Configuration substitution
You can use{{ env.VAR_NAME }} placeholders in any string value across your configuration files. Hyperterse resolves these when the server starts.
Supported locations
Resolution behavior
- Placeholders resolve at the point of use: connector initialization, statement execution, auth check, or agent model initialization.
- Missing variables cause a hard failure with an error identifying the unresolved variable.
- Placeholders are not recursive — a variable whose value contains
{{ env.OTHER }}is not expanded further. - The
.envfile in the working directory is loaded before command execution.
Runtime variables
Fallback port when not set via CLI flag or config.Precedence:
--port flag → server.port config → PORT env → 8080Fallback API key for the
api_key auth plugin when auth.policy.value is not set on a tool.Precedence: auth.policy.value config → HYPERTERSE_API_KEY envComma-separated log tag filter. Limits which tags appear in log output.Precedence:
--log-tags flag → HYPERTERSE_LOG_TAGS envAgent model provider variables
These variables are used when resolving model configuration for declarative agents (app/agents/*/config.terse).
Agent model options and env substitution
model.optionsstring values support{{ env.VAR_NAME }}substitution when the agent model starts.- Missing variables referenced in
model.optionsplaceholders fail startup with a clear error. - This is in addition to provider-level fallback variables in the table above.
.env file
The CLI loads .env from the current working directory when present. Standard KEY=VALUE format. Blank lines and #-prefixed lines are ignored.
.env
Shell-set environment variables take precedence over
.env values. The file
provides defaults, not overrides.Security guidance
- Use
{{ env.VAR }}for all credentials. Connection strings, API keys, and tokens must reference environment variables — never hardcode secrets in.tersefiles. - Rotation requires restart. Environment variables resolve at startup. For zero-downtime rotation, use a secrets manager that updates the environment and signals a restart.
- Set production log level. Debug logs may include substituted statement text. Use log level
2(warn) or3(info) in production.