This page lists every environment variable the tappass Python SDK (v0.10.1) reads. Constructor arguments always take precedence over environment variables.
| Variable |
Default |
Description |
TAPPASS_URL |
http://localhost:9620 |
TapPass server URL. Used by tappass.govern() when no url= argument is given |
TAPPASS_API_KEY |
— |
Bearer key for govern() and enforce-mode calls |
TAPPASS_AGENT_ID |
— |
Stable agent identifier (used by integrations, e.g. Claude Code) |
TAPPASS_ORG_ID |
— |
Tenant ID; unlocks per-tenant policy scoping |
TAPPASS_SESSION_ID |
— |
Session ID to keep stable across one agent run |
| Variable |
Default |
Description |
TAPPASS_FAIL_OPEN |
unset (fail-closed) |
Set to 1, true, or yes to allow tool calls when /v1/govern is unreachable or returns 5xx. Enforce mode fails closed (raises GovernanceUnavailable) without it. Fail-open allows are flagged with details.fail_open=True in audit |
Read by ResiliencePolicy.from_env():
| Variable |
Default |
Description |
TAPPASS_FAIL_MODE |
fail_closed |
fail_closed, fail_open_cached, or fail_open_logged. Invalid values warn and fall back to fail_closed |
TAPPASS_CACHE_TTL |
300 |
Cached-response validity in seconds |
TAPPASS_MAX_OFFLINE_REQUESTS |
100 |
Hard cap on degraded-mode calls (0 = unlimited) |
TAPPASS_LOCAL_AUDIT_PATH |
.tappass_audit_buffer.jsonl |
Path for the local audit buffer file |
TAPPASS_CIRCUIT_FAILURE_THRESHOLD |
3 |
Consecutive failures before the circuit opens |
TAPPASS_CIRCUIT_RECOVERY_TIMEOUT |
30 |
Seconds before OPEN → HALF_OPEN |
| Variable |
Default |
Description |
TAPPASS_DISABLE_TELEMETRY |
unset |
Set to 1 to disable the SDK’s outbound audit reporter |
DO_NOT_TRACK |
unset |
Community-standard equivalent of TAPPASS_DISABLE_TELEMETRY (see consoledonottrack.com) |
| Variable |
Default |
Description |
TAPPASS_SIGNING_KEY |
— |
Agent signing key used when signing capability-token calls. Required by the offline @guard path when no key is supplied programmatically |
| Variable |
Default |
Description |
TAPPASS_ENV |
unset |
Set to test to enable bypass_scope() (which additionally requires a detected test runner). Never set in production |
