> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Environment variables > Deploy-time environment variables distinctive to Lerian Consignado — Dataprev — the Dataprev integration adapters and the per-tenant credential custody store. Lerian Consignado — Dataprev is the Lerian-owned gateway that integrates payroll-lending flows with Dataprev. These variables are set at deploy time and require a service restart to take effect. The universal backbone that every Lerian Go service shares — server, datastores, multi-tenancy, telemetry, plugin authentication, and licensing — is documented once in [BYOC configuration essentials](/en/reference/byoc-configuration); this page covers only the variables distinctive to Lerian Consignado. In the tables below, the **Default / Required** column shows the default value; a bold qualifier (e.g. **Required**, **Required in managed deployments**) marks variables that must be set. `—` means no default. Any variable flagged **Sensitive** carries credential or key material — inject it from your secret manager at deploy time and never commit a value. ## Service and runtime | Variable | Default / Required | Description | | --------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `SERVER_ADDRESS` | `:8080` | Main HTTP listen address. The liveness, readiness, metrics, and version probes bind this same port. | | `ENVIRONMENT_NAME` | `staging` | Runtime environment: `staging` or `production`. Arms stricter security gates in `production`. `ENV_NAME` is accepted as an alternative name. | | `SYSTEMPLANE_ENABLED` | `false` | Enable the [Systemplane](/en/reference/systemplane/overview) runtime-configuration admin API under the `/system` prefix on the main port. Off by default (environment-variable-only mode). | | `DEFAULT_TENANT_ID` | `default` | Tenant identifier used in single-tenant mode. | Lerian Consignado exposes `/health` (liveness) and `/readyz` (readiness) on the main port, plus `/version` and `/metrics`, and — when multi-tenancy is enabled — `GET /readyz/tenant/{id}`. See [Health and readiness](/en/reference/health-and-readiness) for the probe contract. ## Dataprev integration Each Dataprev flow is gated by its own switch and selects an adapter. `disabled` and the local fake adapters are for development only; a managed deployment provisions the real adapter and its per-tenant credentials through the custody store below. | Variable | Default / Required | Description | | ------------------------------------------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- | | `DATAPREV_AVERBACAO_ENABLED` | `false` | Independent opt-in for the averbação (margin-consumption) money path. Averbação stays unsubscribed unless this is enabled alongside streaming. | | `DATAPREV_EMPLOYMENT_REPORT_ENABLED` | `false` | Enable the employment-status report flow. | | `DATAPREV_EMPLOYMENT_REPORT_ADAPTER` | `disabled` | Employment-report adapter. `disabled` is the no-op default. | | `DATAPREV_EMPLOYMENT_REPORT_INTERVAL_SEC` | `3600` | Employment-report poll cadence, in seconds. | | `DATAPREV_EMPLOYMENT_REPORT_PAGE_SIZE` | `100` | Records read per employment-report page. | | `DATAPREV_EMPLOYMENT_REPORT_CONCURRENCY` | `4` | Concurrent employment-report workers. | | `DATAPREV_EXCLUSION_ENABLED` | `false` | Enable the exclusion flow. | | `DATAPREV_EXCLUSION_ADAPTER` | `disabled` | Exclusion adapter. `disabled` is the no-op default. | | `DATAPREV_EXCLUSION_PROVIDER_TIMEOUT_SEC` | `30` | Per-request timeout, in seconds, for exclusion provider calls. | | `DATAPREV_EXCLUSION_CLAIM_DWELL_SEC` | `60` | Dwell before a claimed exclusion item is retried. | | `DATAPREV_EXCLUSION_STATUS_CHECK_LEASE_SEC` | `60` | Lease for the exclusion status-check worker. | | `DATAPREV_EXCLUSION_RECOVERY_INTERVAL_SEC` | `30` | Exclusion recovery-sweep cadence, in seconds. | | `DATAPREV_EXCLUSION_RECOVERY_BATCH` | `50` | Exclusion items processed per recovery pass. | | `DATAPREV_EXCLUSION_RECOVERY_CONCURRENCY` | `4` | Concurrent exclusion recovery workers. | | `DATAPREV_REDIRECTION_ADAPTER` | `disabled` | Redirection adapter. `disabled` is the no-op default. | ## Credential custody Per-tenant Dataprev certificate and OAuth credentials are custodied through a managed secret store. Managed deployments must enable it — the boot guard refuses to start a managed deployment while it is off. | Variable | Default / Required | Description | | --------------------------------------------- | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `CREDENTIALS_STORE_ENABLED` | `false` · **Required in managed deployments** | Enable the per-tenant credential custody store. Must be `true` in production, multi-tenant, SaaS, or BYOC deployments; a managed deployment refuses to boot while it is `false`. | | `CREDENTIALS_CLEANUP_INTERVAL_SEC` | `30` | Credential-cleanup sweep cadence, in seconds. | | `CREDENTIALS_CLEANUP_BATCH_SIZE` | `50` | Credentials processed per cleanup pass. | | `CREDENTIALS_CLEANUP_CONCURRENCY` | `4` | Concurrent credential-cleanup workers. | | `CREDENTIALS_CLEANUP_LEASE_SEC` | `60` | Lease for the credential-cleanup worker. | | `CREDENTIALS_CLEANUP_PERSISTENCE_TIMEOUT_SEC` | `5` | Per-operation persistence timeout, in seconds. | | `AWS_REGION` | `us-east-1` | Region for the secrets-manager custody backend. Credentials resolve through the default AWS SDK chain. | | `AWS_ENDPOINT_URL` | — | AWS-compatible endpoint override for local development. Leave unset in real AWS environments; production must not set it. |