docs

English

日本語

English

日本語

Appearance

Environment variables

Separate public browser configuration, server request credentials, and custody-role secrets across Seams deployment environments.

Environment variables ​

Assign each configuration value to one owner. A build exposes browser-prefixed variables publicly. Never put secrets in these variables.

Browser-owned values ​

Typical browser configuration includes the wallet and relayer origins, project-environment identity, publishable key, chain RPC and explorer URLs, network identity, and RP ID base. Validate required strings before building SeamsConfigsInput.

Example configuration ​

Use VITE_WALLET_ORIGIN, VITE_RELAYER_URL, and VITE_SEAMS_PUBLISHABLE_KEY for the compiled browser examples. A publishable key identifies its project environment; it is public configuration. Keep the application and wallet iframe origins in that environment's allowed origins.

Documentation origins ​

The public docs build uses / as its base path. VITE_DOCS_ORIGIN sets canonical and sitemap URLs. Use https://docs.wallet.seams.sh for production. VITE_WALLET_SITE_ORIGIN selects the parent Wallet site link. Staging deployments must request noindex through their existing HTTP headers. Local preview settings must not enter production builds.

Service-owned values ​

The gateway or relayer owns request-authentication verification material, provider credentials, rate-limit and storage bindings, allowed origins, and network execution configuration. Expose only the minimal public metadata required by the SDK.

Custody-role values ​

Sealing credentials, service-to-service credentials, ceremony signing material, database bindings, and deployment tokens belong only to their owning protected environment. A single job or operator should not receive both independent Derivers' private material where administrative isolation is claimed.

Tenant-root operational shares are generated by their owning Derivers and stored encrypted in role-private D1. They are not manually configured deployment-wide root secrets. Managed backup ciphertext belongs in the role's R2 bucket. Google KMS wrapping-key material stays in KMS. The Worker receives the key reference and a role-scoped credential that permits use of that key.

Keep key references distinct from credential secrets. Neither belongs in browser-prefixed configuration. See tenant-root backups for the current shared-key and administration limits.

Change discipline ​

Keep one reviewed environment contract per deployment lane. Fail startup or preflight when a required value is missing or belongs to the wrong lane. Rotate each secret through its owning service. Then verify that the old value no longer works. Never print secret values during validation.