SERVER_MCP_PRINCIPAL overrides the CLI principal, including an explicit --mcp-principal value;
• GETAIP_SERVER_NATS_REQUEST_TIMEOUT_MS overrides --nats-request-timeout-ms.

Boolean variables are true only for 1, true, TRUE, yes, or YES. Every other value, including an empty string, is false. Boolean environment and CLI switches are otherwise combined as logical OR.

Unsigned integer variables use strict decimal parsing. A malformed or negative value fails startup even when the subsystem would later remain disabled. Values that must be positive receive an additional validation check.

Two list formats exist:

Environment list entries extend the corresponding CLI list. They do not replace it. Duplicate entries can fail a later uniqueness check.

An empty environment value is not a portable substitute for unsetting a variable. Some paths filter empty values, while other paths parse or validate them and fail. Remove an unused variable from the process environment.

getaip-server process and storage

The PostgreSQL inline and file variables are mutually exclusive after CLI and environment resolution. PostgreSQL owns core runtime state when either form resolves; otherwise the storage directory owns local runtime state. With neither, core runtime state is in memory.

The listener address, service ID, trust domain, manifest-print mode, and MCP stdio mode have no GETAIP_SERVER_ environment equivalent in this revision. Configure them with CLI options.

getaip-server native identity and authorization

GETAIP_SERVER_NATIVE_BEARER_TOKEN and GETAIP_SERVER_NATIVE_BEARER_TOKEN_FILE cannot both resolve. Signatures are required by default. To accept unsigned envelopes, GETAIP_SERVER_ALLOW_UNSIGNED_ENVELOPES must be true while the CLI and environment require switches are false. Outside loopback-only insecure development, native bearer authentication is still required for unsigned traffic.

Signer bindings from the route list and file are merged. Every signer must use a valid Ed25519 did:key, and a DID cannot occur twice across the combined sources.

getaip-server callbacks and runtime budgets

The inline and file signing-seed variables are mutually exclusive. An allowed callback host, A2A push key, or delegation route requires a response and callback signing seed. The HTTP and private-network variables expand the destination boundary shared by callbacks and HTTP delegation.

getaip-server connector registry and fleet transport

The registry inline and file variables are mutually exclusive. A resolved registry URL activates fleet composition and then requires the signing-seed file plus either explicit allowed hosts or registry endpoint trust.

getaip-server fleet topology and admission

Per-tenant limits cannot exceed their global counterparts. Weight tenant IDs contain 1–256 bytes, each weight is positive, and duplicate tenant IDs fail startup. Topology preferences affect new assignments, not already pinned work.

getaip-server fleet activation nuance

GETAIP_SERVER_CONNECTOR_REGISTRY_URL or GETAIP_SERVER_CONNECTOR_REGISTRY_URL_FILE is the only environment activation boundary for fleet mode. Do not infer activation from another fleet variable.

Without a registry URL, these environment groups explicitly make the configuration partial and fail startup:

• signing-seed file and fleet callback URL;
• allowed hosts or any fleet network-policy Boolean;
• tenant weights;
• cross-region failover disablement;
• any connector-event or stream-ingress limit.

Valid environment-only pool, transport numeric, topology text, admission numeric, and TLS CA settings do not activate fleet mode and are not all treated as partial configuration in the reviewed implementation. They can be parsed or their file can be read, then discarded when the registry URL is absent. An invalid numeric value or unreadable CA file can still fail startup.

Set the registry URL explicitly and verify the /ready fleet section rather than using a tuning value as an activation probe.

getaip-server connector-event and stream ingress

Any one of these variables without a registry URL is rejected as partial fleet configuration. The limits do not replace route, tenant, signature, timestamp, sequence, lease, or replay validation.

getaip-server NATS and delegation

Authentication values without GETAIP_SERVER_NATS_URL fail startup. Username and password file must resolve together. Delegation lists extend CLI routes and require the response and callback signing seed.

getaip-server MCP

Introspection URL, issuer, client ID, and secret file are an all-or-none group. Introspection also requires a protected resource, rejects a simultaneous static token, and requires its issuer in the advertised authorization-server list.

When resource is absent, a static token, authorization server, supported scope, or documentation URL causes the implementation to derive http://<bind>/mcp. Set GETAIP_SERVER_MCP_RESOURCE explicitly for a public origin.

Connector control-plane variables

The standalone aip-connector-control-plane consumes two environment variables:

An explicit CLI path wins. Empty environment paths are treated as absent. Both files must be regular non-symlink files with no group or other permission bits. Other control-plane settings, including bind address, proxy-network exception, principal ID, lease TTL, pool size, and acquire timeout, are CLI-only in this revision.

Standalone connector-host variables

Every one of the six public standalone hosts consumes the 45 common AIP_CONNECTOR_HOST_ variables documented in the Connector host configuration page linked from the ownership table. That page is the canonical inventory for common endpoint, admitted identity, tenant, trust, storage, topology, credential, lifecycle, callback, event, and limit settings.

Each host then adds its product-owned prefix shown in the ownership table. The connector-local configuration page owns those provider endpoints, account or workspace identifiers, operation descriptors, policy files, and credential file references. This global page does not duplicate them because their required combinations and defaults differ by connector.

getaip variables

Except for the documented principal and response-size overrides, explicit getaip options take precedence. Do not export long-lived inline tokens into a shared shell profile. Prefer owner-only files and give the CLI process access only for the duration of the operation.

The native bearer token and bearer-token file are mutually exclusive. The inline native peer DID and peer-DID file are also mutually exclusive. NATS username and password file must resolve together; the NATS signing seed remains a separate AIP message-signing identity.