Settings Reference

Configuration starts with BaseServiceSettings and extends into SpapsSettings for the full SPAPS service. Both use Pydantic settings, but the package intentionally does not auto-load repo-local .env* files inside the settings class; runners such as compose, systemd, or env-manager should inject process environment.

Base Settings

Setting	Default	Purpose
`env`	`dev`	Runtime environment label
`development_environment`	`None`	Set to `local` for local auth bypass support
`database_url`	local Postgres async URL	SQLAlchemy async database DSN
`redis_url`	`redis://localhost:6379/0`	Celery broker/result fallback
`spaps_auth_enabled`	`False`	Enables reusable SPAPS auth middleware
`spaps_auth_exempt_paths`	health/docs/auth defaults	Paths that bypass reusable auth middleware
`cors_allow_origins`	empty tuple	Enables CORS when non-empty in `create_app`
`secure_messages_enabled`	`False`	Enables secure-message gateway support

SPAPS Settings

Group	Fields
JWT	`jwt_secret`, `jwt_expires_in`, `refresh_token_secret`, `jwt_refresh_expires_in`
Stripe	`stripe_secret_key`, `stripe_webhook_secret`, `stripe_checkout_branding_name`
Mailgun	`mailgun_api_key`, `mailgun_domain`, `mailgun_from`, `mailgun_webhook_signing_key`
Wallets	`solana_rpc_url`, `ethereum_rpc_url`, Lightning fields
Security	`legacy_api_key_auth_enabled`, `secure_messages_require_jwt`, `rate_limit_backend`, webhook and self-service policies

secure_messages_require_jwt remains in the settings projection for compatibility. Current secure_messages routers enforce CurrentUser unconditionally; changing that field does not bypass JWT user identity. | Local mode | spaps_local_mode, development_environment, env |

CSV Parsing

List-like settings accept comma-separated strings.


SPAPS_AUTH_EXEMPT_PATHS=/health,/docs,/api/public
CORS_ALLOW_ORIGINS=http://localhost:3000,https://buildooor.com
WEBHOOK_ALLOWED_DOMAINS=example.com,api.partner.test

Common Mistakes

DEVELOPMENT_ENVIRONMENT=local and SPAPS_LOCAL_MODE=true are development controls. Production startup validation rejects unsafe combinations.

Expecting BaseServiceSettings to load .env automatically.
Removing required auth-exempt paths. The validator adds them back.
Using wildcard CORS origins with credentials in production.