Relying Party ID (domain, e.g., vouch.sh). Used as the WebAuthn RP ID.
VOUCH_RP_NAME
No
Vouch
Relying Party display name shown in browser prompts and UI.
VOUCH_DATABASE_URL
Yes
sqlite:vouch.db?mode=rwc
Database connection URL. Supports sqlite:, postgres:, and Aurora DSQL endpoints.
VOUCH_JWT_SECRET
Conditional
(empty)
JWT signing secret. Must be at least 32 characters. Must not consist of a single repeated character. Used to sign internal state tokens. Required unless VOUCH_JWT_HMAC_KMS_KEY_ID is set.
VOUCH_BASE_URL
No
https://{rp_id}
Base URL for this server. Auto-derived from VOUCH_RP_ID if not set (http://localhost:{port} for local dev, https://{rp_id} for production).
VOUCH_ORG_NAME
No
(none)
Organization name for branding in the UI. Falls back to VOUCH_RP_NAME if not set.
VOUCH_ALLOWED_DOMAINS
No
(none)
Comma-separated list of allowed email domains for enrollment (e.g., example.com,corp.example.com). If not set, all domains are allowed. Normalized to lowercase.
Configure one upstream IdP for enrollment: either OIDC or SAML 2.0. They are mutually exclusive — if both are configured, the server will refuse to start.
These variables configure an external OpenID Connect identity provider for enrollment. All three must be set together for OIDC enrollment to work. At startup, the server fetches the OIDC discovery document from {issuer}/.well-known/openid-configuration to auto-discover authorization, token, and JWKS endpoints.
Variable
Required
Default
Description
VOUCH_OIDC_ISSUER
No
(none)
OIDC issuer URL (e.g., https://accounts.google.com). Must serve a valid OIDC discovery document.
VOUCH_OIDC_CLIENT_ID
No
(none)
OIDC client ID from the external identity provider.
VOUCH_OIDC_CLIENT_SECRET
No
(none)
OIDC client secret from the external identity provider.
These variables configure an external SAML 2.0 identity provider for enrollment. VOUCH_SAML_IDP_METADATA_URL is required for SAML; the others are optional.
Variable
Required
Default
Description
VOUCH_SAML_IDP_METADATA_URL
No
(none)
URL to the SAML IdP metadata XML document. Fetched at server startup.
VOUCH_SAML_SP_ENTITY_ID
No
{VOUCH_BASE_URL}
SAML SP entity ID sent in authentication requests. Defaults to the server’s base URL.
VOUCH_SAML_EMAIL_ATTRIBUTE
No
(auto-detect)
SAML attribute name containing the user’s email address.
VOUCH_SAML_DOMAIN_ATTRIBUTE
No
(none)
SAML attribute name containing the user’s domain (for domain restriction).
OIDC signing key content (base64-encoded PEM format, P-256 ECDSA). Used for signing access tokens and ID tokens with ES256 algorithm. If not set, an ephemeral key is generated on each server restart (not recommended for production).
VOUCH_OIDC_RSA_SIGNING_KEY
No
(auto-generate)
OIDC RSA signing key content (base64-encoded PEM format, RSA-3072). Used for signing ID tokens with RS256 algorithm per OIDC Core Section 3.1.3.7. Minimum 3072-bit key enforced. If not set, an ephemeral key is generated on each server restart.
These variables configure the Vouch GitHub App integration for issuing GitHub tokens. The App ID, name, and key are required together for GitHub App functionality. OAuth client ID and secret are additionally needed for GitHub user authentication.
Variable
Required
Default
Description
VOUCH_GITHUB_APP_ID
No
(none)
GitHub App ID (numeric, assigned when creating the app on github.com).
VOUCH_GITHUB_APP_NAME
No
(none)
GitHub App name (the slug from github.com/apps/{name}).
VOUCH_GITHUB_APP_KEY
No
(none)
GitHub App private key (PEM format, RSA). Can use literal \n for newlines.
VOUCH_GITHUB_WEBHOOK_SECRET
No
(none)
GitHub webhook secret for verifying webhook signatures (HMAC-SHA256).
VOUCH_GITHUB_APP_CLIENT_ID
No
(none)
GitHub App Client ID for OAuth user authentication. Found in GitHub App settings (different from the numeric App ID).
VOUCH_GITHUB_APP_CLIENT_SECRET
No
(none)
GitHub App Client Secret for OAuth user authentication.
When both VOUCH_TLS_CERT and VOUCH_TLS_KEY are set, the server listens on port 443 (HTTPS) with an automatic HTTP-to-HTTPS redirect on port 80. The VOUCH_LISTEN_ADDR setting is ignored when TLS is configured.
Variable
Required
Default
Description
VOUCH_TLS_CERT
No
(none)
TLS certificate (base64-encoded PEM).
VOUCH_TLS_KEY
No
(none)
TLS private key (base64-encoded PEM). Required if VOUCH_TLS_CERT is set.