> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inferwall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# InferenceWall Environment Variables Reference

> Reference for all InferenceWall env vars: API keys, detection profile, host/port, signatures directory, policy file path, ELK logging, and Redis session store.

Environment variables configure both the InferenceWall server and SDK behavior. Set them in your shell, pass them to Docker with `-e`, or load them from `.env.local` via `source .env.local` before running `inferwall serve`.

## Variable Reference

| Variable            | Description                                                                                                | Default                                      |
| ------------------- | ---------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
| `IW_API_KEY`        | Scan API key. Required for authenticated scan requests.                                                    | None (dev mode — auth disabled)              |
| `IW_ADMIN_KEY`      | Admin API key. Required for admin endpoints.                                                               | None (dev mode — auth disabled)              |
| `IW_HOST`           | Server bind address.                                                                                       | `0.0.0.0`                                    |
| `IW_PORT`           | Server port.                                                                                               | `8000`                                       |
| `IW_TLS`            | TLS mode: `auto`, `off`, or `acme`.                                                                        | `off`                                        |
| `IW_PROFILE`        | Detection profile: `lite`, `standard`, or `full`.                                                          | `lite`                                       |
| `IW_LOG_LEVEL`      | Log level: `debug`, `info`, `warning`, or `error`.                                                         | `info`                                       |
| `IW_REDIS_URL`      | Redis connection URL for distributed session storage.                                                      | None (in-memory)                             |
| `IW_SIGNATURES_DIR` | Path to a directory of custom signature YAML files, merged with the built-in catalog at startup.           | `~/.inferwall/signatures`                    |
| `IW_POLICY_PATH`    | Path to a custom policy YAML file.                                                                         | Auto-discovery from `~/.inferwall/policies/` |
| `IW_ELK_URL`        | Logstash HTTP endpoint for shipping logs to an ELK stack. Requires `pip install inferwall[observability]`. | None (disabled)                              |

## Details

### Authentication keys (`IW_API_KEY`, `IW_ADMIN_KEY`)

InferenceWall uses two separate keys with distinct roles:

* **`IW_API_KEY`** — authorizes scan requests (`/v1/scan/input`, `/v1/scan/output`). Include it as `Authorization: Bearer <key>` in HTTP requests.
* **`IW_ADMIN_KEY`** — authorizes admin endpoints. Keep this key restricted to operators.

<Warning>
  When neither key is set, authentication is completely disabled. This is intended for local development only — **never run without keys in production**.
</Warning>

### Detection profile (`IW_PROFILE`)

The profile controls which detection engines are active and which signatures are evaluated:

| Value      | Engines                                | Signatures used                     | Latency      |
| ---------- | -------------------------------------- | ----------------------------------- | ------------ |
| `lite`     | Heuristic (Rust)                       | 75 heuristic                        | \<0.3 ms p99 |
| `standard` | + Classifier (ONNX) + Semantic (FAISS) | + 11 classifier + 10 semantic       | \<80 ms p99  |
| `full`     | + LLM-Judge                            | + composite (ambiguous inputs only) | \<2 s p99    |

### TLS mode (`IW_TLS`)

| Value  | Behavior                                  |
| ------ | ----------------------------------------- |
| `off`  | Plain HTTP (default)                      |
| `auto` | TLS with automatic certificate management |
| `acme` | TLS via ACME/Let's Encrypt                |

### Redis (`IW_REDIS_URL`)

Set `IW_REDIS_URL` to a Redis connection string (e.g., `redis://localhost:6379`) when running multiple InferenceWall instances that need to share session state. Without it, sessions are stored in process memory.

### Custom signatures (`IW_SIGNATURES_DIR`)

By default, InferenceWall loads custom signatures from `~/.inferwall/signatures/`. All `.yaml` files in that directory are merged with the built-in catalog at startup. A custom signature with the same `id` as a built-in signature replaces it entirely.

Set `IW_SIGNATURES_DIR` to point at a different directory:

```bash theme={null}
export IW_SIGNATURES_DIR=/opt/inferwall/team-signatures
```

### Custom policy (`IW_POLICY_PATH`)

By default, InferenceWall auto-discovers policy files from `~/.inferwall/policies/`. Set `IW_POLICY_PATH` to load a specific policy file instead:

```bash theme={null}
export IW_POLICY_PATH=~/.inferwall/policies/my-policy.yaml
```

### ELK observability (`IW_ELK_URL`)

Set this to your Logstash HTTP input endpoint to ship scan events and server logs to an ELK stack. Requires the observability extra:

```bash theme={null}
pip install inferwall[observability]
export IW_ELK_URL=http://logstash.internal:5044
```

## Generating keys

Use `inferwall admin setup` to generate both keys and write them to `.env.local`:

```bash theme={null}
inferwall admin setup
source .env.local && inferwall serve
```

<Tip>
  Add `.env.local` to your `.gitignore` immediately. It contains secrets and must never be committed to source control.
</Tip>

## Docker example

```bash theme={null}
docker run -p 8000:8000 \
  -e IW_API_KEY=iwk_scan_yourkey \
  -e IW_ADMIN_KEY=iwk_admin_yourkey \
  -e IW_PROFILE=standard \
  inferwall
```