Select release
Introduction

Home

Installation

Configuration

Monitoring

Console Installation and Configuration

Integration

Artifact Signing

Migration Instructions

API Reference

General Principles

Admin API

Audit API

Authentication API

Passkeys API

Communication API

Operations API

Registrations API

Reference

Callbacks API (Webhooks)

Configuration Properties

Console Configuration Properties

Database Structure

Internal Architecture

Push Messages Extras

Additional Topics

Database Setup for PostgreSQL

Database Setup for Oracle

Database Setup for MSSQL

Examples

Examples of Operation Types

Configuration Properties

View product develop

You can set the following configurations to the PowerAuth Cloud components:

Docker Container

Environment Variable Default Value Description
TOMCAT_BIND_ALL_INTERFACES false By default, the internal application server connectors (ports 8080 and 8081) are bound only to the loopback interface (127.0.0.1). Set to true to bind them to all network interfaces (0.0.0.0). See Internal Architecture for details and security considerations

PowerAuth Server

Environment Variable Default Value Description
POWERAUTH_SERVER_JPA_CHARSET utf8  
POWERAUTH_SERVER_JPA_CHARACTER_ENCODING utf8  
POWERAUTH_SERVER_JPA_USE_UNICODE true  
POWERAUTH_SERVER_JPA_LOCK_TIMEOUT 10000 Database lock timeout configuration
POWERAUTH_SERVER_DATASOURCE_JNDI_NAME false  
POWERAUTH_SERVER_SPRING_JMX_ENABLED false  
POWERAUTH_SERVER_SPRING_JMX_DEFAULT_DOMAIN powerauth-server  
POWERAUTH_SERVER_HTTP_PROXY_ENABLED false  
POWERAUTH_SERVER_HTTP_PROXY_HOST 127.0.0.1 Proxy host
POWERAUTH_SERVER_HTTP_PROXY_PORT 8080 Proxy port
POWERAUTH_SERVER_HTTP_PROXY_USERNAME   Proxy username
POWERAUTH_SERVER_HTTP_PROXY_PASSWORD   Proxy password
POWERAUTH_SERVER_HTTP_CONNECTION_TIMEOUT 5000 Service connect timeout in milliseconds
POWERAUTH_SERVER_RESTRICT_ACCESS false Whether access to the REST API is restricted
POWERAUTH_SERVER_ACTIVATION_VALIDITY_MILLIS 120000 Default expiration period for activations
POWERAUTH_SERVER_CRYPTO_TEMPORARY_ACTIVATION_BLOCK_ENABLED false Whether the temporary activation block feature is enabled. Applies to activations using cryptography protocol v4. When enabled, such activations that reach the maximum number of failed attempts are blocked for a limited time and automatically returned to the ACTIVE state. Activations using older protocol versions are blocked permanently regardless of this flag.
POWERAUTH_SERVER_CRYPTO_TEMPORARY_ACTIVATION_BLOCK_PERIOD_IN_MILLISECONDS 300000 Time period (in milliseconds) for the first temporary activation block. Default 5 minutes.
POWERAUTH_SERVER_CRYPTO_TEMPORARY_ACTIVATION_BLOCK_MULTIPLIER 2 Multiplier applied to the temporary block period for consecutive blocks. The n-th consecutive block lasts periodInMilliseconds * multiplier^(n-1) ms.
POWERAUTH_SERVER_DB_MASTER_ENCRYPTION_ALGORITHM AEAD_KMAC Encryption algorithm for per-record encryption of database records
POWERAUTH_SERVER_DB_MASTER_ENCRYPTION_KEY   Master DB encryption key for algorithm AES_HMAC
POWERAUTH_SERVER_DB_MASTER_ENCRYPTION_AEAD_KMAC_KEY   Master DB encryption key for algorithm AEAD_KMAC
POWERAUTH_SERVER_SECURE_VAULT_ENABLE_BIOMETRY false Whether biometry is enabled in Secure Vault
POWERAUTH_SERVER_APPLICATION_NAME powerauth-server  
POWERAUTH_SERVER_APPLICATION_DISPLAY_NAME PowerAuth Server  
POWERAUTH_SERVER_APPLICATION_ENVIRONMENT   Application environment exposed in status endpoint
POWERAUTH_SERVER_LOGGING    
POWERAUTH_SERVER_AUTHENTICATION_CODE_MAX_FAILED_ATTEMPTS 5 Maximum failed attempts for signature verification
POWERAUTH_SERVER_PROXIMITY_CHECK_OTP_LENGTH 8 Length of OTP generated for proximity check
POWERAUTH_SERVER_PROXIMITY_CHECK_OTP_STEP_DURATION 30s Time-step duration used for generating and validating TOTP for the proximity check
POWERAUTH_SERVER_PROXIMITY_CHECK_OTP_STEP_COUNT 1 Number of past time-steps used for validating TOTP for the proximity check
POWERAUTH_SERVER_CALLBACKS_DEFAULT_MAX_ATTEMPTS 1 Default maximum number of dispatch attempts for a callback event
POWERAUTH_SERVER_CALLBACKS_DEFAULT_RETENTION_PERIOD 30d Default retention period of a completed callback event before deleting its record from the database table
POWERAUTH_SERVER_CALLBACKS_DEFAULT_INITIAL_BACKOFF 2s Default initial backoff after an unsuccessful attempt to dispatch a callback event
POWERAUTH_SERVER_CALLBACKS_MAX_BACKOFF 32s The maximum allowable backoff period between successive attempts to dispatch a callback event
POWERAUTH_SERVER_CALLBACKS_BACKOFF_MULTIPLIER 1.5 The multiplier used to calculate the backoff period
POWERAUTH_SERVER_CALLBACKS_PENDING_CALLBACK_URL_EVENTS_DISPATCH_LIMIT 100 Maximum number of pending callback events that will be dispatched in a single scheduled job run
POWERAUTH_SERVER_CALLBACKS_THREAD_POOL_CORE_SIZE 1 Number of core threads in the thread pool used by the executor
POWERAUTH_SERVER_CALLBACKS_THREAD_POOL_MAX_SIZE 2 Maximum number of threads in the thread pool used by the executor
POWERAUTH_SERVER_CALLBACKS_THREAD_POOL_QUEUE_CAPACITY 1000 Queue capacity of the thread pool used by the executor
POWERAUTH_SERVER_CALLBACKS_FORCE_RERUN_PERIOD   Time period after which a currently processed callback event is considered stale and should be scheduled to rerun
POWERAUTH_SERVER_CALLBACKS_FAILURE_THRESHOLD 200 The number of consecutive failures allowed for callback events with the same configuration. If set to -1, unlimited number of failures is allowed
POWERAUTH_SERVER_CALLBACKS_FAILURE_RESET_TIMEOUT 60s Time period after which a Callback URL Event will be dispatched, even if failure threshold has been reached
POWERAUTH_SERVER_CALLBACKS_CLIENTS_CACHE_REFRESH_AFTER_WRITE 5m Callback REST clients are cached and automatically evicted if updated through the Callback Management API on a single node. Time-based refreshing mechanism is a fallback in clustered environments

Push Server

Environment Variable Default Value Description
PUSH_SERVER_POWERAUTH_SERVICE_RESPONSE_TIMEOUT 60s PowerAuth REST API response timeout
PUSH_SERVER_POWERAUTH_SERVICE_MAX_IDLE_TIME 200s PowerAuth REST API max idle time
PUSH_SERVER_SECURITY_CLIENT_TOKEN   PowerAuth REST API authentication token
PUSH_SERVER_SECURITY_CLIENT_SECRET   PowerAuth REST API authentication secret / password
PUSH_SERVER_ACCEPT_INVALID_SSL_CERTIFICATE false Whether to accept invalid SSL certificate.
PUSH_SERVER_JPA_CHARSET utf8  
PUSH_SERVER_JPA_CHARACTER_ENCODING utf8  
PUSH_SERVER_JPA_USE_UNICODE true  
PUSH_SERVER_APNS_DEVELOPMENT true Flag indicating that the development instance of APNS service should be used
PUSH_SERVER_APNS_PROXY_ENABLED false Flag indicating if the communication needs to go through proxy
PUSH_SERVER_APNS_PROXY_HOST 127.0.0.1 Proxy host
PUSH_SERVER_APNS_PROXY_PORT 8080 Proxy port
PUSH_SERVER_APNS_PROXY_USERNAME   Proxy username
PUSH_SERVER_APNS_PROXY_PASSWORD   Proxy password
PUSH_SERVER_FCM_PROXY_ENABLED false Flag indicating if the communication needs to go through proxy
PUSH_SERVER_FCM_PROXY_HOST 127.0.0.1 Proxy host
PUSH_SERVER_FCM_PROXY_PORT 8080 Proxy port
PUSH_SERVER_FCM_PROXY_USERNAME   Proxy username
PUSH_SERVER_FCM_PROXY_PASSWORD   Proxy password
PUSH_SERVER_FCM_DATA_NOTIFICATION_ONLY false Flag indicating that FCM service should never use “notification” format, only a data format with extra payload representing the notification
PUSH_SERVER_HMS_PROXY_ENABLED false Flag indicating if the communication needs to go through proxy
PUSH_SERVER_HMS_PROXY_HOST 127.0.0.1 Proxy host
PUSH_SERVER_HMS_PROXY_PORT 8080 Proxy port
PUSH_SERVER_HMS_PROXY_USERNAME   Proxy username
PUSH_SERVER_HMS_PROXY_PASSWORD   Proxy password
PUSH_SERVER_HMS_DATA_NOTIFICATION_ONLY false Flag indicating that HMS service should never use “notification” format, only a data format with extra payload representing the notification
PUSH_SERVER_DATASOURCE_JNDI_NAME false  
PUSH_SERVER_CAMPAIGN_BATCH_SIZE 100000  
PUSH_SERVER_MESSAGE_STORAGE_ENABLED false Whether persistent storing of sent messages is enabled
PUSH_SERVER_REGISTRATION_MULTIPLE_ACTIVATIONS_ENABLED false Whether push registration supports “associated activations”
PUSH_SERVER_SPRING_BATCH_JOB_ENABLED false  
PUSH_SERVER_SPRING_JMX_ENABLED false  
PUSH_SERVER_SPRING_JMX_DEFAULT_DOMAIN powerauth-push-server  
PUSH_SERVER_FCM_CONNECT_TIMEOUT 5000 Push message gateway connect timeout in milliseconds
PUSH_SERVER_APNS_CONNECT_TIMEOUT 5000 Push message gateway connect timeout in milliseconds
PUSH_SERVER_HMS_CONNECT_TIMEOUT 5000 Push message gateway connect timeout in milliseconds
PUSH_SERVER_APPLICATION_NAME powerauth-push-server  
PUSH_SERVER_APPLICATION_DISPLAY_NAME PowerAuth Push Server  
PUSH_SERVER_APPLICATION_ENVIRONMENT   Environment identifier
PUSH_SERVER_LOGGING    

PowerAuth Cloud

Environment Variable Default Value Description
POWERAUTH_CLOUD_POWERAUTH_SERVICE_SECURITY_CLIENT_SECRET   PowerAuth REST API authentication secret / password
POWERAUTH_CLOUD_POWERAUTH_SERVICE_SECURITY_CLIENT_TOKEN   PowerAuth REST API authentication token
POWERAUTH_CLOUD_POWERAUTH_SERVICE_RESPONSE_TIMEOUT 60s PowerAuth REST API response timeout
POWERAUTH_CLOUD_POWERAUTH_SERVICE_MAX_IDLE_TIME 200s PowerAuth REST API max idle time
POWERAUTH_CLOUD_FIDO2_SERVICE_SECURITY_CLIENT_SECRET   PowerAuth FIDO2 API authentication secret / password
POWERAUTH_CLOUD_FIDO2_SERVICE_SECURITY_CLIENT_TOKEN   PowerAuth FIDO2 API authentication token
POWERAUTH_CLOUD_FIDO2_SERVICE_RESPONSE_TIMEOUT 60s PowerAuth FIDO2 API response timeout
POWERAUTH_CLOUD_FIDO2_SERVICE_MAX_IDLE_TIME 200s PowerAuth FIDO2 API max idle time
POWERAUTH_CLOUD_PUSH_SERVER_RESPONSE_TIMEOUT 60s Push Server API response timeout
POWERAUTH_CLOUD_PUSH_SERVER_MAX_IDLE_TIME 200s Push Server API max idle time
POWERAUTH_CLOUD_DATASOURCE_JNDI_NAME false  
POWERAUTH_CLOUD_DATASOURCE_URL jdbc:postgresql://host.docker.internal:5432/powerauth  
POWERAUTH_CLOUD_DATASOURCE_USERNAME $USERNAME$  
POWERAUTH_CLOUD_DATASOURCE_PASSWORD $PASSWORD$  
POWERAUTH_CLOUD_JPA_CHARSET utf8  
POWERAUTH_CLOUD_JPA_CHARACTER_ENCODING utf8  
POWERAUTH_CLOUD_JPA_USE_UNICODE true  
POWERAUTH_CLOUD_JPA_LOCK_TIMEOUT 10000 Database lock timeout configuration
POWERAUTH_CLOUD_LOGGING    
POWERAUTH_CLOUD_SECURITY_AUTH_TYPE BASIC_HTTP BASIC_HTTP for basic HTTP authentication or OIDC for OpenID Connect. If OIDC is enabled, the properties below must be configured.
POWERAUTH_CLOUD_SECURITY_AUTH_OIDC_ROLES_CLAIM   A name of the claim in the JWT that contains the user roles.
POWERAUTH_CLOUD_SECURITY_AUTH_OIDC_ISSUER_URI   URL of the provider, e.g. https://sts.windows.net/example/
POWERAUTH_CLOUD_SECURITY_AUTH_OIDC_AUDIENCES   A comma-separated list of allowed aud JWT claim values to be validated.
POWERAUTH_CLOUD_DEVICEINFOTRANSLATION_BATCHSIZE 100 Batch size to use when querying the DB to translate the device info
POWERAUTH_CLOUD_DEVICEINFOTRANSLATION_DATALOAD_CRON 0 0 1 * * * Cron expression for the device info mapping data load job (use - to turn it off completely)
POWERAUTH_CLOUD_DEVICEINFOTRANSLATION_DATALOAD_BATCHSIZE 100 Batch size to use when loading device info mapping data to the database
POWERAUTH_CLOUD_DEVICEINFOTRANSLATION_DATALOAD_SOURCE_ANDROID_LOCATION /opt/device-info-mapping/android.csv Source Android device info mapping file location (set to empty value to not load Android data)
POWERAUTH_CLOUD_DEVICEINFOTRANSLATION_DATALOAD_SOURCE_ANDROID_ENCODING UTF-16LE Source Android device info mapping file encoding
POWERAUTH_CLOUD_DEVICEINFOTRANSLATION_DATALOAD_SOURCE_IOS_LOCATION /opt/device-info-mapping/ios.txt Source iOS device info mapping file location (set to empty value to not load iOS data)
POWERAUTH_CLOUD_DEVICEINFOTRANSLATION_DATALOAD_SOURCE_IOS_ENCODING UTF-8 Source iOS device info mapping file encoding

Enrollment Server

Environment Variable Default Value Description
ENROLLMENT_SERVER_POWERAUTH_SERVICE_RESPONSE_TIMEOUT 60s PowerAuth REST API response timeout
ENROLLMENT_SERVER_POWERAUTH_SERVICE_MAX_IDLE_TIME 200s PowerAuth REST API max idle time
ENROLLMENT_SERVER_POWERAUTH_SERVICE_SECURITY_CLIENT_SECRET   PowerAuth REST API authentication secret / password
ENROLLMENT_SERVER_POWERAUTH_SERVICE_SECURITY_CLIENT_TOKEN   PowerAuth REST API authentication token
ENROLLMENT_SERVER_PUSH_SERVER_RESPONSE_TIMEOUT 60s Push Server response timeout
ENROLLMENT_SERVER_PUSH_SERVER_MAX_IDLE_TIME 200s Push Server max idle time
ENROLLMENT_SERVER_MTOKEN_ENABLED true Publishing of Mobile Token endpoints can be enabled or disabled using this property
ENROLLMENT_SERVER_ACTIVATION_SPAWN_ENABLED false The activation spawn functionality can be enabled or disabled using this property
ENROLLMENT_SERVER_DATASOURCE_JNDI_NAME false  
ENROLLMENT_SERVER_ADMIN_ENABLED true The admin API can be enabled or disabled using this property
ENROLLMENT_SERVER_ACTIVATION_REMOVE_ALLOW_1FA false Whether single-factor authentication using POSSESSION factor is permitted for the activation removal endpoint
ENROLLMENT_SERVER_JPA_CHARSET utf8  
ENROLLMENT_SERVER_JPA_CHARACTER_ENCODING utf8  
ENROLLMENT_SERVER_JPA_USE_UNICODE true  
ENROLLMENT_SERVER_JPA_LOCK_TIMEOUT 10000 Database lock timeout configuration
ENROLLMENT_SERVER_USER_INFO_PROVIDER   Whether to register minimal claims provider (value MINIMAL) or REST provider (value REST)
ENROLLMENT_SERVER_USER_INFO_REST_URL   Base URL of user-info storage. Must be specified if the provider is type of REST
ENROLLMENT_SERVER_USER_INFO_REST_BASIC_ENABLED false Whether Basic authentication enabled
ENROLLMENT_SERVER_USER_INFO_REST_BASIC_USERNAME   Basic authentication username
ENROLLMENT_SERVER_USER_INFO_REST_BASIC_PASSWORD   Basic authentication password
ENROLLMENT_SERVER_LOGGING    
ENROLLMENT_SERVER_FLAG_REPORTING false Enable sharing the flags in the public API

Please note that under normal circumstanced you are supposed to define only:

POWERAUTH_CLOUD_DATASOURCE_URL=jdbc:postgresql://host.docker.internal:5432/powerauth
POWERAUTH_CLOUD_DATASOURCE_USERNAME=$USERNAME$
POWERAUTH_CLOUD_DATASOURCE_PASSWORD=$PASSWORD$

Consult support if you have some specific request.

Last updated on Oct 29, 2026 (11:36) View product
On this page:

develop

PowerAuth Cloud