Environment variables¶

Every environment variable keryx reads, and what reads it. This list is exhaustive.

Environment variables cannot override configuration keys¶

keryx has no environment layer over its configuration. It sets no env prefix, and the config store is assembled from files and changed flags only. WORKSPACE_ROOT, PROVIDERS_IMAGE, KERYX_PROVIDERS_IMAGE and every other name derived from a config key are ignored.

Everything below is a specific variable that a specific piece of code looks up by name. Adding a new one is a code change, not a naming convention.

Generation API keys¶

Read directly by the adapter, never from configuration, so a key is never committed.

Variable	Read by
`GEMINI_API_KEY`	the Gemini image adapter, and the chat client when the chat provider is `gemini`
`ELEVENLABS_API_TOKEN`	the ElevenLabs voice and music adapters
`ANTHROPIC_API_KEY`	the chat client when the chat provider is `claude` or `claude-local`
`OPENAI_API_KEY`	the chat client when the chat provider is `openai` or `openai-compatible`

When providers.chat.provider is unset, keryx infers the chat provider from exactly one of ANTHROPIC_API_KEY, GEMINI_API_KEY and OPENAI_API_KEY being present. Two or more present is an error asking you to choose — see providers.chat.*.

Platform credentials¶

Each platform resolves its token environment variable → OS keychain → config key. The config fallback is plaintext, so the environment or the keychain is preferred.

Variable	Platform	Holds
`INSTAGRAM_ACCESS_TOKEN`	Instagram	access token
`INSTAGRAM_APP_SECRET`	Instagram	app secret, for the OAuth exchange
`YOUTUBE_REFRESH_TOKEN`	YouTube	refresh token
`YOUTUBE_CLIENT_SECRET`	YouTube	OAuth client secret
`TIKTOK_REFRESH_TOKEN`	TikTok	rotating refresh token
`TIKTOK_CLIENT_SECRET`	TikTok	OAuth client secret
`LINKEDIN_ACCESS_TOKEN`	LinkedIn	access token
`LINKEDIN_REFRESH_TOKEN`	LinkedIn	refresh token, only issued to Marketing Developer Platform apps
`LINKEDIN_CLIENT_SECRET`	LinkedIn	OAuth client secret

Rendering¶

Variable	Read by
`KERYX_FFMPEG_WASI`	the `afmpeg` renderer, as the fallback for `providers.render.module` — a host path or an `https://` URL

Because providers.render and providers.render.module cannot both be expressed in configuration, this variable is the working way to point afmpeg at a locally-built or mirrored ffmpeg-wasi module. It is checked only when providers.render.module resolves to empty, and an unset variable leaves the pinned published module in force.

Token write-back and alerting¶

Variable	Read by
`GITLAB_TOKEN`	`auth.writeback.backend: gitlab` — an api-scoped access token. Required; the backend refuses without it.
`CI_PROJECT_ID`	the GitLab write-back, when `auth.writeback.gitlab.project` is unset
`CI_API_V4_URL`	the GitLab write-back, when `auth.writeback.gitlab.api_url` is unset
`ALERT_WEBHOOK_URL`	the webhook alert backend; takes precedence over `auth.alerts.webhook.url`
`ALERT_SMTP_USERNAME`	the email alert backend; takes precedence over `auth.alerts.email.username`
`ALERT_SMTP_PASSWORD`	the email alert backend; takes precedence over `auth.alerts.email.password`

Environment the studio inspects¶

Variable	Read by
`SSH_AUTH_SOCK`	the studio, to report whether an ssh-agent is available for a remote git project

A project registry entry may also name an environment variable of your choosing to hold an ssh key path (ssh.key.env). That name is data, not a fixed variable — see Author against a remote repo over SSH.

Environment used only by the test suites¶

These gate tests and have no effect on a released binary: INT_TEST, INT_TEST_<GROUP>, INT_TEST_E2E, and the fixture-writing switches KERYX_WRITE_LAYOUT_CASES and KERYX_WRITE_PARITY_GOLDEN.