# Configuration Reference

Synqly Embedded supports reading configuration through both command-line flags
and environment variables. This page lists every available option and is updated
automatically when new configuration options are added.

## If You Use the Helm Chart

The Synqly Embedded Helm chart automatically generates a mixture of command-line
flags and environment variables based on the values in your `values.yaml`. Non-sensitive
values, such as ports and hostnames, are passed as command-line flags. Secrets,
such as database passwords and tokens, are set as environment variables read
from Kubernetes Secrets, so they never appear in observability tool run arg logging.

If you use the Synqly Embedded Helm Chart, this page is only required for options
that the chart doesn't yet expose through `values.yaml`. When setting these values,
add the variable to `embedded.environmentVariables` in your `values.yaml`. For a secret,
use `valueFrom` so the value stays in a Kubernetes Secret:


```yaml
embedded:
  environmentVariables:
    - name: SYNQLY_<FLAG>
      valueFrom:
        secretKeyRef:
          name: <SECRET_NAME>
          key: <SECRET_KEY>
```

## If You Run Synqly Embedded Another Way

When running Synqly Embedded outside of Helm, such as with Docker or Google Cloud Run,
you set every option yourself. Each option below has a command-line flag and an
equivalent environment variable. Use whichever makes the best sense for your setup.
We recommend environment variables for secrets, as they are generally better protected
from accidental logging or exposure.

## How Options Are Read

- Each environment variable is the flag name in upper case, with `-` replaced by
`_` and a `SYNQLY_` prefix. For example, `--db-pass` reads `SYNQLY_DB_PASS`.
The tables below show the few options that use a different name.
- The order of precedence is CLI flags > environment variables > config file > default
values. CLI flags will override any other setting, and CLI flags, environment variables,
and config files will always be read instead of a default value.
- Synqly Embedded ignores an environment variable that is set but empty, and
uses the next source instead.
- If a value can't be read, such as text for a number option, Synqly Embedded
stops at startup with an error that names the variable. The error doesn't
include the value to protect against logging sensitive values.


## Options

### Organization, Root Token, and Admin

| Option  | Details  | Description |
|  --- | --- | --- |
| `--admin`
`SYNQLY_ADMIN`
 | String
Optional
 | Username of a default organization administrator. Only applied on the first Synqly Embedded run against a clean database
 |
| `--admin-password`
`SYNQLY_ADMIN_PASSWORD`
 | String
Optional
 | Password of the default organization administrator. Only applied on the first Synqly Embedded run against a clean database
 |
| `--invite-member`
`SYNQLY_INVITE_MEMBER`
 | String
Optional
 | Comma-separated email addresses to invite as organization administrators
 |
| `--organization-fullname`
`SYNQLY_ORGANIZATION_FULLNAME`
 | String
Optional
 | Display name of the Synqly Organization created on first startup, such as `Acme Corp`
 |
| `--organization-name`
`SYNQLY_ORGANIZATION_NAME`
 | String
**Required**
 | ID of the Synqly Organization created on first startup. Use a lowercase, hyphenated string such as `acme-corp`
 |
| `--silent`
`SYNQLY_SILENT`
 | Boolean
Optional
Default: `false`
 | Disable printing the auto-generated organization token to the log when the organization is first created
 |
| `--token`
`SYNQLY_TOKEN`
 | String
**Required**
 | Root token used to administer Synqly Embedded and create the first organization. Generate one with `openssl rand -base64 32`
 |
| `--token-signing-key`
`SYNQLY_TOKEN_SIGNING_KEY`
 | String
**Required**
 | Base64-encoded 32-byte key that signs organization and integration tokens. Generate one with `openssl rand -base64 32`
 |


### Networking and URLs

| Option  | Details  | Description |
|  --- | --- | --- |
| `--allow-address`
`SYNQLY_ALLOW_ADDRESS`
 | List
Optional
 | Allowed DNS, IPv4 and IPv6 host:port egress addresses and optional port (port defaults to 443 or 80; IPv6 addresses must be enclosed in '[]'). Required for any embedded integrations using non-public IP addresses such as an internal SIEM test instance
 |
| `--api-ingress-url`
`SYNQLY_API_INGRESS_URL`
 | String
Optional
 | Public base URL of the Synqly API, such as `https://synqly-api.acme.com`. Used for provider webhook URLs, Shared Signals issuers, and JWKS URLs
 |
| `--ingress-url`
`SYNQLY_INGRESS_URL`
 | String
Optional
 | Base URL of the management UI, such as `https://synqly.acme.com`. Used for SAML and OIDC redirect URLs
 |
| `--port`
`SYNQLY_PORT`
 | Integer
Optional
Default: `8000`
 | Port the Synqly API listens on
 |
| `--requests-per-min`
`SYNQLY_REQUESTS_PER_MIN`
 | Integer
Optional
Default: `6000`
 | Requests per minute allowed for the root token. Must be between 100 and 1000000
 |
| `--tls-crt`
`SYNQLY_TLS_CRT`
 | String
Optional
 | Path to a PEM TLS certificate file the Synqly API uses to serve HTTPS
 |
| `--tls-key`
`SYNQLY_TLS_KEY`
 | String
Optional
 | Path to the PEM private key file for `--tls-crt`
 |


### Database

| Option  | Details  | Description |
|  --- | --- | --- |
| `--db-host`
`SYNQLY_DB_HOST`
 | String
Optional
Default: `localhost`
 | Database host address
 |
| `--db-idle-in-transaction-timeout`
`SYNQLY_DB_IDLE_IN_TRANSACTION_TIMEOUT`
 | Duration
Optional
Default: `5m0s`
 | How long a session may sit idle inside an open transaction before the server terminates it, releasing the row locks it holds
 |
| `--db-name`
`SYNQLY_DB_NAME`
 | String
Optional
Default: `synqly`
 | Database name
 |
| `--db-pass`
`SYNQLY_DB_PASS`
 | String
Optional
 | Database password
 |
| `--db-port`
`SYNQLY_DB_PORT`
 | Integer
Optional
Default: `26257`
 | Database port
 |
| `--db-user`
`SYNQLY_DB_USER`
 | String
Optional
Default: `root`
 | Database user
 |


### Encryption Keys

Set `SYNQLY_KMS_TYPE`, then the options for that key management service.

| Option  | Details  | Description |
|  --- | --- | --- |
| `--kms-akv-base-url`
`SYNQLY_KMS_AKV_BASE_URL`
 | String
Optional
 | Azure Key Vault DNS suffix (e.g. vault.usgovcloudapi.net for Azure US Government); defaults to vault.azure.net
 |
| `--kms-akv-key`
`SYNQLY_KMS_AKV_KEY`
 | String
Optional
 | Azure KMS Key name (bring your own key)
 |
| `--kms-akv-rotation-period`
`SYNQLY_KMS_AKV_ROTATION_PERIOD`
 | String
Optional
Default: `365d`
 | Azure rotation period in days [90d-2560d], 0d to disable rotation
 |
| `--kms-aws-access-key-id`
`SYNQLY_KMS_AWS_ACCESS_KEY_ID`
 | String
Optional
 | AWS access key id
 |
| `--kms-aws-kms-key`
`SYNQLY_KMS_AWS_KMS_KEY`
 | String
Optional
 | AWS KMS key (KMS alias, arn or id: bring your own key)
 |
| `--kms-aws-region`
`SYNQLY_KMS_AWS_REGION`
 | String
**Required if** `--kms-type=aws`
 | AWS region of the KMS keys
 |
| `--kms-aws-role-arn`
`SYNQLY_KMS_AWS_ROLE_ARN`
 | String
Optional
 | ARN of the IAM role used to access AWS KMS
 |
| `--kms-aws-rotation-period`
`SYNQLY_KMS_AWS_ROTATION_PERIOD`
 | String
Optional
Default: `365d`
 | AWS rotation period in days [90d-2560d], 0d to disable rotation
 |
| `--kms-aws-secret-access-key`
`SYNQLY_KMS_AWS_SECRET_ACCESS_KEY`
 | String
Optional
 | AWS secret access key
 |
| `--kms-gcp-credentials-file`
`SYNQLY_KMS_GCP_CREDENTIALS_FILE`
 | String
Optional
 | Path to a GCP service account key JSON file. Leave unset to use Application Default Credentials
 |
| `--kms-gcp-key`
`SYNQLY_KMS_GCP_KEY`
 | String
Optional
 | Full resource name of a pre-existing GCP KMS key to use instead of generated keys, such as `projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<key>`
 |
| `--kms-gcp-keyring`
`SYNQLY_KMS_GCP_KEYRING`
 | String
**Required if** `--kms-type=gcp`
 | GCP keyring name
 |
| `--kms-gcp-project`
`SYNQLY_KMS_GCP_PROJECT`
 | String
**Required if** `--kms-type=gcp`
 | GCP project id
 |
| `--kms-gcp-region`
`SYNQLY_KMS_GCP_REGION`
 | String
**Required if** `--kms-type=gcp`
 | GCP region name
 |
| `--kms-gcp-rotation-period`
`SYNQLY_KMS_GCP_ROTATION_PERIOD`
 | String
Optional
Default: `365d`
 | GCP rotation period in days [1d-3650d], 0d to disable rotation
 |
| `--kms-id`
`SYNQLY_KMS_ID`
 | String
Optional
 | Azure application client id
 |
| `--kms-secret`
`SYNQLY_KMS_SECRET`
 | String
Optional
 | Azure application client secret value
 |
| `--kms-tenant`
`SYNQLY_KMS_TENANT`
 | String
Optional
 | Azure application tenant id
 |
| `--kms-type`
`SYNQLY_KMS_TYPE`
 | String
Optional
Default: `aead`
 | Key management service that holds the encryption keys: `aws`, `azure`, `gcp`, or `vault`. The default, `aead`, doesn't use an external key service
 |
| `--kms-vault`
`SYNQLY_KMS_VAULT`
 | String
**Required if** `--kms-type=azure`
 | Azure key vault name
 |
| `--kms-vault-address`
`SYNQLY_KMS_VAULT_ADDRESS`
 | String
**Required if** `--kms-type=vault`
 | HashiCorp Vault address, such as `https://vault.acme.com:8200`
 |
| `--kms-vault-mount`
`SYNQLY_KMS_VAULT_MOUNT`
 | String
**Required if** `--kms-type=vault`
 | Path of the HashiCorp Vault transit secrets engine, such as `transit/`
 |
| `--kms-vault-role-id`
`SYNQLY_KMS_VAULT_ROLE_ID`
 | String
Optional
 | Vault approle role id
 |
| `--kms-vault-secret-id`
`SYNQLY_KMS_VAULT_SECRET_ID`
 | String
Optional
 | Vault approle secret id
 |
| `--kms-vault-token`
`SYNQLY_KMS_VAULT_TOKEN`
 | String
Optional
 | Vault access token
 |


### SMTP

Synqly Embedded uses SMTP to send invite and password reset emails.

| Option  | Details  | Description |
|  --- | --- | --- |
| `--smtp-domain`
`SYNQLY_SMTP_DOMAIN`
 | String
Optional
Default: `https://app.synqly.com`
 | Base URL of the management UI, used for links in invite and password reset emails
 |
| `--smtp-pass`
`SYNQLY_SMTP_PASS`
 | String
Optional
 | SMTP password
 |
| `--smtp-reply-to`
`SYNQLY_SMTP_REPLY_TO`
 | String
Optional
 | Reply-to address for invite and password reset emails
 |
| `--smtp-server`
`SYNQLY_SMTP_SERVER`
 | String
**Required if** `--invite-member` is set
 | SMTP server (e.g. smtp-mail.outlook.com:587)
 |
| `--smtp-user`
`SYNQLY_SMTP_USER`
 | String
Optional
 | SMTP user
 |


### AWS Role Assumption (Optional)

Synqly Embedded only uses these options to assume an AWS role for integrations that use AWS role-based authentication. Safe to leave unset if you only support IAM User authentication to AWS hosted providers. To assume the role, Synqly Embedded uses the AWS SDK's default credentials, such as IRSA, EKS Pod Identity, or the standard `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` variables.

| Option  | Details  | Description |
|  --- | --- | --- |
| `--aws-assumer-role`
`SYNQLY_AWS_ASSUMER_ROLE`
 | String
Optional
 | ARN of the AWS role used for cross-account role assumption
 |
| `--aws-region`
`AWS_REGION`
 | String
Optional
 | AWS region used for role assumption
 |


### Bridge (Optional)

Synqly Embedded only uses these options for the Bridge feature. Safe to leave unset if you don't use Bridge.

| Option  | Details  | Description |
|  --- | --- | --- |
| `--bridge-account-nkey-file`
`SYNQLY_BRIDGE_ACCOUNT_NKEY_FILE`
 | String
Optional
 | Path to the Bridge account NKey seed file
 |
| `--bridge-creds`
`SYNQLY_BRIDGE_CREDS`
 | String
Optional
 | Path to the Bridge credentials file
 |
| `--bridge-server-address`
`SYNQLY_BRIDGE_SERVER_ADDRESS`
 | List
Optional
 | Synqly bridge server address (e.g. tls://bridge.synqly.com:4222)
 |


### Other

| Option  | Details  | Description |
|  --- | --- | --- |
| `--features`
`SYNQLY_FEATURES`
 | String
Optional
 | JSON object of feature flag overrides
 |
| `--level`
`SYNQLY_LEVEL`
 | Integer
Optional
Default: `1`
 | Log level: `0` (debug), `1` (info), `2` (warning), or `3` (error)
 |
| `--license-file`
`SYNQLY_LICENSE_FILE`
 | String
Optional
Default: `/etc/synqly/license.json`
 | Path to the Synqly license file. Only required if you need the embedded container to run for more than 90 days without a version upgrade. Reach out to Synqly Support for more details
 |