Environment variables

api-test resolves ${VAR} and ${VAR:-default} placeholders in its YAML config at load time. Plain $VAR (no braces) is left untouched so Postgres DSN-style strings don't get rewritten.

This page documents the conventional APITEST_* variables the shipped configs expect.

Convention

api_keys:
  file:
    - { name: "devkey", key: "${APITEST_DEV_KEY:-devkey-please-change}" }

${APITEST_DEV_KEY:-devkey-please-change} resolves to the env var when set, else to the literal default. Use the default form for fixtures that should "just work" out of the box; use the bare ${APITEST_DEV_KEY} form for required values where missing should fail loudly.

Generated by make dev-secrets

make dev-secrets writes .env.dev (gitignored) with random secrets on first run. Subsequent runs reuse the file so sessions persist.

Variable	Used in	Description
APITEST_COOKIE_SECRET	portal.cookie_secret	HMAC secret for the portal session cookie.
APITEST_DEV_KEY	api_keys.file[0].key	Default static API key for dev-mode auth.
APITEST_DEV_BEARER	bearer.tokens[0].token	Default static bearer token.

source ./.env.dev to load them into the current shell.

OIDC

Variable	Used in	Description
APITEST_OIDC_ISSUER	oidc.issuer	OIDC issuer URL.
APITEST_OIDC_AUDIENCE	oidc.audience	Expected aud claim.
APITEST_INSECURE	n/a (gate)	When set to 1, allows oidc.skip_signature_verification: true in config. Never set in production.

Database

Variable	Used in	Description
APITEST_DB_URL	database.url	PostgreSQL DSN. The shipped api-test.example.yaml interpolates this.

Plexara self-registration (M5+)

Variable	Used in	Description
PLEXARA_ADMIN_URL	plexara.register.admin_url	Plexara admin API URL.
PLEXARA_ADMIN_AUTH	plexara.register.auth_header	Authorization header value (e.g. Bearer <token>).

Logging

Variable	Description
LOG_LEVEL	One of debug, info (default), warn, error. Lowercase or uppercase.

Healthcheck

Variable	Description
APITEST_HEALTHCHECK_URL	URL --healthcheck probes. Defaults to http://127.0.0.1:8080/healthz. Useful when the binary listens on a non-default port inside a container.