Application-to-runner settings
| Variable | Set it in | Purpose |
|---|---|---|
KESTREL_RUNNER_SERVICE_URL | Trusted application server or local client | Address of the Local Core HTTP bridge or remote runner service |
KESTREL_RUNNER_SERVICE_TOKEN | Trusted application server only | Authenticates calls to the runner |
Never expose the runner token through a public environment variable or browser bundle.
Provider and tool settings
| Variable | Purpose |
|---|---|
OPENROUTER_API_KEY | Authenticates an OpenRouter provider configuration |
TAVILY_API_KEY | Authenticates internet-backed search tools when enabled |
KESTREL_REASONING_MASTER_KEY | Required in hosted runtimes; a base64 or hex value that decodes to exactly 32 bytes and encrypts provider continuation and opted-in visible reasoning with separate derived keys |
KESTREL_REASONING_KEY_FILE | Optional local-runtime path for the generated 0600 reasoning key file |
Desktop stores provider choices through its settings interface. Kestrel One administrators configure organization-approved gateways through trusted administrative controls.
Hosted runtime startup fails closed when KESTREL_REASONING_MASTER_KEY is
missing or invalid. Do not log, expose, or reuse this key as provider
credentials. Local runtimes generate a private key file when no environment
key is configured.
Kestrel One services
Kestrel One production operation also requires application authentication, PostgreSQL, Redis, object storage, queue workers, email, and any enabled billing or managed-deployment services. Those deployment settings belong to authorized operators, not end-user onboarding.