InferenceWall Environment Variables Reference

Environment variables configure both the InferenceWall server and SDK behavior. Set them in your shell, pass them to Docker with -e, or load them from .env.local via source .env.local before running inferwall serve.

Variable Reference

Variable	Description	Default
`IW_API_KEY`	Scan API key. Required for authenticated scan requests.	None (dev mode — auth disabled)
`IW_ADMIN_KEY`	Admin API key. Required for admin endpoints.	None (dev mode — auth disabled)
`IW_HOST`	Server bind address.	`0.0.0.0`
`IW_PORT`	Server port.	`8000`
`IW_TLS`	TLS mode: `auto`, `off`, or `acme`.	`off`
`IW_PROFILE`	Detection profile: `lite`, `standard`, or `full`.	`lite`
`IW_LOG_LEVEL`	Log level: `debug`, `info`, `warning`, or `error`.	`info`
`IW_REDIS_URL`	Redis connection URL for distributed session storage.	None (in-memory)
`IW_SIGNATURES_DIR`	Path to a directory of custom signature YAML files, merged with the built-in catalog at startup.	`~/.inferwall/signatures`
`IW_POLICY_PATH`	Path to a custom policy YAML file.	Auto-discovery from `~/.inferwall/policies/`
`IW_ELK_URL`	Logstash HTTP endpoint for shipping logs to an ELK stack. Requires `pip install inferwall[observability]`.	None (disabled)

Details

Authentication keys (`IW_API_KEY`, `IW_ADMIN_KEY`)

InferenceWall uses two separate keys with distinct roles:

IW_API_KEY — authorizes scan requests (/v1/scan/input, /v1/scan/output). Include it as Authorization: Bearer <key> in HTTP requests.
IW_ADMIN_KEY — authorizes admin endpoints. Keep this key restricted to operators.

When neither key is set, authentication is completely disabled. This is intended for local development only — never run without keys in production.

Detection profile (`IW_PROFILE`)

The profile controls which detection engines are active and which signatures are evaluated:

Value	Engines	Signatures used	Latency
`lite`	Heuristic (Rust)	75 heuristic	<0.3 ms p99
`standard`	+ Classifier (ONNX) + Semantic (FAISS)	+ 11 classifier + 10 semantic	<80 ms p99
`full`	+ LLM-Judge	+ composite (ambiguous inputs only)	<2 s p99

TLS mode (`IW_TLS`)

Value	Behavior
`off`	Plain HTTP (default)
`auto`	TLS with automatic certificate management
`acme`	TLS via ACME/Let’s Encrypt

Redis (`IW_REDIS_URL`)

Set IW_REDIS_URL to a Redis connection string (e.g., redis://localhost:6379) when running multiple InferenceWall instances that need to share session state. Without it, sessions are stored in process memory.

Custom signatures (`IW_SIGNATURES_DIR`)

By default, InferenceWall loads custom signatures from ~/.inferwall/signatures/. All .yaml files in that directory are merged with the built-in catalog at startup. A custom signature with the same id as a built-in signature replaces it entirely. Set IW_SIGNATURES_DIR to point at a different directory:

export IW_SIGNATURES_DIR=/opt/inferwall/team-signatures

Custom policy (`IW_POLICY_PATH`)

By default, InferenceWall auto-discovers policy files from ~/.inferwall/policies/. Set IW_POLICY_PATH to load a specific policy file instead:

export IW_POLICY_PATH=~/.inferwall/policies/my-policy.yaml

ELK observability (`IW_ELK_URL`)

Set this to your Logstash HTTP input endpoint to ship scan events and server logs to an ELK stack. Requires the observability extra:

pip install inferwall[observability]
export IW_ELK_URL=http://logstash.internal:5044

Generating keys

Use inferwall admin setup to generate both keys and write them to .env.local:

inferwall admin setup
source .env.local && inferwall serve

Add .env.local to your .gitignore immediately. It contains secrets and must never be committed to source control.

Docker example

docker run -p 8000:8000 \
  -e IW_API_KEY=iwk_scan_yourkey \
  -e IW_ADMIN_KEY=iwk_admin_yourkey \
  -e IW_PROFILE=standard \
  inferwall

Get Started

Core Concepts

Integrations

Guides

Reference

InferenceWall Environment Variables Reference

Variable Reference

Details

Authentication keys (`IW_API_KEY`, `IW_ADMIN_KEY`)

Detection profile (`IW_PROFILE`)

TLS mode (`IW_TLS`)

Redis (`IW_REDIS_URL`)

Custom signatures (`IW_SIGNATURES_DIR`)

Custom policy (`IW_POLICY_PATH`)

ELK observability (`IW_ELK_URL`)

Generating keys

Docker example

​Variable Reference

​Details

​Authentication keys (IW_API_KEY, IW_ADMIN_KEY)

​Detection profile (IW_PROFILE)

​TLS mode (IW_TLS)

​Redis (IW_REDIS_URL)

​Custom signatures (IW_SIGNATURES_DIR)

​Custom policy (IW_POLICY_PATH)

​ELK observability (IW_ELK_URL)

​Generating keys

​Docker example

Variable Reference

Details

Authentication keys (`IW_API_KEY`, `IW_ADMIN_KEY`)

Detection profile (`IW_PROFILE`)

TLS mode (`IW_TLS`)

Redis (`IW_REDIS_URL`)

Custom signatures (`IW_SIGNATURES_DIR`)

Custom policy (`IW_POLICY_PATH`)

ELK observability (`IW_ELK_URL`)

Generating keys

Docker example