Skip to content
Alcarta

Configure Alcarta

Configuration is resolved in this order:

  1. Built-in defaults
  2. The TOML file named by GW_CONFIG_FILE
  3. Environment variables

Environment values win. Canonical settings use the GW_ prefix. A small set of legacy database, Redis, and base-URL aliases is accepted with a deprecation warning.

Validate the complete configuration before starting a new release:

Terminal window
gw-server config check

The command exits non-zero for unknown or retired keys, invalid ranges, unsafe production values, and inconsistent settings. Its resolved report redacts secrets with a short hash, which makes two values comparable without disclosing them.

Handle secrets

Section titled “Handle secrets”

JWT signing, cursor, session, and key-encryption material must come from files. Do not place these long-lived keys in environment variables. Database and Redis URLs, SMTP credentials, OAuth client secrets, and observability credentials are normal secret values and should come from your platform’s secret store.

Keep GW_BASE_URL equal to the public HTTPS origin. Alcarta uses it for verification links, approval links, and OAuth redirect URIs; an internal service URL will produce broken flows.

See Configuration reference for the settings operators most often need.