Configuration Properties

This page lists all configuration properties for each In-App Protection component. Properties shared across components are listed first, followed by component-specific sections.

Shared Properties

Redis Topologies

In-App Protection components connect to Redis through Lettuce and support both a single Redis instance (standalone) and a Redis OSS cluster. Redis is configured through In-App Protection-specific INAPPPROTECTION_REDIS_* environment variables, which map onto the underlying Spring Data Redis (spring.data.redis.*) properties.

[!IMPORTANT] Do not configure Redis with a connection URL (INAPPPROTECTION_REDIS_URL). Use the discrete host/port (or cluster nodes) properties instead. A Redis URL forces standalone mode and silently overrides INAPPPROTECTION_REDIS_CLUSTER_NODES, breaking OSS cluster deployments. It also embeds the access key in a single string, which the components deliberately avoid in favour of a separate INAPPPROTECTION_REDIS_PASSWORD.

The Lettuce client is forced to use the RESP2 protocol. This is required for managed Redis services (such as Azure Managed Redis with the OSS cluster policy) whose nodes reject the unauthenticated HELLO handshake that the default RESP3 protocol performs before authentication.

Authentication and TLS

The following properties apply to both topologies. Leave them unset for an unauthenticated local Redis; set them for managed Redis services (such as Azure Managed Redis).

Standalone

A standalone instance is the default. Point the components at it with INAPPPROTECTION_REDIS_HOST / INAPPPROTECTION_REDIS_PORT as listed in the shared properties above. This is also the correct topology for managed Redis using the Enterprise cluster policy, where a proxy hides cluster routing behind a single endpoint.

OSS Cluster

To run against a Redis OSS cluster (for example Azure Managed Redis with the OSS cluster policy), activate the redis-cluster Spring profile and provide the cluster nodes:

SPRING_PROFILES_ACTIVE=redis-cluster
INAPPPROTECTION_REDIS_CLUSTER_NODES=node1:6380,node2:6380

The cluster properties live in a profile-specific resource (application-redis-cluster.properties) that is loaded only when the redis-cluster profile is active. While the profile is inactive (the default), the cluster configuration is absent and the component runs standalone — so the same image serves both topologies. Activating the profile switches the components to cluster mode; INAPPPROTECTION_REDIS_HOST / INAPPPROTECTION_REDIS_PORT are then ignored. The authentication and TLS variables above apply to both topologies.

[!NOTE] Activating the redis-cluster profile without setting INAPPPROTECTION_REDIS_CLUSTER_NODES fails fast at startup. Set both together, or neither.

[!TIP] INAPPPROTECTION_REDIS_CLUSTER_NODES only needs seed nodes, not the full cluster. Lettuce performs cluster topology discovery from any reachable seed and then keeps the topology current through adaptive and periodic refresh (see the variables below). For managed Redis with the OSS cluster policy (such as Azure Managed Redis), the service exposes a single stable endpoint — point INAPPPROTECTION_REDIS_CLUSTER_NODES at that one endpoint and the remaining nodes are discovered automatically.

The following variables are honoured only when the redis-cluster profile is active:

Device API

The Device API collects security telemetry from mobile applications and triggers configurable callback.

Callbacks

Callbacks enables integration with external systems by delivering security events to configured endpoints. For each monitored application, one or more callback URLs can be registered to receive notifications about security events. When such an event is generated, it is first written to a Redis Stream for asynchronous delivery by the Integration API.

Redis Publisher Configuration

The following properties control the Redis Stream used to queue and redeliver outgoing callback messages.

Integration API

The Integration API consumes callback events from the Redis Stream and dispatches them as HTTP requests to external URLs registered per application. It also consumes email events from the Redis Stream and delivers them via the Gmail API.

Callbacks

Redis Consumer Configuration

The following properties control the Redis Stream consumer used to dispatch callback messages.

Web Client Configuration

The following properties control the HTTP client used to deliver callback requests, including timeouts and the circuit breaker that prevents repeated calls to unresponsive endpoints.

Emails

The Integration API consumes email events from the Redis Stream and delivers them via the Gmail API. Email delivery is enabled by default and requires Gmail API credentials to be configured. To disable it, set INAPPPROTECTION_EMAIL_ENABLED=false.

Email Client Configuration

Google Mail Client

OAuth 2.0 credentials for the Google Mail API. These are required when email sending is enabled. The OAuth credential must be authorized with at least the gmail.send scope.

To obtain these credentials, create OAuth 2.0 credentials in the Google Cloud Console and request the refresh token.

Redis Consumer Configuration

The following properties control the Redis Stream consumer used to dispatch email messages.

Password Reset Email Content

You can customize both the subject line and the HTML body of the password reset email. These settings are optional, if not provided, the system will fall back to the default values.

If you provide a custom HTML template, it must include the ${PASSWORD_RESET_URL} placeholder to display the reset link to the user. Available placeholders are:

Console API

The Console API provides the backend for the Console Web. It handles authentication, user management, and access to operational data.

TOTP (Two-Factor Authentication)

Console users can secure their accounts with a time-based one-time password (TOTP). The following properties configure code generation and QR code rendering for authenticator app setup.

Password Reset

These properties control the self-service password reset flow, including the security token generated and included in the password reset link sent to the user.

Email

The Console API publishes email events to a Redis Stream for asynchronous delivery by the Integration API.

Redis Publisher Configuration

The following properties control how the Console API writes outgoing email messages to the Redis Stream, including retry behaviour when publishing fails.

Logstash

Logstash polls the PostgreSQL database for new security events and ships them to Elasticsearch. All connection details are provided via environment variables.