# =============================================================================
# FCTR Okta MCP Server - Environment Configuration
# =============================================================================
# Copy this file to .env and fill in your values
# Lines starting with # are comments
# =============================================================================
# OKTA CONNECTION (Required)
# =============================================================================
# Your Okta organization URL (without https://)
# Example: your-org.okta.com
OKTA_CLIENT_ORGURL=your-org.okta.com
# Alternative name (either works)
# OKTA_ORG_URL=your-org.okta.com
# =============================================================================
# AUTHENTICATION - Choose ONE method
# =============================================================================
# Authentication method: API_TOKEN (default) or OAUTH2
TOKEN_METHOD=API_TOKEN
# -----------------------------------------------------------------------------
# Option 1: API Token (Simpler, good for development)
# -----------------------------------------------------------------------------
# Create at: Okta Admin > Security > API > Tokens
OKTA_API_TOKEN=your-api-token-here
# Alternative name (either works)
# SSWS_API_KEY=your-api-token-here
# -----------------------------------------------------------------------------
# Option 2: OAuth2 with Private Key JWT (More secure, recommended for production)
# -----------------------------------------------------------------------------
# Create OAuth2 app in Okta Admin > Applications > Create App Integration
# Choose "API Services" and enable "Private key" auth
# OAuth2 Client ID from your Okta app
# OKTA_OAUTH2_CLIENT_ID=your-client-id
# Private key in PEM format (can be multi-line or escaped \n)
# OKTA_OAUTH2_PRIVATE_KEY_PEM=-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----
# OAuth2 scopes (space-separated)
# OKTA_OAUTH2_SCOPES="okta.agentPools.read okta.appGrants.read okta.apps.read okta.authModes.read okta.authenticators.read okta.authorizationServers.read okta.behaviors.read okta.brands.read okta.captchas.read okta.certificateAuthorities.read okta.clients.read okta.deviceAssurance.read okta.devices.read okta.domains.read okta.emailDomains.read okta.emailServers.read okta.enduser.dashboard.read okta.enduser.read okta.eventHooks.read okta.events.read okta.factors.read okta.groups.read okta.identitySources.read okta.idps.read okta.inlineHooks.read okta.linkedObjects.read okta.logStreams.read okta.logs.read okta.manifests.read okta.networkZones.read okta.orgs.read okta.policies.read okta.principalRateLimits.read okta.profileMappings.read okta.pushProviders.read okta.rateLimits.read okta.reports.read okta.riskProviders.read okta.roles.read okta.schemas.read okta.securityEventsProviders.read okta.sessions.read okta.templates.read okta.threatInsights.read okta.trustedOrigins.read okta.uischemas.read okta.userTypes.read okta.users.read"
# =============================================================================
# SERVER MODE
# =============================================================================
# Enable Agent Mode for autonomous AI workflows
# false (default) = Direct Mode - all tools exposed directly
# true = Agent Mode - meta-tool discovery pattern (lower context size)
ENABLE_AGENT_MODE=false
# =============================================================================
# TRANSPORT CONFIGURATION (HTTP mode only)
# =============================================================================
# HTTP transport is enabled via command-line flags:
# python -m fctr_okta_mcp.server --http-transport --i-understand-the-risks
# Or use the startup script:
# ./scripts/start_http_server.sh (Linux/macOS)
# .\scripts\start_http_server.ps1 (Windows)
# Host to bind to (default: 127.0.0.1, use 0.0.0.0 for all interfaces)
MCP_HOST=127.0.0.1
# Port to listen on (default: 8000)
MCP_PORT=8000
# Base URL for CSV download links (optional)
# Use this when behind a reverse proxy with HTTPS
# If not set, defaults to http://{MCP_HOST}:{MCP_PORT}
# MCP_BASE_URL=https://your-domain.com
# =============================================================================
# PERFORMANCE & RATE LIMITING
# =============================================================================
# Maximum concurrent API requests (default: 3)
# Lower = safer for rate limits, Higher = faster
# Recommended: 3 for trial accounts, 10-15 for production
OKTA_CONCURRENT_LIMIT=3
# Code execution timeout in seconds (default: 300 = 5 minutes)
OKTA_MCP_EXECUTION_TIMEOUT_SECONDS=300
# Maximum progress events to send (default: 20)
# API_PROGRESS_MAX_EVENTS=20
# =============================================================================
# LOGGING
# =============================================================================
# Log level: DEBUG, INFO, WARNING, ERROR (default: INFO)
OKTA_MCP_LOG_LEVEL=INFO
# Log directory (default: ./logs or ~/.fctr-okta-mcp/logs)
# OKTA_MCP_LOG_DIR=./logs
# Maximum log file size in bytes (default: 10MB)
# OKTA_MCP_MAX_LOG_SIZE=10485760
# Number of backup log files to keep (default: 5)
# OKTA_MCP_LOG_BACKUP_COUNT=5
# Enable console logging (default: true)
# OKTA_MCP_CONSOLE_LOGGING=true
