Version: 1.0

Environment variables and configuration

All configuration is via environment variables. Every variable has a development default so the AS runs without any environment setup locally.

Environment variables

Variable	Default	Purpose
`PBAC_ADMIN_API_KEY`	(blank — admin endpoints open)	API key required for the Admin API (`/admin/`) and AuthZEN (`/access/`) endpoints. When blank, these endpoints are unprotected. Set to a strong random value in production.
`PBAC_BUNDLE_API_KEY`	`dev-bundle-key`	API key required for the bundle endpoint (`/bundles/**`). OPA sends this when fetching the policy bundle. Set to a strong random value in production.
`PBAC_OIDC_ISSUER`	`http://localhost:8080`	OIDC issuer URL. Returned in `/.well-known/openid-configuration` and embedded in issued tokens. Must match the public URL of the AS.
`OPA_URL`	`http://localhost:8181`	Base URL of the OPA instance. The AS appends `/v1/data/oauth/token`, `/v1/data/oauth/authorize`, etc.
`PBAC_TRUSTED_PROXY_COUNT`	`0`	Number of trusted reverse proxy hops for `X-Forwarded-For` processing. Set to `1` (or more) if the AS sits behind a load balancer.
`PBAC_SOFTWARE_STATEMENT_VERIFY`	`false`	Whether to verify JWT signatures on Dynamic Client Registration (DCR) software statements. Set to `true` in production with a configured JWKS endpoint.
`PBAC_DPOP_ENABLED`	`true`	Master switch for DPoP support. When `false`, the token endpoint rejects requests that include a `DPoP` header.
`PBAC_DPOP_IAT_WINDOW_SECONDS`	`60`	Maximum age of a DPoP proof's `iat` claim in seconds. Proofs older than this are rejected.
`PBAC_DPOP_SIGNING_ALGS`	`ES256,RS256`	Comma-separated list of accepted DPoP proof signing algorithms.
`PBAC_DPOP_NONCE_ENABLED`	`false`	Whether the AS requires server-issued nonces in DPoP proofs. When `true`, the AS issues a `DPoP-Nonce` response header and requires clients to include it in subsequent proofs.
`PBAC_DPOP_NONCE_TTL_SECONDS`	`300`	Validity window for issued nonces in seconds.
`LOKI_URL`	`http://localhost:3100`	Loki push endpoint for structured log aggregation. See Logging & Observability.
`INSTANCE_NAME`	`local`	Instance label for Loki log tagging. Used for multi-instance filtering in Grafana dashboards.

Production checklist

Set PBAC_ADMIN_API_KEY to a strong secret. By default this is blank and the admin endpoints are unprotected — always set this in production.
Set PBAC_BUNDLE_API_KEY to a strong secret. The default dev-bundle-key must not be used in production. OPA must be configured with this key when fetching the bundle.
Set PBAC_OIDC_ISSUER to the public HTTPS URL of your AS.
Set PBAC_SOFTWARE_STATEMENT_VERIFY=true if accepting DCR registrations from external parties.

Spring Boot properties

Additional runtime configuration (database URL, connection pool, Flyway, logging) is managed via application.properties / application-dev.properties in src/main/resources/. These follow standard Spring Boot conventions and can be overridden with environment variables using the SPRING_ prefix or -- flags on the command line.

See the Spring Boot Externalized Configuration docs for override precedence.

Rate limiting

The authorization server does not implement application-level rate limiting. Rate limiting must be configured at the reverse proxy layer (e.g., nginx, HAProxy, cloud load balancer) before production deployment.

Recommended limits:

Endpoint	Suggested Limit	Rationale
`POST /token`	30 req/s per client_id	Prevent credential stuffing
`POST /introspect`	100 req/s per caller IP	High-frequency RS calls expected
`GET /authorize`	20 req/s per client_id	User-facing, lower throughput
`POST /register`	5 req/min per IP	DCR abuse prevention
`GET /bundles/**`	10 req/min per IP	OPA polls every 10-30s

These are starting points — adjust based on observed traffic patterns.

Next steps

OPA Setup — Configure OPA as an external sidecar and connect it to the AS bundle server
Kubernetes — Deploy the AS and OPA to Kubernetes with Helm and GitOps
Troubleshooting — Diagnose common issues with bundles, tokens, and connectivity