Environment variables

Assign every value to one owner. Browser-prefixed variables are public after a build and must never contain a secret.

Browser-owned values

Typical browser configuration includes the wallet and relayer origins, project-environment identity, publishable key, chain RPC and explorer URLs, network identity, and RP ID base. Validate required strings before building SeamsConfigsInput.

Service-owned values

The gateway or relayer owns request-authentication verification material, provider credentials, rate-limit and storage bindings, allowed origins, and network execution configuration. Expose only the minimal public metadata required by the SDK.

Custody-role values

Sealing credentials, service-to-service credentials, ceremony signing material, database bindings, and deployment tokens belong only to their owning protected environment. A single job or operator should not receive both independent Derivers' private material where administrative isolation is claimed.

Tenant-root operational shares are generated by their owning Derivers and stored encrypted in role-private D1. They are not manually configured deployment-wide root secrets. Managed backup ciphertext belongs in the role's R2 bucket. Google KMS wrapping-key material stays in KMS; the Worker receives the key reference and a role-scoped credential permitted to invoke it.

Keep key references distinct from credential secrets. Neither belongs in browser-prefixed configuration. See tenant-root backups for the current shared-key and administration limits.

Change discipline

Keep one reviewed environment contract per deployment lane. Fail startup or preflight when a required value is missing or belongs to the wrong lane. Rotate secrets through the owning boundary, then verify revocation of the old value. Never print secret values during validation.