# Environment Variables

Source: https://wraps.dev/docs/reference/environment-variables

All environment variables used by the Wraps CLI and SDKs.

## Wraps Configuration

Copy for AI

Control CLI behavior, telemetry, and API connectivity.

| Variable | Description | Default |
| --- | --- | --- |
| `WRAPS_LOCAL_ONLY` | Disable telemetry and API calls | `false` |
| `WRAPS_API_KEY` | API key for Wraps Platform | \- |
| `WRAPS_API_URL` | Custom API endpoint | `https://api.wraps.dev` |
| `WRAPS_APP_URL` | Custom app/dashboard URL | `https://app.wraps.dev` |
| `WRAPS_TELEMETRY_DISABLED` | Disable anonymous telemetry | `false` |

## AWS Credentials

Copy for AI

Standard AWS environment variables for authentication. The CLI and SDKs use the default AWS credential chain, so these are only needed when not using AWS CLI profiles or IAM roles.

| Variable | Description | Default |
| --- | --- | --- |
| `AWS_ACCESS_KEY_ID` | AWS access key | \- |
| `AWS_SECRET_ACCESS_KEY` | AWS secret key | \- |
| `AWS_SESSION_TOKEN` | Temporary session token (for STS/SSO) | \- |
| `AWS_REGION` | AWS region. Post-deploy commands (upgrade, restore, doctor, etc.) auto-resolve from saved connection metadata when unset — the CLI only falls back to us-east-1 when no saved deployments are found. | \- |
| `AWS_DEFAULT_REGION` | Alternative to AWS\_REGION; checked second in the resolution chain. | \- |
| `AWS_PROFILE` | Named AWS CLI profile | `default` |
| `AWS_ROLE_ARN` | IAM role ARN for OIDC assumption | \- |

## DNS Automation

Copy for AI

Provide DNS provider credentials to enable automatic DNS record creation during domain verification.

| Variable | Description | Default |
| --- | --- | --- |
| `CLOUDFLARE_API_TOKEN` | Cloudflare API token for DNS automation | \- |
| `CLOUDFLARE_ZONE_ID` | Cloudflare zone ID | \- |
| `VERCEL_TOKEN` | Vercel API token for DNS automation | \- |

## Pulumi (Internal)

Copy for AI

These variables are managed automatically by the CLI. You should only override them if you have a custom Pulumi setup.

| Variable | Description | Default |
| --- | --- | --- |
| `PULUMI_CONFIG_PASSPHRASE` | Encryption passphrase for Pulumi state | `Auto-generated` |
| `PULUMI_BACKEND_URL` | Pulumi state backend URL | `file://~/.wraps/pulumi` |

## CI/CD Examples

Copy for AI

### GitHub Actions

Use OIDC federation to assume an IAM role without storing access keys.

.github/workflows/deploy.yml

```
name: Deploy Email Infrastructureon:  push:    branches: [main]jobs:  deploy:    runs-on: ubuntu-latest    permissions:      id-token: write      contents: read    steps:      - uses: actions/checkout@v4      - uses: aws-actions/configure-aws-credentials@v4        with:          role-to-assume: arn:aws:iam::123456789012:role/github-actions          aws-region: us-east-1      - run: npx @wraps.dev/cli email init --yes --preset production
```

### Vercel

Vercel handles OIDC automatically when you set the role ARN. No access keys are needed.

Vercel Environment Variables

```
# In Vercel project settings, add:AWS_ROLE_ARN=arn:aws:iam::123456789012:role/wraps-email-role# Vercel handles OIDC automatically — no access keys needed
```

## Next Steps

AWS Setup

Step-by-step guide for configuring AWS credentials and permissions for Wraps.

[View Guide](https://wraps.dev/docs/guides/aws-setup)

Error Codes

Complete reference for all CLI error codes and SDK error classes with solutions.

[View Reference](https://wraps.dev/docs/reference/errors)