# Configuration index

> Find the full configuration-variable reference, common settings, hardened profiles, secret inputs, and deployment-specific requirements.

[Canonical HTML page](https://safeonlineexam.com/docs/reference/configuration)

The complete configuration reference — profiles and hardened validation, the
PostgreSQL settings, required application values, file-based secrets, Canvas/LTI
endpoint overrides, SEB and diagnostic options, and secret rotation — lives in the
Deploy section:

<Cards>
  <Card title="Configuration reference" href="/docs/deploy/configuration" description="Every runtime variable, its default, and its hardened requirement, plus the file-based-secret model and rotation consequences." />
</Cards>

## The variables you set most often [#the-variables-you-set-most-often]

| Variable                                            | What it is                                                                              |
| --------------------------------------------------- | --------------------------------------------------------------------------------------- |
| `TOOL_URL`                                          | Public HTTPS origin of this deployment.                                                 |
| `CANVAS_DOMAIN`                                     | The connected Canvas origin.                                                            |
| `LTI_CLIENT_ID`                                     | LTI 1.3 Developer Key client ID.                                                        |
| `LTI_DEPLOYMENT_ID`                                 | Installed External App deployment ID (allowlist supported).                             |
| `LTI_DEPLOYMENT_ID_CHECKING_ENABLED`                | `true` (strict) or `false` (controlled self-service).                                   |
| `CANVAS_API_CLIENT_ID` / `CANVAS_API_CLIENT_SECRET` | API OAuth Developer Key — distinct from the LTI key.                                    |
| `LTI_PRIVATE_KEY`                                   | RSA private JWK used to sign as the tool.                                               |
| `SESSION_SECRET` / `STATE_ENCRYPTION_KEY`           | Two different ≥32-char secrets.                                                         |
| `SEB_CONFIG_ENCRYPTION_CERT_PEM`                    | Public certificate used to encrypt `.seb` files when certificate encryption is enabled. |
| `DATABASE_*`                                        | PostgreSQL connection and pool settings.                                                |

For self-hosted Canvas, also see the endpoint overrides (`LTI_ISSUER`,
`LTI_KEY_SET_URL`, `LTI_AUTH_URL`) in
[Self-hosted Canvas](/docs/canvas/self-hosted-canvas).