Assetera DocsEnvironment and credentials
The full set of environment variables a tied-agent app needs, grouped by concern, plus how each credential is issued and why nothing is hardcoded.
Every value your app needs is an environment variable. No host, secret, or instrument id is hardcoded, which is what lets the same build run against playground, staging, and production by changing config only. This page is the single reference: each group links to the page that explains it in depth.
Secrets marked server only must never reach the browser. Only the NEXT_PUBLIC_* values are safe to
expose. See the tied-agent walkthrough for why the browser holds
only an opaque session cookie.
Identity (OIDC / Keycloak)
Your confidential OIDC client, and where to send users to sign in. Explained in Authentication and the walkthrough.
| Variable | Server only | Purpose |
|---|---|---|
ASSETERA_ISSUER | Realm issuer URL, for example https://auth.<base_domain>/realms/assetera | |
ASSETERA_CLIENT_ID | Your tenant's confidential client id | |
ASSETERA_CLIENT_SECRET | yes | Client credential (or use private_key_jwt instead of a shared secret) |
ASSETERA_REDIRECT_URI | Your callback, for example https://<your-app>/api/auth/callback |
The same client handles tied-agent registration and sign-in. The BFF reads the returned access token's
sub and uses it as the customer key for MetaKYC and the embedded wallet.
Marketplace API
The multi-tenant API your BFF proxies to. Your tenant claim scopes every response.
| Variable | Server only | Purpose |
|---|---|---|
ASSETERA_API_BASE | Marketplace API base URL | |
ASSETERA_INSTRUMENT_PAIR_ID | The single token_pairs id a tied-agent app sells (convention for the single-instrument starter) |
KYC (MetaKYC SDK)
Verification runs through @asseteragmbh/metakyc. Full setup in
KYC integration.
| Variable | Server only | Purpose |
|---|---|---|
METAKYC_BASE_URL | MetaKYC service URL | |
METAKYC_CLIENT_ID | Your MetaKYC tenant / client id (may be tenantId) | |
METAKYC_API_KEY | yes | Session-token creation |
METAKYC_SECRET_KEY | yes | Session-token creation |
NEXT_PUBLIC_METAKYC_BASE_URL | Same URL, browser side | |
NEXT_PUBLIC_METAKYC_CLIENT_ID | Same client id, browser side |
Wallet
The delivery wallet the RWA is sent to. Explained in Wallets.
| Variable | Server only | Purpose |
|---|---|---|
DYNAMIC_ENVIRONMENT_ID | Embedded ("Assetera") wallet environment id | |
WALLETCONNECT_PROJECT_ID | Optional, for connecting an external wallet by QR |
DYNAMIC_ENVIRONMENT_ID is public runtime configuration, but serve it through your environment-specific
configuration route rather than baking one environment into a reusable build. The embedded-wallet sign-in
also requires the OIDC client to be enabled for wallet-audience token exchange; Assetera configures that
server-side.
Session store
The BFF session that holds tokens server-side. On a serverless host (for example Vercel) this must be a hosted store, not in-memory, so sessions survive across function invocations.
| Variable | Server only | Purpose |
|---|---|---|
SESSION_PASSWORD | yes | 32+ char secret that encrypts the session cookie (iron-session) |
REDIS_URL | yes | Hosted session/token store |
A starting .env
# --- Identity (OIDC) ---
ASSETERA_ISSUER=
ASSETERA_CLIENT_ID=
ASSETERA_CLIENT_SECRET= # server only
ASSETERA_REDIRECT_URI=
# --- Marketplace API ---
ASSETERA_API_BASE=
ASSETERA_INSTRUMENT_PAIR_ID=
# --- KYC (MetaKYC) ---
METAKYC_BASE_URL=
METAKYC_CLIENT_ID=
METAKYC_API_KEY= # server only
METAKYC_SECRET_KEY= # server only
NEXT_PUBLIC_METAKYC_BASE_URL=
NEXT_PUBLIC_METAKYC_CLIENT_ID=
# --- Wallet ---
DYNAMIC_ENVIRONMENT_ID=
WALLETCONNECT_PROJECT_ID= # optional
# --- Session store ---
SESSION_PASSWORD= # server only, 32+ chars
REDIS_URL= # server onlyHow each credential is issued
Provisioning is done with the Assetera team, not self-serve (see Partner onboarding). You supply your app's URLs; Assetera issues the credentials bound to your tenant.
| Credential | Issued by | You provide | Delivered as |
|---|---|---|---|
OIDC client id + secret (or private_key_jwt) | Assetera Identity | Your redirect URI and app origin | Confidential client bound to your tenant |
| MetaKYC client id + API/secret keys | Assetera Compliance | Your tenant details | Tenant-scoped MetaKYC credentials |
| Instrument entitlement (pair id) | Assetera / issuer | Which instrument you sell | The token_pairs id enabled for your tenant |
| Wallet environment id | Assetera | Your wallet mode choice | Environment id for the embedded wallet |
For a DSP relying on its own onboarding, the pack replaces MetaKYC SDK credentials with the agreed identity federation and reliance-data contract. Do not request or store MetaKYC keys when your integration does not run Assetera-led onboarding.
Rotate secrets through the Assetera team, never share them across environments, and keep every server-only
value out of the repo and out of any NEXT_PUBLIC_* variable.