Deployed runtime: identity and access
| Concern | Environment variables | Behavior when absent |
|---|---|---|
| Browser OIDC issuer | OAUTH_ISSUER_URL | Browser login is not configured |
| Browser OIDC client | OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET | Browser login is not configured |
| Browser redirect | OAUTH_REDIRECT_URI | Browser login is not configured |
| Microsoft door | OAUTH_MICROSOFT_CLIENT_ID, OAUTH_MICROSOFT_CLIENT_SECRET | Off; one provider, one button |
| Microsoft tenants | OAUTH_MICROSOFT_ALLOWED_TENANTS | Boot fails when the client id is set |
| Microsoft authority | OAUTH_MICROSOFT_ISSUER_URL | The organizations authority: work or school, any tenant |
| Apple door | OAUTH_APPLE_CLIENT_ID + three secret values | Off without client ID; boot fails if sibling missing |
| Bearer JWKS | OIDC_JWKS_URL, OIDC_AUDIENCE, OIDC_ISSUER | Deployed JWT verification |
| Bearer HMAC | OIDC_HS256_SECRET | Local/test verifier path |
| Dev bypass | OIDC_DISABLED | Off; the dev profile and production reject true / 1 |
web-env.yaml uses # NAVIGATOR_OPTIONAL_ENV OAUTH_APPLE_CLIENT_ID to mark the optional Apple client ID; ops ship
emits its entry only for a nonblank coordinate.
| Bootstrap Owner | NAVIGATOR_BOOTSTRAP_OWNER_EMAIL (config.toml) | Missing: ship refused; unset: no JIT identity |
| Protected firm Entity | NAVIGATOR_BOOTSTRAP_COMPANY | Shook Law PLLC is protected either way |
| Google token policy | GOOGLE_OAUTH_CLIENT_IDS, GOOGLE_OAUTH_REQUIRED_HD | No client/domain pin |
| Google token endpoint | GOOGLE_TOKENINFO_URL | Google default |
| Password door | NAVIGATOR_IDENTITY_PLATFORM_API_KEY | OIDC-only login |
| Password endpoint | NAVIGATOR_IDENTITY_PLATFORM_ENDPOINT | Google default |
| Identity Platform admin calls | NAVIGATOR_GCP_METADATA_ENDPOINT | GCE metadata server default |