Environment Variables Reference
Auto-generated
This page is auto-generated from backend/.env.example. Do not edit manually.
Server
| Variable | Default | Required | Description |
|---|---|---|---|
PORT | 4005 | Yes | — |
NODE_ENV | development | Yes | — |
Licensing & Deployment
| Variable | Default | Required | Description |
|---|---|---|---|
LICENSE_KEY | your_license_jwt_here | Yes | Signed JWT issued by the ThreatWeaver License Manager (TLM). Resolution order: 1) license_config DB table (set via UI), 2) this env var. Obtain from https://license.threatweaver.ai or your self-hosted TLM instance. |
DEPLOYMENT_ID | * | No | Unique identifier that binds this instance to its license. Use * to accept any deployment in development/air-gapped environments. In production, set to the ID provided with your license. |
DEPLOYMENT_MODE | — | No | Deployment mode. Controls multi-tenant vs single-tenant behaviour. Valid values: saas | dedicated | (empty string for standalone/self-hosted) |
LICENSE_CHECKIN_URL | https://license.threatweaver.ai | No | Phone-home URL. Omit for offline/air-gapped deployments. The app calls POST /api/license/checkin every 24 h against this URL. |
MACHINE_ID | — | No | Override the machine identity used for license binding. Useful in containers where the host fingerprint changes between restarts. |
TW_DATA_DIR | ./data | No | Directory for persistent license state and instance-id file. Defaults to ./data relative to the working directory. |
Multi-tenant Configuration
| Variable | Default | Required | Description |
|---|---|---|---|
DEDICATED_TENANT_SLUG | — | No | Only needed when DEPLOYMENT_MODE=dedicated or when connecting to a TLM. Slug for the tenant this dedicated instance serves (e.g. "acme-corp"). |
DEDICATED_TENANT_PLAN | enterprise | No | Plan tier for the dedicated tenant. Default: enterprise Valid values: starter | professional | enterprise |
TLM_BASE_URL | https://tlm.threatweaver.ai | No | Base URL of the ThreatWeaver License Manager (TLM) API. |
TLM_VENDOR_API_KEY | your-tlm-vendor-api-key-here | No | Vendor API key issued by TLM for instance-to-TLM communication. |
TW_INTERNAL_API_KEY | — | No | Internal API key used for service-to-service calls within the platform. Generate with: openssl rand -hex 32 |
TENANT_CACHE_TTL_SECONDS | 300 | No | How long (seconds) to cache resolved tenant records. Default: 300 |
TENANCY_MODE | — | No | Tenancy mode for the migration guard. Typically set automatically by TLM. Valid values: multi | single | (empty) |
TW_SERVICE_PRIVATE_KEY | — | No | SERVICE-TO-SERVICE AUTH (ES256 JWT Tokens) Replaces simple API keys with asymmetric JWT service tokens for TLM ↔ TW. Generate key pairs with: npx tsx scripts/generate-service-keypair.ts tw This service's ES256 private key (PEM, base64-encoded for single-line storage) Used to SIGN outbound tokens when calling TLM. |
TLM_SERVICE_PUBLIC_KEY | — | No | TLM's ES256 public key (PEM, base64-encoded) Used to VERIFY inbound tokens from TLM on /api/internal/* routes. |
Initial Admin User
| Variable | Default | Required | Description |
|---|---|---|---|
INITIAL_ADMIN_EMAIL | admin@company.com | No | Used only during first-time database bootstrap when no admin exists. Change the password immediately after first login! |
INITIAL_ADMIN_PASSWORD | changeme123 | No | — |
INITIAL_ADMIN_NAME | System Administrator | No | — |
Tenable Api
| Variable | Default | Required | Description |
|---|---|---|---|
TENABLE_ACCESS_KEY | your_tenable_access_key_here | Yes | Obtain your API keys from https://cloud.tenable.com/ → Settings → API Keys. |
TENABLE_SECRET_KEY | your_tenable_secret_key_here | Yes | — |
TENABLE_API_URL | https://cloud.tenable.com | No | — |
DATABASE_URL | postgresql://tenable:tenable_secure_password_change_me@localhost:5432/tenable_dashboard | Yes | DATABASE (PostgreSQL) Primary connection string (takes precedence over individual DB_* vars). |
DB_HOST | localhost | No | Individual connection parameters (used by seeds/scripts when DATABASE_URL is absent). |
DB_PORT | 5432 | No | — |
DB_NAME | tenable_dashboard | No | — |
DB_USER | tenable | No | — |
DB_PASSWORD | tenable_secure_password_change_me | No | — |
DB_READ_REPLICA_URL | postgresql://tenable:password@replica-host:5432/tenable_dashboard | No | Read replica connection string for heavy read workloads. Leave unset to route all queries to the primary. |
DB_POOL_MAX | 10 | No | Maximum connections in the TypeORM connection pool. Default: 10 |
DB_SSL_REJECT_UNAUTHORIZED | true | No | Set to false to allow self-signed TLS certs (never in production). Default: true (reject unauthorized certificates). |
ENCRYPTION_SALT | — | Yes | Salt for key derivation (min 8 chars). Generate with: openssl rand -hex 16 WARNING: Changing this after data has been encrypted will break decryption. |
Security & Encryption
| Variable | Default | Required | Description |
|---|---|---|---|
ENCRYPTION_KEY | your_32_character_encryption_key | Yes | 32-character hex key for encrypting secrets at rest (e.g. 2FA seeds, API keys). Must be exactly 32+ characters. Generate with: openssl rand -hex 16 |
APPSEC_ENCRYPTION_KEY | — | No | Separate encryption key for AppSec payload sanitization. Falls back to ENCRYPTION_KEY if not set. |
Jwt
| Variable | Default | Required | Description |
|---|---|---|---|
JWT_SECRET | your_super_secret_jwt_key_change_in_production_min_32_chars | Yes | Secret for signing access tokens. Minimum 32 characters. Generate with: openssl rand -hex 32 |
JWT_EXPIRES_IN | 1d | No | Access token lifetime. Default: 15m (short for security). |
JWT_REFRESH_SECRET | your_refresh_token_secret_change_in_production | Yes | Separate secret for refresh tokens. Generate with: openssl rand -hex 32 |
JWT_REFRESH_EXPIRES_IN | 7d | No | Refresh token lifetime. Default: 7d |
Session
| Variable | Default | Required | Description |
|---|---|---|---|
SESSION_TIMEOUT_MINUTES | 30 | No | Idle session timeout in minutes. Default: 30 |
Rate Limiting
| Variable | Default | Required | Description |
|---|---|---|---|
RATE_LIMIT_WINDOW_MS | 60000 | No | Rolling window duration in milliseconds. Default: 60000 (1 minute) |
RATE_LIMIT_MAX_REQUESTS | 100 | No | Max requests per IP per window. Default: 100 |
Cors
| Variable | Default | Required | Description |
|---|---|---|---|
CORS_ORIGIN | http://localhost:3005,http://127.0.0.1:3005 | No | Comma-separated list of allowed origins. Wildcards are NOT supported. |
App Urls
| Variable | Default | Required | Description |
|---|---|---|---|
BASE_URL | https://api.threatweaver.ai | No | Override the public-facing URLs. The app infers these from the request when not set, but explicit values are recommended for production deployments. Public base URL of this backend (no trailing slash). |
FRONTEND_URL | https://threatweaver.ai | No | Public URL of the frontend (used in email links, OAuth redirects, etc.). |
BACKEND_URL | https://api.threatweaver.ai | No | Explicit backend URL (used by SSO callbacks and CI/CD status webhooks). Falls back to BASE_URL or the incoming request host if not set. |
Redis
| Variable | Default | Required | Description |
|---|---|---|---|
REDIS_URL | redis://localhost:6379 | No | Redis is optional locally — the app degrades gracefully without it. In production, Redis is strongly recommended for session and response caching. |
REDIS_HOST | localhost | No | — |
REDIS_PORT | 6379 | No | — |
REDIS_ENABLED | true | No | Set to false to explicitly disable Redis (e.g. for local-only deploys). Default: true |
Runtime Tuning
| Variable | Default | Required | Description |
|---|---|---|---|
REQUEST_TIMEOUT_MS | 30000 | No | HTTP request timeout in milliseconds. Default: 30000 (30 s) |
Feature Flags
| Variable | Default | Required | Description |
|---|---|---|---|
ALLOW_DEMO_LOGIN | true | No | Allow demo/test login credentials (admin@company.com / changeme123). ONLY enable in non-production environments. Never set to true in production. |
SYNC_STREAMING_ENABLED | true | No | Enable streaming (chunked transfer) for large Tenable sync responses. Default: true |
SYNC_CHUNK_SIZE | 100 | No | Number of records per chunk during streaming sync. Default: 100 |
Logging
| Variable | Default | Required | Description |
|---|---|---|---|
LOG_LEVEL | debug | No | Valid values: debug | info | warn | error |
Cache Ttl
| Variable | Default | Required | Description |
|---|---|---|---|
CACHE_TTL | 3600 | No | Default server-side cache TTL in seconds. Default: 3600 (1 h) |
API_CACHE_TTL | 21600 | No | Tenable API response cache TTL in seconds. Default: 21600 (6 h) |
AZURE_CLIENT_ID | — | No | SSO — AZURE AD (OPTIONAL) Register an app at https://portal.azure.com → Azure Active Directory → App registrations. |
AZURE_CLIENT_SECRET | — | No | — |
AZURE_TENANT_ID | — | No | — |
OKTA_DOMAIN | — | No | SSO — OKTA (OPTIONAL) Create an OIDC app at https://developer.okta.com/. |
OKTA_CLIENT_ID | — | No | — |
OKTA_CLIENT_SECRET | — | No | — |
GOOGLE_CLIENT_ID | — | No | SSO — GOOGLE OAUTH (OPTIONAL) Configure at https://console.cloud.google.com/ → APIs & Services → Credentials. |
GOOGLE_CLIENT_SECRET | — | No | — |
SMTP_HOST | smtp.example.com | No | SMTP — EMAIL NOTIFICATIONS (OPTIONAL) Required for password-reset emails, alert notifications, and scan reports. |
SMTP_PORT | 587 | No | — |
SMTP_USER | notifications@example.com | No | — |
SMTP_PASS | your-smtp-password-here | No | — |
SMTP_FROM | ThreatWeaver <noreply@threatweaver.io> | No | — |
Appsec / Pentest AI (Optional)
| Variable | Default | Required | Description |
|---|---|---|---|
APPSEC_AI_PROVIDER | openai | No | Enables AI-assisted vulnerability analysis and report generation. Provider for AI features. Valid values: openai | anthropic | azure_openai |
APPSEC_AI_API_KEY | your-ai-api-key-here | No | API key for the chosen AI provider. |
APPSEC_AI_MODEL | gpt-4o | No | Model name to use (e.g. gpt-4o, claude-3-5-sonnet-20241022). |
APPSEC_AI_RESIDENCY_MODE | cloud_hybrid | No | Data residency mode for AI calls. Valid values: cloud_hybrid | cloud_only | on_prem Default: cloud_hybrid |
APPSEC_CALLBACK_URL | https://oob.threatweaver.ai | No | Public URL for out-of-band (OOB) callback server (Blind SSRF/XXE probes). Defaults to http://localhost:4005 if not set. |
APPSEC_CALLBACK_DOMAIN | oob.threatweaver.ai | No | Domain used for DNS-based OOB detection (Blind SSRF via DNS). |
Intelligence Feeds (Optional)
| Variable | Default | Required | Description |
|---|---|---|---|
NVD_API_KEY | your-nvd-api-key-here | No | API keys for external threat intelligence data sources. NVD (National Vulnerability Database) API key — increases rate limits. Register at https://nvd.nist.gov/developers/request-an-api-key |
GITHUB_TOKEN | ghp_your-github-token-here | No | GitHub personal access token — used for zero-day PoC discovery via GitHub search. Requires at minimum: public_repo read scope. Create at https://github.com/settings/tokens |
SHODAN_API_KEY | your-shodan-api-key-here | No | Shodan API key — used by the OSINT scanner agent for internet exposure data. Obtain at https://account.shodan.io/ |
Generated on 2026-04-04