Environment variables
Most are documented in .env.example (app), services/harbor/.env.example (engine) and services/ap4m-merchants/.env.example. A few app variables are read by code but not yet listed there: HARBOR_X402_URL, HARBOR_X402_API_KEY, AGENTCORE_MODE and MASTERCARD_OF_MODE (PILOT_PUBLIC_ORIGIN is present but commented out). These are the ones you are most likely to touch. Secrets stay server-side and are never committed.
Engine
Name Values Purpose HARBOR_API_KEYSsecret, principal:token,... Bearer credentials. HARBOR_KEKsecret, Base64 of 32 bytes Key-encryption key for delegate and payer keys. EXEC_NETWORKtestnet | devnetExecution network. MAINNET_EXECUTIONfalseAlways false. HARBOR_SOURCE_TAG2610240SourceTag on every built transaction. EXECUTORdynamic | quickjsScript sandbox runtime. HARBOR_MCP_EXECUTION_ENABLEDunset | true | false false makes MCP search-only.HARBOR_DEPLOYMENT_PROFILEe.g. paid-dynamic Other profiles disable REST. HARBOR_LOCAL_DEVtrueLocal bearer-less principal on loopback. HARBOR_PUBLIC_URLURL Where QuickNode posts hooks. AUTONOMOUS_STRATEGY_RUNNERfalseStrategy runner switch. QN_MODEoff | mock | liveQuickNode .GUARDRAILS_MODE, GUARDRAILS_THRESHOLDoff | mock | aws; 0.8AWS .KMS_MODE, HARBOR_KEK_CIPHERTEXToff | kek | signAWS .AP4M_DEMO_ENABLED, AP4M_EVM_EVENT_ENABLED, AP4M_EVM_EVENT_MODEfalse; false; off | mockMastercard .MASTERCARD_MCP_ENABLEDunset | true | false Developers MCP federation. BITHOMP_API_KEYoptional Indexer fallback.
App
Name Values Purpose PILOT_DEPLOYMENT_PROFILElocal-wallet | local-wallet-isolated-v1 | hostedRequired. Never mix profile artifacts. PILOT_PUBLIC_ORIGINexact HTTPS origin Hosted only. HARBOR_MOCK1 | 0In-process mock or a real engine. HARBOR_URL, HARBOR_API_KEYURL; secret Engine connection (server only). HARBOR_X402_URL, HARBOR_X402_API_KEYURL; secret x402-only engine (isolated profile). PILOT_HOSTED_STATE_API_KEYsecret Hosted-state persistence. EXEC_NETWORKtestnet | devnetMust match the engine. NEXT_PUBLIC_DEV_SIGNER0 | 1Test-network browser signer. Hosted refuses 1. SESSION_SECRETsecret, ≥ 32 chars Sessions and wallet-action proofs. P_LIVE_RLUSD_ACQUISITION_STATE_DIRabsolute path, mode 0700 Replay markers. Required for chat. MODEL_DEFAULT, OPENROUTER_ALLOWED_MODELSmodel IDs OpenRouter .DEMO_MODEL_ENABLED and DEMO_MODEL_*default off Free demo model limits. BEDROCK_MODE, BEDROCK_MODELS, BEDROCK_DAILY_TURN_CAP, AWS_BEARER_TOKEN_BEDROCKBedrock models. AGENTCORE_MODEoff | standin | awsAgentCore research. LEDGER_MODE, LEDGER_SPECULOS_URL, LEDGER_DEFAULT_ACCOUNT_INDEXLedger .MASTERCARD_OF_MODEmock | sandboxOpen Finance. VAULT_BACKEND, VAULT_PATH, VAULT_GITHUB_TOKEN, VAULT_REPOVault .PILOT_STRUCTURED_PREFERENCES, PILOT_PERSONALIZATION_BACKEND, PILOT_PERSONALIZATION_STATE_DIRMemory .BACKTEST_EXTERNAL_READS_ENABLED, BACKTEST_QUOTA_*default off Backtesting .PILOT_HERMES_ENABLED0Hermes .
Any value outside the documented set fails closed at startup. For example, HARBOR_MOCK must be exactly 1 or 0, and a hosted profile with LEDGER_SPECULOS_URL set refuses to start.