# New Ory Agent Security is now live! Claim your complimentary test drive.

On this page

This page is auto-generated from the [configuration schema](https://github.com/ory/talos/blob/master/spec/config.schema.json).

Required top-level keys: `credentials`, `secrets`

## Environment variables

Every configuration key can be set via an environment variable. Ory Talos converts dot-separated config paths to uppercase with underscores:

```text
<SECTION>_<KEY>
```

Replace dots (`.`) with underscores (`_`) and convert to uppercase. For example, `serve.http.port` becomes `SERVE_HTTP_PORT`.

### Array values

For array-typed config keys (like `secrets.hmac.retired`), use comma separation or indexed variables:

```shell
# Comma-separated

export SECRETS_HMAC_RETIRED="old-secret-1,old-secret-2"

# Or indexed

export SECRETS_HMAC_RETIRED_0="old-secret-1"

export SECRETS_HMAC_RETIRED_1="old-secret-2"
```

### Precedence

Configuration sources are applied in this order (highest priority first):

1. Environment variables
2. Configuration file (`--config` flag)
3. Default values

Environment variables always override file-based configuration.

### Required variables

At minimum, these must be set (via env var or config file):

| Variable                  | Description                                                                                |
|---------------------------|--------------------------------------------------------------------------------------------|
| `SECRETS_HMAC_CURRENT`    | HMAC secret (also derives the pagination cursor key). Minimum 32 characters.              |
| `CREDENTIALS_ISSUER`     | Token issuer (`iss` claim) for derived tokens.                                            |

## `cache` Commercial

Cache configuration.

| Key                                           | Type                           | Default              | Env Var                        | Description                                                |
|-----------------------------------------------|--------------------------------|----------------------|-------------------------------|------------------------------------------------------------|
| `cache.memory.max_size`                       | integer                        | `104857600`          | `CACHE_MEMORY_MAX_SIZE`       | Maximum memory usage in bytes. (restart required, Commercial) |
| `cache.memory.num_counters`                   | integer                        | `10000`              | `CACHE_MEMORY_NUM_COUNTERS`   | Number of counters for frequency estimation. (restart required, Commercial) |
| `cache.redis.addrs`                           | string[]                       | `[