Environment variable reference

LeapView configuration is process-global. Environment settings apply to the entire instance and cannot be overridden per workspace. Values marked secret must come from the deployment environment or a secret manager.

Run leapview config validate to validate the active environment, or add --production to apply production requirements when LEAPVIEW_PRODUCTION is not set. Validation never prints configured values or secrets.

Administration

Agent

Analytics

Assets

Authentication

Bootstrap

Client

Connection

Deployment

Development

Managed Data

Operations

Qualification

Refresh

Release

Security

Server

Site

Storage

Workload

Relationships

• production-dev-bypass: Production cannot bypass authentication. Failure: production serve must not enable LEAPVIEW_DEV_AUTH_BYPASS.
• production-oidc-complete: OIDC settings are all-or-none in production. Failure: production OIDC auth requires LEAPVIEW_OIDC_ISSUER_URL, LEAPVIEW_OIDC_CLIENT_ID, LEAPVIEW_OIDC_CLIENT_SECRET, and LEAPVIEW_OIDC_CALLBACK_URL.
• production-azure-complete: Azure settings are all-or-none in production. Failure: production Azure auth requires LEAPVIEW_AZURE_CLIENT_ID, LEAPVIEW_AZURE_CLIENT_SECRET, and LEAPVIEW_AZURE_CALLBACK_URL.
• production-auth-mode: Production requires local, API-token-only, OIDC, or Azure authentication. Failure: production serve requires OIDC auth env vars, Azure auth env vars, LEAPVIEW_LOCAL_AUTH, or LEAPVIEW_API_TOKEN_ONLY_AUTH.
• production-csrf-key: Production requires a CSRF key with at least 32 characters. Failure: production serve requires LEAPVIEW_CSRF_KEY with at least 32 characters.
• production-metrics-token: Production requires a metrics bearer token with at least 32 characters. Failure: production metrics scraping requires LEAPVIEW_METRICS_BEARER_TOKEN with at least 32 characters.
• production-public-url: Production requires a canonical public URL. Failure: production serve requires LEAPVIEW_PUBLIC_URL.
• production-public-url-https: The production public URL must be an HTTPS origin without a path, query, fragment, or credentials. Failure: production serve requires LEAPVIEW_PUBLIC_URL to be an https origin.
• production-mcp-oauth-issuer-https: An external production MCP OAuth issuer must use HTTPS. Failure: production serve requires LEAPVIEW_MCP_OAUTH_ISSUER_URL to be an https URL.
• production-allowed-host: Production derives an allowed host from its public URL, explicit hosts, or a browser-auth callback host. Failure: production serve requires LEAPVIEW_PUBLIC_URL, LEAPVIEW_ALLOWED_HOSTS, or an OIDC/Azure callback URL host.
• production-secure-cookie: Production browser authentication requires secure cookies unless API-token-only mode is also enabled. Failure: production browser auth requires LEAPVIEW_COOKIE_SECURE=true.
• evaluation-production: Evaluation mode uses the production serving-state runtime. Failure: LEAPVIEW_EVALUATION_MODE requires LEAPVIEW_PRODUCTION=true.
• evaluation-environment: Evaluation state is isolated in the evaluation environment. Failure: LEAPVIEW_EVALUATION_MODE requires LEAPVIEW_ENVIRONMENT=evaluation.
• evaluation-local-auth: Evaluation mode requires an unavoidable local sign-in. Failure: LEAPVIEW_EVALUATION_MODE requires LEAPVIEW_LOCAL_AUTH=true.
• evaluation-loopback-origin: Evaluation mode permits plain HTTP only for a loopback origin. Failure: LEAPVIEW_EVALUATION_MODE requires a loopback http LEAPVIEW_PUBLIC_URL origin.
• evaluation-insecure-cookie: Evaluation mode uses a localhost HTTP session cookie. Failure: LEAPVIEW_EVALUATION_MODE requires LEAPVIEW_COOKIE_SECURE=false.
• evaluation-no-proxy: Evaluation mode must not trust forwarding headers. Failure: LEAPVIEW_EVALUATION_MODE requires LEAPVIEW_TRUST_PROXY_HEADERS=false.
• production-oidc-issuer-https: The production OIDC issuer must use HTTPS. Failure: production serve requires LEAPVIEW_OIDC_ISSUER_URL to be an https URL.
• production-oidc-callback-https: The production OIDC callback must use HTTPS. Failure: production serve requires LEAPVIEW_OIDC_CALLBACK_URL to be an https URL.
• production-oidc-provider-slug: The OIDC provider identifier must be route-safe. Failure: LEAPVIEW_OIDC_PROVIDER_ID must be a route-safe slug containing only letters, numbers, dots, underscores, or dashes.
• production-azure-callback-https: The production Azure callback must use HTTPS. Failure: production serve requires LEAPVIEW_AZURE_CALLBACK_URL to be an https URL.
• production-scim-token: A configured production SCIM token must contain at least 32 characters. Failure: production SCIM provisioning requires LEAPVIEW_SCIM_BEARER_TOKEN with at least 32 characters.
• managed-data-backend: Managed data uses a supported storage backend. Failure: LEAPVIEW_MANAGED_DATA_BACKEND must be local or s3.
• managed-data-runtime-dir: Every managed-data backend requires a private local runtime and staging directory. Failure: managed-data storage requires LEAPVIEW_MANAGED_DATA_DIR.
• managed-data-s3-location: The S3 managed-data backend requires a bucket and region. Failure: S3 managed-data storage requires LEAPVIEW_MANAGED_DATA_S3_BUCKET and LEAPVIEW_MANAGED_DATA_S3_REGION.
• managed-data-s3-credentials: Managed-data S3 credentials are either omitted or configured as a complete key pair. Failure: managed-data S3 credentials require both LEAPVIEW_MANAGED_DATA_S3_ACCESS_KEY_ID and LEAPVIEW_MANAGED_DATA_S3_SECRET_ACCESS_KEY; a session token also requires that pair.
• managed-data-positive-limits: Managed-data upload, session, garbage-collection, and free-space limits are positive. Failure: managed-data limits, durations, and free-space thresholds must be positive.
• managed-data-revision-limit: The managed-data revision limit is at least the per-file limit. Failure: LEAPVIEW_MANAGED_DATA_MAX_REVISION_BYTES must be at least LEAPVIEW_MANAGED_DATA_MAX_FILE_BYTES.