# Gateway Environment Variables

## Core Gateway Configuration <a href="#core-gateway-configuration" id="core-gateway-configuration"></a>

<table><thead><tr><th width="138.91015625">CLI Parameter</th><th>Environment Variable</th><th>Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>-d, --debug</code></td><td><code>KEEPER_GATEWAY_LOG_LEVEL</code></td><td><code>info</code></td><td>Sets logging level. Valid values: <code>debug</code>, <code>info</code>, <code>warning</code>, <code>error</code>, <code>critical</code></td></tr><tr><td><code>--verbose</code></td><td><code>KEEPER_GATEWAY_VERBOSE</code></td><td></td><td>Enable verbose logging</td></tr><tr><td><code>--log-file</code></td><td><code>KEEPER_GATEWAY_LOG_FILE</code></td><td>Generated based on timestamp</td><td>Specifies the log file path</td></tr><tr><td><code>--log-folder</code></td><td><code>KEEPER_GATEWAY_LOG_FOLDER</code></td><td><code>~/.keeper/logs</code> or <code>/var/log/keeper-gateway</code> for service</td><td>Specifies the log folder location</td></tr><tr><td><code>--config-file, -c</code></td><td><code>GATEWAY_CONFIG_PATH</code></td><td><code>~/.keeper/gateway-config.json</code></td><td>Path to the gateway configuration file</td></tr><tr><td>N/A</td><td><code>GATEWAY_CONFIG</code></td><td>None</td><td>Base64 encoded configuration string</td></tr><tr><td><code>--aws-kms-secret-name</code></td><td><code>AWS_KMS_SECRET_NAME</code></td><td>None</td><td>AWS KMS secret name for configuration</td></tr><tr><td>N/A</td><td><code>VERIFY_SSL</code></td><td><code>TRUE</code></td><td>Whether to verify SSL certificates</td></tr><tr><td>N/A</td><td><code>KRELAY_SERVER</code></td><td>Auto-detected from config</td><td>Override the TURN/STUN relay server</td></tr><tr><td>N/A</td><td><code>INSECURE_DEBUG</code></td><td><code>False</code></td><td>Show passwords in logs</td></tr><tr><td><code>--show-cmds</code></td><td><code>KEEPER_GATEWAY_SHOW_CMDS</code></td><td><code>False</code></td><td>Show commands being executed</td></tr><tr><td><code>--max-workers, -w</code></td><td><code>KEEPER_GATEWAY_MAX_WORKERS</code></td><td>1 for process pool, 10 for thread pool</td><td>Number of worker processes/threads</td></tr><tr><td><code>--log-to-stdout</code></td><td><code>KEEPER_GATEWAY_LOG_TO_STDOUT</code></td><td><code>False</code></td><td>Output logs to stdout instead of file</td></tr><tr><td>N/A</td><td><code>GUACD_HOST</code></td><td><code>127.0.0.1</code></td><td>Host for guacd service</td></tr><tr><td>N/A</td><td><code>GUACD_PORT</code></td><td><code>4822</code></td><td>Port for guacd service</td></tr><tr><td>N/A</td><td><code>GUACD_PATH</code></td><td><code>pyguacd</code> (Windows) or <code>/opt/keeper/sbin/guacd</code> (Linux)</td><td>Path to guacd executable</td></tr><tr><td><code>--tunnel-only-use-turn</code></td><td><code>KEEPER_GATEWAY_TUNNEL_ONLY_USE_TURN</code></td><td><code>False</code></td><td>Force use of TURN relay only</td></tr><tr><td>N/A</td><td><code>RECORDING_PATH</code></td><td><code>/recording_pipes</code></td><td>Path for session recordings (removed after session ends)</td></tr><tr><td>N/A</td><td><code>TYPE_SCRIPT_RECORDING_PATH</code></td><td><code>/recording_pipes</code></td><td>Path for typescript recordings (removed after session ends)</td></tr><tr><td>N/A</td><td><code>KEEPER_GATEWAY_CVE_SECURITY_CHECKS</code></td><td><code>false</code></td><td>Enable CVE security checks during initialization</td></tr><tr><td>N/A</td><td><code>KEEPER_GATEWAY_USE_GUACR</code></td><td><code>false</code></td><td>Use Guacamole recording (guacr) instead of standard</td></tr></tbody></table>

## Connection Timeout Variables (Gateway) <a href="#connection-timeout-variables-gateway" id="connection-timeout-variables-gateway"></a>

<table><thead><tr><th>Environment Variable</th><th width="119.65234375">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_SET_LOCAL_DESCRIPTION_TIMEOUT</code></td><td><code>15s</code></td><td>Time to set local description in WebRTC</td></tr><tr><td><code>KEEPER_GATEWAY_OPEN_CONNECTION_TIMEOUT</code></td><td><code>60s</code></td><td>Time to wait for connection establishment</td></tr><tr><td><code>KEEPER_GATEWAY_CREATE_ANSWER_TIMEOUT</code></td><td><code>30s</code></td><td>Time to create peer ICE answer</td></tr><tr><td><code>KEEPER_GATEWAY_READ_TIMEOUT</code></td><td><code>15s</code></td><td>Time to wait for data from data channel</td></tr><tr><td><code>KEEPER_GATEWAY_NON_PARED_READ_TIMEOUT</code></td><td><code>5s</code></td><td>Time to wait for data before paring</td></tr><tr><td><code>KEEPER_GATEWAY_CLOSE_CONNECTION_TIMEOUT</code></td><td><code>5s</code></td><td>Time to wait for connection closure</td></tr><tr><td><code>KEEPER_GATEWAY_TEST_CONNECTION_TIMEOUT</code></td><td><code>5s</code></td><td>Time to wait for test connection</td></tr><tr><td><code>KEEPER_GATEWAY_ABRUPT_DISCONNECTION_TIMEOUT</code></td><td><code>3s</code></td><td>Time to detect abrupt disconnection</td></tr><tr><td><code>KEEPER_GATEWAY_FORCE_CLOSE_TIMEOUT</code></td><td><code>6s</code></td><td>Time to force close connection</td></tr><tr><td><code>KEEPER_GATEWAY_RUST_CLEANUP_TIMEOUT</code></td><td><code>5s</code></td><td>Time for Rust cleanup operations</td></tr><tr><td><code>KEEPER_GATEWAY_ACCEPT_OFFER_TIMEOUT</code></td><td>calculated</td><td>Time to accept WebRTC offer (create_answer + set_local_description + 10)</td></tr><tr><td><code>KEEPER_GATEWAY_RECORDINGS_PATH_TIMEOUT</code></td><td><code>20s</code></td><td>Time to create recording path</td></tr><tr><td><code>KEEPER_GATEWAY_GUACD_RECEIVE_TIMEOUT</code></td><td><code>15s</code></td><td>Time to receive from Guacamole daemon</td></tr><tr><td><code>KEEPER_GATEWAY_DATA_CHANNEL_TIMEOUT</code></td><td><code>5s</code></td><td>Time for data channel send</td></tr><tr><td><code>KEEPER_GATEWAY_CONNECTION_ESTABLISHMENT_TIMEOUT</code></td><td><code>15s</code></td><td>Time to establish connection</td></tr><tr><td><code>KEEPER_GATEWAY_JIT_ACCOUNT_CREATION_TIMEOUT</code></td><td><code>90s</code></td><td>Time for JIT ephemeral user creation</td></tr><tr><td><code>KEEPER_GATEWAY_RECORDINGS_PATH_EPHEMERAL_TIMEOUT</code></td><td><code>60s</code></td><td>Time for ephemeral recording path setup</td></tr></tbody></table>

## Rust WebRTC Module (pam-rustwebrtc) Variables <a href="#rust-webrtc-module-pam-rustwebrtc-variables" id="rust-webrtc-module-pam-rustwebrtc-variables"></a>

### Backend I/O Configuration <a href="#backend-i-o-configuration" id="backend-i-o-configuration"></a>

<table><thead><tr><th width="310.59375">Environment Variable</th><th width="125.6484375">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_BACKEND_FLUSH_TIMEOUT_MS</code></td><td><code>50ms</code></td><td>Maximum time to wait for backend flush() to complete</td></tr><tr><td><code>KEEPER_GATEWAY_MAX_FLUSH_FAILURES</code></td><td><code>5</code></td><td>Number of consecutive flush failures before closing connection</td></tr><tr><td><code>KEEPER_GATEWAY_CHANNEL_SHUTDOWN_GRACE_MS</code></td><td><code>100ms</code></td><td>Grace period before signaling channels to exit during tube close</td></tr></tbody></table>

### Channel Cleanup Timeouts <a href="#channel-cleanup-timeouts" id="channel-cleanup-timeouts"></a>

<table><thead><tr><th>Environment Variable</th><th width="129.1171875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_DATA_CHANNEL_CLOSE_TIMEOUT_SECS</code></td><td><code>3s</code></td><td>Timeout for data channel close operation</td></tr><tr><td><code>KEEPER_GATEWAY_PEER_CONNECTION_CLOSE_TIMEOUT_SECS</code></td><td><code>5s</code></td><td>Timeout for peer connection close operation</td></tr><tr><td><code>KEEPER_GATEWAY_DISCONNECT_TO_EOF_DELAY_MS</code></td><td><code>100ms</code></td><td>Delay between disconnect message and EOF in Drop cleanup</td></tr></tbody></table>

### ICE / Connection Establishment <a href="#ice-connection-establishment" id="ice-connection-establishment"></a>

<table><thead><tr><th>Environment Variable</th><th width="133.4140625">Default</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_ICE_GATHER_TIMEOUT_SECS</code></td><td><code>30s</code></td><td>ICE gathering timeout for initial connection</td></tr><tr><td><code>KEEPER_GATEWAY_ICE_RESTART_ANSWER_TIMEOUT_SECS</code></td><td><code>10s</code></td><td>Timeout waiting for ICE restart answer from remote peer</td></tr><tr><td><code>KEEPER_GATEWAY_ICE_DISCONNECTED_WAIT_SECS</code></td><td><code>2s</code></td><td>Wait time after ICE disconnected before triggering restart</td></tr></tbody></table>

### Activity Monitoring <a href="#activity-monitoring" id="activity-monitoring"></a>

<table><thead><tr><th>Environment Variable</th><th width="139.9140625">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_ACTIVITY_TIMEOUT_SECS</code></td><td><code>120s</code></td><td>Inactivity duration before considering ICE restart</td></tr><tr><td><code>KEEPER_GATEWAY_STALE_TUBE_SWEEP_INTERVAL_SECS</code></td><td><code>300s</code></td><td>How often stale tube sweeper runs</td></tr></tbody></table>

### Concurrency / Scale <a href="#concurrency-scale" id="concurrency-scale"></a>

<table><thead><tr><th>Environment Variable</th><th width="140.51171875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_MAX_CONCURRENT_CREATES</code></td><td><code>100</code></td><td>Maximum concurrent tube creations allowed</td></tr></tbody></table>

### Router / HTTP Timeouts <a href="#router-http-timeouts" id="router-http-timeouts"></a>

<table><thead><tr><th>Environment Variable</th><th width="142.73828125">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_ROUTER_HTTP_TIMEOUT_SECS</code></td><td><code>5s</code></td><td>HTTP timeout for router API calls</td></tr><tr><td><code>KEEPER_GATEWAY_TUBE_CREATION_TIMEOUT_SECS</code></td><td><code>15s</code></td><td>Total timeout for tube creation</td></tr><tr><td><code>KEEPER_GATEWAY_ROUTER_CIRCUIT_BREAKER_COOLDOWN_SECS</code></td><td><code>60s</code></td><td>Circuit breaker cooldown after router failures</td></tr><tr><td><code>KEEPER_GATEWAY_ROUTER_CIRCUIT_BREAKER_THRESHOLD</code></td><td><code>3</code></td><td>Number of consecutive router failures before opening circuit breaker</td></tr></tbody></table>

### WebRTC Logging <a href="#webrtc-logging" id="webrtc-logging"></a>

<table><thead><tr><th>Environment Variable</th><th width="137.9296875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_INCLUDE_WEBRTC_LOGS</code></td><td><code>false</code></td><td>Include WebRTC library logs (very verbose). Set to "1" or "true" to enable</td></tr><tr><td><code>KPAM_ROUTER_HOST</code></td><td>Derived from KSM config</td><td>Router hostname override</td></tr></tbody></table>

## Health Check Variables <a href="#health-check-variables" id="health-check-variables"></a>

<table><thead><tr><th>Environment Variable</th><th width="139.55859375">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_HEALTH_CHECK_ENABLED</code></td><td><code>false</code></td><td>Enable health check server</td></tr><tr><td><code>KEEPER_GATEWAY_HEALTH_CHECK_HOST</code></td><td><code>127.0.0.1</code></td><td>Health check server bind address</td></tr><tr><td><code>KEEPER_GATEWAY_HEALTH_CHECK_PORT</code></td><td><code>8099</code></td><td>Health check server port</td></tr><tr><td><code>KEEPER_GATEWAY_HEALTH_CHECK_USE_SSL</code></td><td><code>false</code></td><td>Enable SSL for health check</td></tr><tr><td><code>KEEPER_GATEWAY_HEALTH_CHECK_SSL_CERT</code></td><td>None</td><td>Path to SSL certificate</td></tr><tr><td><code>KEEPER_GATEWAY_SSL_KEY</code></td><td>None</td><td>Path to SSL private key</td></tr><tr><td><code>KEEPER_GATEWAY_HEALTH_CHECK_AUTH_TOKEN</code></td><td>None</td><td>Authentication token for health check API</td></tr></tbody></table>

## Resource Management Variables <a href="#resource-management-variables" id="resource-management-variables"></a>

<table><thead><tr><th width="306.1171875">Environment Variable</th><th width="141.28515625">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td>Environment Variable</td><td>Default</td><td>Purpose</td></tr><tr><td><code>KEEPER_GATEWAY_RESOURCE_CHECK_ENABLED</code></td><td><code>true</code></td><td>Enable resource checking to prevent starvation</td></tr><tr><td><code>KEEPER_GATEWAY_MIN_HEADROOM_PERCENT</code></td><td><code>15</code></td><td>Minimum memory headroom percentage to maintain</td></tr><tr><td><code>KEEPER_GATEWAY_CHECK_RBI_CAPACITY</code></td><td><code>true</code></td><td>Check if RBI session can fit in available resources</td></tr><tr><td><code>KEEPER_GATEWAY_HTTP_RAM_MB</code></td><td><code>800</code></td><td>RAM requirement for RBI/HTTP connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_RDP_RAM_MB</code></td><td><code>75</code></td><td>RAM requirement for RDP connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_VNC_RAM_MB</code></td><td><code>65</code></td><td>RAM requirement for VNC connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_SSH_RAM_MB</code></td><td><code>70</code></td><td>RAM requirement for SSH connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_MYSQL_RAM_MB</code></td><td><code>35</code></td><td>RAM requirement for MySQL connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_POSTGRESQL_RAM_MB</code></td><td><code>35</code></td><td>RAM requirement for PostgreSQL connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_SQLSERVER_RAM_MB</code></td><td><code>35</code></td><td>RAM requirement for SQL Server connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_KUBERNETES_RAM_MB</code></td><td><code>70</code></td><td>RAM requirement for Kubernetes connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_TELNET_RAM_MB</code></td><td><code>50</code></td><td>RAM requirement for Telnet connections (MB)</td></tr><tr><td><code>KEEPER_GATEWAY_TUNNEL_RAM_MB</code></td><td><code>35</code></td><td>RAM requirement for tunnel/port forwarding (MB)</td></tr></tbody></table>

## RBI (Remote Browser Isolation) Variables <a href="#rbi-remote-browser-isolation-variables" id="rbi-remote-browser-isolation-variables"></a>

<table><thead><tr><th width="311.48828125">Environment Variable</th><th width="136.32421875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_RBI_PROFILE_STORAGE_PATH</code></td><td><code>/opt/keeper/gateway/rbi-profiles</code></td><td>Directory for browser session persistence profiles</td></tr></tbody></table>

## AI / Threat Detection Variables <a href="#ai-threat-detection-variables" id="ai-threat-detection-variables"></a>

<table><thead><tr><th width="310.5546875">Environment Variable</th><th width="143.58984375">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KEEPER_GATEWAY_AI_LLM_PROVIDER</code></td><td><code>openai-generic</code></td><td>AI LLM provider (<code>aws-bedrock</code>, <code>anthropic</code>, <code>google-ai</code>, <code>vertex-ai</code>, <code>openai</code>, <code>azure-openai</code>, <code>openai-generic</code>)</td></tr><tr><td><code>KEEPER_GATEWAY_AI_MODEL</code></td><td>None (required)</td><td>AI model name/identifier</td></tr><tr><td><code>KEEPER_GATEWAY_AI_API_KEY</code></td><td>None (required)</td><td>API key for AI provider</td></tr><tr><td><code>KEEPER_GATEWAY_AI_BASE_URL</code></td><td>None (optional)</td><td>Base URL for AI provider API</td></tr><tr><td><code>KEEPER_GATEWAY_AI_API_VERSION</code></td><td>None (required for Azure)</td><td>API version for Azure OpenAI</td></tr><tr><td><code>KEEPER_GATEWAY_AI_RISK_LEVEL_SOURCE</code></td><td>None</td><td>Source for risk level classification</td></tr><tr><td><code>RISK_CLASSIFIER_MODEL_DIR</code></td><td>None</td><td>Directory containing risk classifier model</td></tr><tr><td><code>KEEPER_GATEWAY_SENTRY_API_KEY</code></td><td>None</td><td>API key for Sentry threat detection</td></tr><tr><td><code>KEEPER_GATEWAY_SENTRY_BASE_URL</code></td><td>None</td><td>Base URL for Sentry service</td></tr><tr><td><code>KEEPER_GATEWAY_SENTRY_MODEL</code></td><td>None</td><td>Model identifier for Sentry</td></tr></tbody></table>

### AWS Bedrock Variables <a href="#aws-bedrock-variables" id="aws-bedrock-variables"></a>

<table><thead><tr><th width="311.88671875">Environment Variable</th><th width="146.359375">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>AWS_REGION</code></td><td>None (required)</td><td>AWS region for Bedrock</td></tr><tr><td><code>AWS_PROFILE</code></td><td>None (optional)</td><td>AWS profile for credentials</td></tr><tr><td><code>AWS_ACCESS_KEY_ID</code></td><td>None (optional)</td><td>AWS access key</td></tr><tr><td><code>AWS_SECRET_ACCESS_KEY</code></td><td>None (optional)</td><td>AWS secret access key</td></tr><tr><td><code>AWS_SESSION_TOKEN</code></td><td>None (optional)</td><td>AWS session token</td></tr></tbody></table>

### Alternative API Keys (Provider-Specific) <a href="#alternative-api-keys-provider-specific" id="alternative-api-keys-provider-specific"></a>

<table><thead><tr><th width="317.13671875">Environment Variable</th><th width="145.9453125">Provider</th><th>Purpose</th></tr></thead><tbody><tr><td><code>OPENAI_API_KEY</code></td><td>OpenAI</td><td>Alternative to <code>KEEPER_GATEWAY_AI_API_KEY</code></td></tr><tr><td><code>ANTHROPIC_API_KEY</code></td><td>Anthropic</td><td>Alternative to <code>KEEPER_GATEWAY_AI_API_KEY</code></td></tr><tr><td><code>AZURE_OPENAI_API_KEY</code></td><td>Azure OpenAI</td><td>Alternative to <code>KEEPER_GATEWAY_AI_API_KEY</code></td></tr><tr><td><code>GOOGLE_API_KEY</code></td><td>Google AI</td><td>Alternative to <code>KEEPER_GATEWAY_AI_API_KEY</code></td></tr></tbody></table>

## KDNRM Module Variables <a href="#kdnrm-module-variables" id="kdnrm-module-variables"></a>

### Logging Configuration <a href="#logging-configuration" id="logging-configuration"></a>

<table><thead><tr><th width="319.9140625">Environment Variable</th><th width="143.74609375">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>LOG_ENGINE</code></td><td><code>"default"</code></td><td>Specifies the logging engine to use</td></tr><tr><td><code>LOG_SHOW_STACKTRACE</code></td><td><code>FALSE</code></td><td>When TRUE, displays full Python stack traces in logs</td></tr><tr><td><code>LOG_SHOW_LINE_NO</code></td><td><code>FALSE</code></td><td>When TRUE, shows line numbers in log output</td></tr><tr><td><code>LOG_TO_FILE</code></td><td>None</td><td>File path where logs should be written</td></tr><tr><td><code>LOG_USAGE_SEC</code></td><td><code>0</code></td><td>Memory usage logging interval in seconds (0 = disabled)</td></tr></tbody></table>

### Local Secrets Manager Configuration <a href="#local-secrets-manager-configuration" id="local-secrets-manager-configuration"></a>

<table><thead><tr><th width="320.06640625">Environment Variable</th><th width="141.19921875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>USE_LOCAL_SM</code></td><td><code>FALSE</code></td><td>When TRUE, uses local SQLite database instead of KSM server</td></tr><tr><td><code>LOCAL_KSM_DEBUG</code></td><td><code>FALSE</code></td><td>Enables debug logging for local secrets manager</td></tr><tr><td><code>LOCAL_SM_DB_FILE</code></td><td>None</td><td>Path to specific SQLite database file for local secrets</td></tr><tr><td><code>LOCAL_SM_DIR</code></td><td>HOME or USERPROFILE</td><td>Directory where local SQLite database will be stored</td></tr><tr><td><code>LOCAL_KSM_FALLBACK_SM</code></td><td><code>FALSE</code></td><td>When TRUE, falls back to real KSM server if local DB fails</td></tr><tr><td><code>KSM_CONFIG</code></td><td>None</td><td>Path to KSM configuration file</td></tr></tbody></table>

### Discovery and DAG Configuration <a href="#discovery-and-dag-configuration" id="discovery-and-dag-configuration"></a>

<table><thead><tr><th width="323.703125">Environment Variable</th><th width="141.53125">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>USE_LOCAL_DAG</code></td><td><code>FALSE</code></td><td>When TRUE, uses local DAG/discovery database instead of remote</td></tr><tr><td><code>LOCAL_DAG_DIR</code></td><td><code>HOME</code> or <code>USERPROFILE</code></td><td>Directory for local DAG database storage</td></tr><tr><td><code>LOCAL_DAG_DEBUG</code></td><td><code>FALSE</code></td><td>Enables debug logging for local DAG</td></tr><tr><td><code>DAG_DEBUG_LEVEL</code></td><td><code>0</code></td><td>Debug verbosity level (0-5) for discovery DAG</td></tr><tr><td><code>DAG_RENDER</code></td><td>None</td><td>When TRUE, renders discovery graph visualizations</td></tr><tr><td><code>DUMP_DISCOVERY_JSON</code></td><td><code>FALSE</code></td><td>When TRUE, exports discovery results to JSON file</td></tr><tr><td><code>RULE_DEBUG</code></td><td><code>FALSE</code></td><td>Enables debug logging for rule engine evaluations</td></tr></tbody></table>

### Gateway Configuration <a href="#gateway-configuration" id="gateway-configuration"></a>

<table><thead><tr><th width="328.4140625">Environment Variable</th><th width="141.890625">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>GATEWAY_USER</code></td><td><code>Gateway.GATEWAY_USER</code> constant</td><td>User for gateway connections (falls back to USER/USERNAME)</td></tr><tr><td><code>KEEPER_GATEWAY_SAAS_PLUGIN_DIR</code></td><td><code>provider.saas_plugins_dir</code></td><td>Directory for custom SaaS plugins</td></tr><tr><td><code>KEEPER_GATEWAY_SERVICE_LOG_FINER_LEVEL</code></td><td>0</td><td>Increase the amount of debug information shown when mapping users to services. Increasing the number shows more information. Current max is 3.</td></tr></tbody></table>

## Keeper DAG Module Variables <a href="#keeper-dag-module-variables" id="keeper-dag-module-variables"></a>

### Debug & Development <a href="#debug-and-development" id="debug-and-development"></a>

<table data-header-hidden><thead><tr><th width="332.28515625">Environment Variable</th><th width="140.2890625">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>GS_DEBUG_LEVEL</code></td><td>0</td><td>Increase debug level; higher numbers produce more debug output</td></tr><tr><td><code>GS_IS_DEV</code></td><td>False</td><td>Development mode flag. When True, shows vertex names when adding edges</td></tr><tr><td><code>GS_CONN_DEBUG</code></td><td>False</td><td>Enable GraphSync connection-level debug logging</td></tr></tbody></table>

### Router & Server Connection <a href="#router-and-server-connection" id="router-and-server-connection"></a>

<table><thead><tr><th width="337.0390625">Environment Variable</th><th width="143.16796875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>ROUTER_HOST</code></td><td>Configured hostname from config</td><td>Override the FQDN of the krouter</td></tr><tr><td><code>KROUTER_URL</code></td><td>Derived from <code>ROUTER_HOST</code></td><td>Full URL to the krouter; overrides ROUTER_HOST when set</td></tr><tr><td><code>USE_SSL</code></td><td><code>TRUE</code></td><td>Determine if connection to krouter should use SSL/TLS</td></tr></tbody></table>

### Local Database Connection <a href="#local-database-connection" id="local-database-connection"></a>

<table data-header-hidden><thead><tr><th width="298.17578125">Environment Variable</th><th width="162.6796875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>LOCAL_DAG_DB_FILE</code></td><td><code>'local_dag.db'</code></td><td>Database filename for local DAG connections</td></tr></tbody></table>

### Transaction & Logging <a href="#transaction-and-logging" id="transaction-and-logging"></a>

<table><thead><tr><th width="297.0546875">Environment Variable</th><th width="219.44140625">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>GS_LOG_TRANS</code></td><td>False</td><td>Enable transaction logging for web service calls</td></tr><tr><td><code>GS_LOG_TRANS_DIR</code></td><td>"." (current directory)</td><td>Directory path where transaction log files will be created</td></tr></tbody></table>

## Discovery Common Module Variables <a href="#discovery-common-module-variables" id="discovery-common-module-variables"></a>

<table><thead><tr><th width="307.546875">Environment Variable</th><th width="183.09375">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>PROCESS_GS_DEBUG_LEVEL</code></td><td>None</td><td>Controls debug logging level for process graph service</td></tr><tr><td><code>USE_KSM</code></td><td>FALSE</td><td>When TRUE, uses KSM connection instead of local connection</td></tr><tr><td><code>GRAPH_DIR</code></td><td>HOME, then PROFILENAME, then "."</td><td>Directory where graph visualization files are rendered</td></tr></tbody></table>

## Service-Specific Environment Variables <a href="#service-specific-environment-variables" id="service-specific-environment-variables"></a>

### Windows Service <a href="#windows-service" id="windows-service"></a>

<table><thead><tr><th width="310.94140625">Variable</th><th>Purpose</th></tr></thead><tbody><tr><td><code>ProgramData</code></td><td>Used to determine various Windows service paths</td></tr><tr><td><code>SystemRoot</code></td><td>Used for Windows system paths</td></tr><tr><td><code>COMPUTERNAME</code></td><td>Used for Windows hostname</td></tr></tbody></table>

### Legacy Timeout Variables (Deprecated - Use KEEPER\_GATEWAY\_ Prefix Instead) <a href="#legacy-timeout-variables-deprecated-use-keeper_gateway_-prefix-instead" id="legacy-timeout-variables-deprecated-use-keeper_gateway_-prefix-instead"></a>

<table data-header-hidden><thead><tr><th width="270.98046875">Environment Variable</th><th width="132.2421875">Default Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>SET_LOCAL_DESCRIPTION</code></td><td>15s</td><td>(Deprecated) Use KEEPER_GATEWAY_SET_LOCAL_DESCRIPTION_TIMEOUT</td></tr><tr><td><code>OPEN_CONNECTION_TIMEOUT_SEC</code></td><td>30s</td><td>(Deprecated) Use KEEPER_GATEWAY_OPEN_CONNECTION_TIMEOUT</td></tr><tr><td><code>CREATE_ANSWER_TIMEOUT_SEC</code></td><td>30s</td><td>(Deprecated) Use KEEPER_GATEWAY_CREATE_ANSWER_TIMEOUT</td></tr><tr><td><code>READ_TIMEOUT_SEC</code></td><td>5s</td><td>(Deprecated) Use KEEPER_GATEWAY_READ_TIMEOUT</td></tr><tr><td><code>NON_PARED_READ_TIMEOUT_SEC</code></td><td>5s</td><td>(Deprecated) Use KEEPER_GATEWAY_NON_PARED_READ_TIMEOUT</td></tr><tr><td><code>CLOSE_CONNECTION_TIMEOUT_SEC</code></td><td>5s</td><td>(Deprecated) Use KEEPER_GATEWAY_CLOSE_CONNECTION_TIMEOUT</td></tr><tr><td><code>TEST_CONNECTION_TIMEOUT_SEC</code></td><td>5s</td><td>(Deprecated) Use KEEPER_GATEWAY_TEST_CONNECTION_TIMEOUT</td></tr><tr><td><code>ACCEPT_OFFER_TIMEOUT_SEC</code></td><td>calculated</td><td>(Deprecated) Use KEEPER_GATEWAY_ACCEPT_OFFER_TIMEOUT</td></tr><tr><td><code>RECORDINGS_PATH_TIMEOUT_SEC</code></td><td>20s</td><td>(Deprecated) Use KEEPER_GATEWAY_RECORDINGS_PATH_TIMEOUT</td></tr></tbody></table>

<br>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/gateways/gateway-environment-variables.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.