Reference
Configuration index
A quick pointer to the full configuration-variable reference.
The complete configuration reference — profiles and hardened validation, the PostgreSQL settings, required application values, file-based secrets, Canvas/LTI endpoint overrides, SEB and diagnostic options, and secret rotation — lives in the Deploy section:
The variables you set most often
| Variable | What it is |
|---|---|
TOOL_URL | Public HTTPS origin of this deployment. |
CANVAS_DOMAIN | The connected Canvas origin. |
LTI_CLIENT_ID | LTI 1.3 Developer Key client ID. |
LTI_DEPLOYMENT_ID | Installed External App deployment ID (allowlist supported). |
LTI_DEPLOYMENT_ID_CHECKING_ENABLED | true (strict) or false (controlled self-service). |
CANVAS_API_CLIENT_ID / CANVAS_API_CLIENT_SECRET | API OAuth Developer Key — distinct from the LTI key. |
LTI_PRIVATE_KEY | RSA private JWK used to sign as the tool. |
SESSION_SECRET / STATE_ENCRYPTION_KEY | Two different ≥32-char secrets. |
SEB_CONFIG_ENCRYPTION_CERT_PEM | Public certificate that .seb files are encrypted to. |
DATABASE_* | PostgreSQL connection and pool settings. |
For self-hosted Canvas, also see the endpoint overrides (LTI_ISSUER,
LTI_KEY_SET_URL, LTI_AUTH_URL) in
Self-hosted Canvas.