Reference

Environment Variables

All environment variables used by the Wraps CLI and SDKs.

Wraps Configuration

Control CLI behavior, telemetry, and API connectivity.

Variable	Description	Default
`WRAPS_LOCAL_ONLY`	Disable telemetry and API calls	`false`
`WRAPS_API_KEY`	API key for Wraps Platform	-
`WRAPS_API_URL`	Custom API endpoint	`https://api.wraps.dev`
`WRAPS_TELEMETRY_DISABLED`	Disable anonymous telemetry	`false`
`WRAPS_HOME`	Custom config directory	`~/.wraps`

AWS Credentials

Standard AWS environment variables for authentication. The CLI and SDKs use the default AWS credential chain, so these are only needed when not using AWS CLI profiles or IAM roles.

Variable	Description	Default
`AWS_ACCESS_KEY_ID`	AWS access key	-
`AWS_SECRET_ACCESS_KEY`	AWS secret key	-
`AWS_SESSION_TOKEN`	Temporary session token (for STS/SSO)	-
`AWS_REGION`	AWS region	`us-east-1`
`AWS_PROFILE`	Named AWS CLI profile	`default`
`AWS_ROLE_ARN`	IAM role ARN for OIDC assumption	-

DNS Automation

Provide DNS provider credentials to enable automatic DNS record creation during domain verification.

Variable	Description	Default
`CLOUDFLARE_API_TOKEN`	Cloudflare API token for DNS automation	-
`CLOUDFLARE_ZONE_ID`	Cloudflare zone ID	-
`VERCEL_TOKEN`	Vercel API token for DNS automation	-

Pulumi (Internal)

These variables are managed automatically by the CLI. You should only override them if you have a custom Pulumi setup.

Variable	Description	Default
`PULUMI_CONFIG_PASSPHRASE`	Encryption passphrase for Pulumi state	`Auto-generated`
`PULUMI_BACKEND_URL`	Pulumi state backend URL	`file://~/.wraps/pulumi`

CI/CD Examples

GitHub Actions

Use OIDC federation to assume an IAM role without storing access keys.

.github/workflows/deploy.yml

name: Deploy Email Infrastructureon:  push:    branches: [main]jobs:  deploy:    runs-on: ubuntu-latest    permissions:      id-token: write      contents: read    steps:      - uses: actions/checkout@v4      - uses: aws-actions/configure-aws-credentials@v4        with:          role-to-assume: arn:aws:iam::123456789012:role/github-actions          aws-region: us-east-1      - run: npx @wraps.dev/cli email init --yes --preset production

Vercel

Vercel handles OIDC automatically when you set the role ARN. No access keys are needed.

Vercel Environment Variables

# In Vercel project settings, add:AWS_ROLE_ARN=arn:aws:iam::123456789012:role/wraps-email-role# Vercel handles OIDC automatically — no access keys needed

Next Steps

AWS Setup

Step-by-step guide for configuring AWS credentials and permissions for Wraps.

View Guide

Error Codes

Complete reference for all CLI error codes and SDK error classes with solutions.

View Reference