| Email backend | NAVIGATOR_EMAIL_BACKEND | Must be sendgrid outside the harness |
| Outbound SendGrid | SENDGRID_API_KEY, SENDGRID_FROM_EMAIL | Required outside the harness |
| SendGrid base URL | SENDGRID_BASE_URL | Official hosts only outside the harness |
| Inbound SendGrid | SENDGRID_INBOUND_SECRET | Required outside the harness |
| Attachment scanner | NAVIGATOR_CLAMD_ADDR | Required in every deployed profile; private clamd only |
| Event webhook | SENDGRID_EVENTS_SECRET, SENDGRID_EVENTS_PUBLIC_KEY | Required outside the harness |
| Threaded mail | NAVIGATOR_PARSE_HOST, NAVIGATOR_LAWYER_NOTIFY_EMAIL | Both values enable it |
| DKIM fence | NAVIGATOR_DKIM_REQUIRE_DOMAIN | Optional domain pin |
| Internal ops notices | SLACK_WEBHOOK_URL | Optional; otherwise captured in memory |
| DocuSign endpoint | DOCUSIGN_BASE_URL | Declares DocuSign; demo in dev, live in production |
| DocuSign account | DOCUSIGN_ACCOUNT_ID | Environment-specific account |
| DocuSign JWT IDs | DOCUSIGN_INTEGRATION_KEY, DOCUSIGN_USER_ID | Preferred auth path |
| DocuSign JWT proof | DOCUSIGN_PRIVATE_KEY, DOCUSIGN_OAUTH_BASE | Preferred auth path |
| DocuSign static auth | DOCUSIGN_ACCESS_TOKEN | Short-lived fallback |
| DocuSign signer | DOCUSIGN_SIGNER_EMAIL, DOCUSIGN_SIGNER_NAME | Required signer identity |
| DocuSign webhook | DOCUSIGN_HMAC_KEY, DOCUSIGN_WEBHOOK_SECRET | Required once DOCUSIGN_BASE_URL is set |
| Xero tenant | XERO_TENANT_ID, XERO_BASE_URL | All Xero values select real billing |
| Xero OAuth client | XERO_CLIENT_ID, XERO_CLIENT_SECRET | Otherwise stub billing |
| Xero OAuth token | XERO_TOKEN_URL, XERO_SCOPE, XERO_ACCESS_TOKEN | Otherwise stub billing |