Skip to main content
Generated projects do not require environment variables by default. Use these variables when you add local encrypted credentials, API-key auth, or runtime health checks that need a key.

​
Quick Start

​
Variables

​
FENTARIS_AUTH_KEY

Encryption key used to decrypt local credentials in .fentaris/credentials.enc.json.
fentaris doctor checks whether this variable is present before verifying encrypted credentials when a local credential store exists. Local fentaris secrets and fentaris auth api-key commands resolve the key in this order: --key, the exported process environment, then the discovered project .env. A shell export overrides the project .env. On the first command that writes an encrypted local credential store, the CLI generates a random project key in .env when no key is configured. Read-only commands do not create a key, and projects without encrypted credentials do not require one. If credentials.enc.json already exists, Fentaris never replaces its missing key automatically; provide the original key so the store remains recoverable. fentaris secrets setup applies the same precedence and creates the key only when its plan needs the local encrypted backend. It also writes prompted credentialEnv(...) values to .env with file mode 0600. Existing shell values and .env assignments are left unchanged. Generated dev and start scripts load .env automatically. fentaris dev also loads the discovered project .env before starting the package script. For an older SDK-only project, update direct launch commands to load the file explicitly, for example node --env-file-if-exists=.env dist/index.js. The core does not mutate process.env or load dotenv files implicitly. Retain this value through your normal local secret-management process. The same value is required for future reads and updates. Do not commit .env or expose the key in command output.

​
FENTARIS_GUEST_API_KEY

API key used by runtime health checks for projects that still use a guest user convention.
Use this key in the x-fentaris-api-key header when connecting a client to a proxy that enables API-key identity.

​
FENTARIS_ADMIN_API_KEY

API key used by runtime health checks for projects that still use an admin user convention.
Use this key in the x-fentaris-api-key header when connecting a client to a proxy that enables API-key identity.

​
FENTARIS_API_KEY

Fallback API key used by runtime health checks when a guest or admin key is not present.

​
FENTARIS_EDGE_CONTROL_PLANE_URL

Control-plane base URL used by legacy fentaris-edge login and as the saved default after fentaris edge join device authorization and enrollment.
Prefer the explicit zero-global-install flow for first enrollment:
Use HTTPS. The enrolled gateway URL must use wss://; ws:// is accepted only for loopback development.

​
FENTARIS_EDGE_ALLOWED_EXECUTABLES

Comma-separated exact executable paths or basenames that the edge agent may start after local recipe consent. The default is empty and denies every direct executable.

​
FENTARIS_EDGE_ALLOWED_PACKAGES

Comma-separated exact package names that the edge agent may launch through npx, pnpm, yarn, or bunx. The default is empty.
Allow the concrete executable or package. Do not allow a general shell interpreter as a workaround.
Edge Control inventory, selection, and fan-out limits are application configuration, not environment variables. Configure them under McpProxyOptions.edge.control so policy review and deployment configuration remain explicit.

​
Upstream Credential Variables

Servers can also read arbitrary environment variables through credential sources.
The exact variable name depends on the project code and upstream server. Every declared credential source is required when the proxy starts. Before opening HTTP, Edge, or another first exposure transport, Fentaris resolves all declarations directly from the runtime configuration. Missing variables, unreadable local files, wrong encryption keys, or absent JSON paths are aggregated in FENTARIS_CREDENTIALS_UNAVAILABLE; run fentaris secrets setup or follow the manual action for a custom source.
Do not commit .env or .fentaris/credentials.enc.json. Generated projects ignore both by default.