Configuration

Unkey services read configuration from a TOML file passed at startup. Environment variables can be referenced with ${VAR} and are expanded before parsing. Defaults and validation run after parsing. The config schema maps to svc/ctrl/api/config.go. The control plane API is configured via a TOML file: control-api --config=unkey.toml.

string

Instance identifier for logs and tracing.

string

required

Region label for routing and observability.

int

default:"8080"

HTTP server port.

int

Prometheus metrics port. Set to 0 to disable.

string

required

Bearer token for control API clients.

Known consumers:

API service
Krane service

Rotation is manual today. There is no built-in rotation mechanism. TODO: Replace with JWT-based auth once auth.unkey.cloud is in place.

string

Base domain for wildcard certificates.

string

Base domain for regional routing.

string

Base domain for custom CNAME targets.

string

required

MySQL DSN. The control plane API uses one read-write connection for all queries.

object

Restate integration.

Show Fields

string

default:"http://restate:8080"

Restate ingress URL.

string

default:"http://restate:9070"

Restate admin URL.

string

Restate API key.

object

GitHub webhook configuration.

Show Fields

string

Webhook signature secret.

object

Tracing configuration. Logging settings are parsed but not applied by the control API runtime.

Show Fields

float

default:"0.25"

Trace sampling rate.

float

default:"1.0"

Log sampling rate.

duration

default:"1s"

Slow log threshold.

Example configuration

Control API:

http_port = 8080
prometheus_port = 9090
region = "${UNKEY_REGION}"
instance_id = "${POD_NAME}"
auth_token = "${UNKEY_AUTH_TOKEN}"
default_domain = "${UNKEY_DEFAULT_DOMAIN}"
regional_domain = "${UNKEY_REGIONAL_DOMAIN}"
cname_domain = "${UNKEY_CNAME_DOMAIN}"
database = "${UNKEY_DATABASE_PRIMARY}"

[restate]
url = "${UNKEY_RESTATE_URL}"
admin_url = "${UNKEY_RESTATE_ADMIN_URL}"
api_key = "${UNKEY_RESTATE_API_KEY}"

[github]
webhook_secret = "${UNKEY_GITHUB_APP_WEBHOOK_SECRET}"

[observability.tracing]
sample_rate = 0.1

[observability.logging]
sample_rate = 0.01
slow_threshold = "2s"

Overview

Services

RFCs

Example configuration

​Example configuration

Example configuration