Configuration reference¶

The backend loads configuration from process environment variables and, for local development, backend/.env. Copy backend/.env.example; do not commit the resulting file.

Values shown as secret must exist only on the backend. The Flutter application must never receive them.

Application¶

Variable	Secret	Purpose
`APP_NAME`	No	Service display name.
`APP_VERSION`	No	API version reported by the service.
`APP_ENV`	No	Environment such as `development`, `test`, or `production`.
`API_PREFIX`	No	Mounted API prefix; default is `/api/v1`.
`CORS_ORIGINS`	No	Comma-separated allowed browser origins. Use exact production origins.
`DATABASE_URL`	Yes	SQLAlchemy database connection string. Treat embedded credentials as secret.
`WORKFLOW_CANDIDATE_MIN_CONFIDENCE`	No	Minimum score for retaining workflow candidates.
`HEURISTIC_AUTO_ROUTE_THRESHOLD`	No	Confidence above which deterministic routing may resolve directly.
`HEURISTIC_AI_FALLBACK_THRESHOLD`	No	Boundary for using AI as a fallback to heuristic assessment.
`AI_WORKFLOW_SELECTION_THRESHOLD`	No	Confidence required to select an AI-suggested workflow.

eGov AI¶

Variable	Secret	Purpose
`EGOV_AI_BASE_URL`	No	Authorized provider environment URL.
`EGOV_AI_ACCESS_CODE`	Yes	Server-side provider credential.
`EGOV_AI_CATEGORY`	No	Provider category used by the adapter.
`EGOV_AI_GENERATION_ENABLED`	No	Enables provider-backed generation when configured.
`EGOV_AI_REQUEST_TIMEOUT_SECONDS`	No	Request timeout.
`EGOV_AI_MINIMUM_CREDITS`	No	Minimum available credits before an eligible request.
`EGOV_AI_CREDIT_CACHE_SECONDS`	No	Duration for cached credit status.
`EGOV_AI_MAX_DOCUMENT_BYTES`	No	Maximum document size sent through the AI adapter.

eGovPH SSO¶

Variable	Secret	Purpose
`EGOVPH_SSO_BASE_URL`	No	Authorized SSO environment base URL.
`EGOVPH_SSO_PARTNER_CODE`	Sensitive	Partner identifier; keep it server-side.
`EGOVPH_SSO_PARTNER_SECRET`	Yes	Partner credential used only by the backend.
`EGOVPH_SSO_REQUEST_TIMEOUT_SECONDS`	No	Provider request timeout.
`APPLICATION_SESSION_TTL_HOURS`	No	eAkto session lifetime.

There is no required EGOVPH_SSO_AUTHORIZE_URL setting in the current application. The backend builds its flow from the configured provider contract and eAkto callback.

Face liveness and eVerify¶

Variable	Secret	Purpose
`FACE_LIVENESS_BASE_URL`	No	Liveness integration base URL.
`FACE_LIVENESS_API_KEY`	Yes	Backend liveness credential.
`FACE_LIVENESS_CALLBACK_URL`	No	Allowed callback into the eAkto frontend.
`FACE_LIVENESS_REQUEST_TIMEOUT_SECONDS`	No	Liveness request timeout.
`FACE_LIVENESS_CONFIDENCE_THRESHOLD`	No	Minimum accepted confidence under current policy.
`EVERIFY_BASE_URL`	No	Authorized eVerify environment base URL.
`EVERIFY_CLIENT_ID`	Sensitive	Backend client identifier.
`EVERIFY_CLIENT_SECRET`	Yes	Backend client secret.
`EVERIFY_PUBLIC_KEY`	Public	Public key passed to an approved client-side verification flow.
`EVERIFY_IDENTITY_REFERENCE_SECRET`	Yes	Secret used to protect internal identity references.
`EVERIFY_REQUEST_TIMEOUT_SECONDS`	No	eVerify request timeout.
`EVERIFY_SIGN_IN_CHALLENGE_TTL_MINUTES`	No	Sign-in challenge lifetime.
`IDENTITY_ASSURANCE_TTL_MINUTES`	No	High-assurance identity lifetime.

Despite its name, use EVERIFY_PUBLIC_KEY only for the purpose and origin allowed by the provider. A public key is not a substitute for the server credentials.

Supabase documents¶

Variable	Secret	Purpose
`SUPABASE_URL`	No	Supabase project URL.
`SUPABASE_SECRET_KEY`	Yes	Server-side key for protected database/storage operations.
`SUPABASE_DATABASE_URL`	Yes	Direct database URL when used.
`SUPABASE_DOCUMENT_BUCKET`	No	Private document bucket name.
`SUPABASE_DOCUMENT_TABLE`	No	Citizen document metadata table.
`SUPABASE_REQUEST_TIMEOUT_SECONDS`	No	Supabase request timeout.
`DOCUMENT_MAX_UPLOAD_BYTES`	No	Maximum accepted upload size.

Never use a privileged Supabase key in Flutter. Enforce private bucket policy even if the backend already checks ownership.

Flutter¶

Build definition	Secret	Purpose
`API_BASE_URL`	No	Public eAkto API URL including `/api/v1`.

Pass it at run or build time:

flutter run -d chrome \
  --dart-define=API_BASE_URL=http://localhost:8000/api/v1

Safe validation¶

Check that required names exist without printing their values. In production, prefer platform health checks and secrets-manager metadata over dumping the process environment.