> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Console environment variables

> The environment variables that connect Lerian Console to Midaz, Tracer, and Access Manager, and the ones that switch Console screens on or off.

Console reads these variables when its container starts. After you change one, restart the Console container. You do not need to rebuild the image.

To install or upgrade Console, see the [Console chart README](https://github.com/LerianStudio/helm/tree/main/charts/product-console).

## Product addresses

| Variable | Required | What it does |
| :- | :- | :- |
| `MIDAZ_V2_BASE_PATH` | Yes | The address of the Ledger `/v2` API, ending in `/v2/`. Console reads Fees, Holders, Alias Accounts, accounting routes, and operation routes from it. Without it, these pages fail. |
| `TRACER_BASE_PATH` | Only with Tracer | The address of the Tracer service, without `/v1`. |
| `MIDAZ_BASE_PATH` | Yes | The address of the Ledger API for organizations, ledgers, assets, accounts, portfolios, segments, and account types. Without it, these pages fail. |
| `MIDAZ_TRANSACTION_BASE_PATH` | Yes | The address of the Ledger API for transactions, operations, and balances. Without it, these pages fail. |
| `FLOWKER_BASE_PATH` | Only with Flowker | The address of the Flowker API. |
| `LENDER_BASE_PATH` | Only with Lender | The address of the Lender API, ending in `/api/v1`. |
| `PLUGIN_CONSIGNADO_BASE_PATH` | Only with Consignado CLT | The address of the Consignado CLT API, ending in `/v1`. |
| `REPORTER_BASE_PATH` | Only with Reporter | The address of the Reporter API. |
| `MATCHER_BASE_PATH` | Only with Matcher | The address of Matcher, without a path. |
| `NARYA_BASE_PATH` | Only with the Matcher copilot | The address of the copilot service that serves the [Matcher copilot](https://docs.lerian.studio/en/products/matcher/ui/matcher-copilot.md), without `/v1`. Unset or empty, the copilot is off and Matcher pages show no panel. The copilot also needs `PLUGIN_AUTH_ENABLED` set to `true`. |
| `STREAMING_HUB_BASE_PATH` | Only with Streaming Hub | The address of the Streaming Hub API. |
| `NOTIFICATION_BASE_PATH` | Only with Notification | The address of Notification, without a path. |
| `PLUGIN_PIX_INDIRECT_BTG_BASE_PATH` | Only with Pix BTG | The address of Pix BTG, without a path. |
| `PLUGIN_PAYMENTS_BASE_PATH` | Only with Payments | The address of the Payments API. |
| `PLUGIN_BANK_TRANSFER_BASE_PATH` | Only with Bank Transfer | The address of the Bank Transfer API. |

## License

| Variable | Required | What it does |
| :- | :- | :- |
| `LICENSE_KEY` | Yes | The Lerian license key of your deployment. Console does not start without it. Its readiness check answers 503 until a license is accepted. |

## Access Manager

| Variable | Default | What it does |
| :- | :- | :- |
| `PLUGIN_AUTH_ENABLED` | `true` | Turns on sign-in through Access Manager. Console derives `NEXT_PUBLIC_PLUGIN_AUTH_ENABLED` from it when that variable is unset. Console does not start unless `PLUGIN_AUTH_ENABLED` or `OAUTH_ENABLED` is `true`. |
| `PLUGIN_AUTH_BASE_PATH` | `http://plugin-auth:4000/v1` | The address of the Access Manager Auth API, ending in `/v1`. |
| `PLUGIN_AUTH_PUBLIC_BASE_PATH` | — | The address of the same Auth API as the browser reaches it. Console sends the browser there to start an SSO sign-in. Without it, Console uses `PLUGIN_AUTH_BASE_PATH`. |
| `PLUGIN_IDENTITY_BASE_PATH` | `http://plugin-identity:4001/v1` | The address of the Access Manager Identity API, ending in `/v1`. |
| `PLUGIN_AUTH_CLIENT_ID` | — | The client ID of the Access Manager application that Console signs users in with. Its secret is `PLUGIN_AUTH_CLIENT_SECRET`. |

## Sign-in options

| Variable | Default | What it does |
| :- | :- | :- |
| `ENABLE_FORGOT_PASSWORD` | `false` | Turns on password reset from the sign-in page. It is on only when the value is `true`. |
| `GOOGLE_DIRECTORY_ENABLED` | `false` | Turns on the Google Workspace directory card in **Settings** > **Security** > **Single Sign-On**. It is on only when the value is `true`. |
| `TRUSTED_PROXIES` | — | The address ranges, in CIDR form and separated by commas, of the proxies in front of Console. Console reads the caller address from the forwarded address header only past these ranges. Without it, Console derives no caller address. |
| `ALLOWED_ORIGINS` | — | The origins, separated by commas, from which Console accepts write requests, for example `https://console.example.com`. Without it, Console refuses every create, update, and delete. |

## Data store

Console connects to MongoDB with these variables.

| Variable | Default | What it does |
| :- | :- | :- |
| `MONGODB_URI` | `mongodb` | The connection scheme, for example `mongodb`. |
| `MONGO_HOST` | `midaz-mongodb` | The MongoDB host. |
| `MONGO_PORT` | `27017` | The MongoDB port. |
| `MONGODB_DB_NAME` | `midaz-console` | The database name. |
| `MONGODB_USER` | `midaz` | The database user. Its password is `MONGODB_PASS`. |
| `MONGO_PARAMETERS` | `directConnection=true` | The connection options that Console appends to the connection string. |
| `MONGO_TLS_CA_CERT` | — | The CA certificate for the MongoDB connection, as a base64-encoded PEM. |
| `MONGO_CONNECT_TIMEOUT` | `30000` | The time, in milliseconds, that Console waits for MongoDB at startup. |
| `MONGO_CONNECT_RETRIES` | `5` | The number of connection attempts at startup. |

## Account types

| Variable | Default | What it does |
| :- | :- | :- |
| `MIDAZ_ACCOUNT_TYPE_VALIDATION_ENABLED` | `false` | Turns on account type validation in Console. It is on only when the value is `true`. |
| `MIDAZ_ACCOUNT_TYPE_VALIDATION` | — | The organization and ledger pairs, written as `<organization-id>:<ledger-id>` and separated by commas. Console skips a pair that does not have this shape. |

## Telemetry

| Variable | Default | What it does |
| :- | :- | :- |
| `ENABLE_TELEMETRY` | `true` | Turns on the export of traces, metrics, and logs. It is on only when the value is `true`. |
| `OTEL_EXPORTER_OTLP_ENDPOINT` | `http://localhost:4318` | The collector address that Console uses for an `OTEL_URL_*` variable that is empty. |
| `OTEL_URL_TRACES` | `http://infra:4318/v1/traces` | The address for traces. |
| `OTEL_URL_METRICS` | `http://infra:4318/v1/metrics` | The address for metrics. |
| `OTEL_URL_LOGS` | `http://infra:4318/v1/logs` | The address for logs. |

## Secrets

Keep `NEXTAUTH_SECRET`, `MONGODB_PASS`, and `PLUGIN_AUTH_CLIENT_SECRET` in your secret vault. Never put them in a file in your repository or in an image.

## Screens

| Variable | What it controls |
| :- | :- |
| `NEXT_PUBLIC_MIDAZ_CONSOLE_AVATAR_ALLOWED_FORMAT` | The image formats accepted for avatars, separated by commas, for example `jpeg,jpg,png`. |
| `NEXT_PUBLIC_PARTNERS_ENABLED` | The **Partners** entry of Settings and the **Partners** card on the home page. They are on unless the value is `false`. |
| `NEXT_PUBLIC_BANK_TRANSFER_ENABLED` | The Bank Transfer screens of the Midaz module. They are off unless the value is `true`. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.