Environment variables
The CLI creates a git-ignored .env with a unique ES256 P-256 signing key and refresh secret. Move production values into a deployment secret manager. Never commit the private JWK.
Configuration
Configure persisted ES256 keys, Redis, OAuth providers, agent identity, and deployment settings.