> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sovseal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Your Self-Hosted sovseal Deployment

> Every real environment variable the edge function and client SDK read — no fictional server config included.

sovseal's self-hosted surface is small on purpose: one edge function with two auto-provisioned secrets, and a handful of client-side variables that tune the local engine. This page lists only variables that exist in the code — nothing aspirational.

## Edge Function Secrets

The `v2-agent-state` function reads exactly two values, both provisioned automatically by Supabase when you deploy — you do not set these yourself:

| Variable                    | Purpose                                              |
| --------------------------- | ---------------------------------------------------- |
| `SUPABASE_URL`              | The project's API URL.                               |
| `SUPABASE_SERVICE_ROLE_KEY` | Server-side key used for privileged database access. |

<Warning>
  There is no `OPENAI_API_KEY`, `JWT_SECRET`, `ADMIN_API_KEY`, or `AUTH_DISABLED` for this deployment. Authentication is verified against WorkOS's remote JWKS (`jose.createRemoteJWKSet`) — there is no local secret to configure, and no mode that disables authentication. If you need a custom auth boundary, that is a fork, not a configuration option.
</Warning>

## Client-Side Environment Variables

These are read by `@sovseal/mcp-server` (and, where noted, by both SDKs) from the process environment.

| Variable                   | Default              | Purpose                                                                                                                                                        |
| -------------------------- | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `SOVSEAL_KEY_FALLBACK`     | —                    | Set to `file` to store the master key at `~/.sovseal/` (0600) when no OS keychain is available. If unset and no keychain exists, the process **fails closed**. |
| `SOVSEAL_DB_DIR`           | `~/.sovseal/db/`     | Override where the local LanceDB database is written.                                                                                                          |
| `SOVSEAL_MODEL_DIR`        | `~/.sovseal/models/` | Override where the ONNX embedding model is downloaded and cached.                                                                                              |
| `SOVSEAL_DECAY_EPISODIC`   | `14`                 | **Half-life in days** for episodic memories. Internally: `lambda = ln(2) / halfLife`. Lower values decay faster.                                               |
| `SOVSEAL_DECAY_SEMANTIC`   | `90`                 | Half-life in days for semantic (factual) memories.                                                                                                             |
| `SOVSEAL_DECAY_PROCEDURAL` | `180`                | Half-life in days for procedural (how-to) memories — the most persistent by default.                                                                           |
| `SOVSEAL_NAMESPACE`        | `"default"`          | Resolves which namespace's retention policy applies.                                                                                                           |

<Note>
  The decay variables are **half-lives in days**, not raw decay rates — `SOVSEAL_DECAY_EPISODIC=7` means episodic memories lose half their reinforcement weight every 7 days, not that the decay constant itself is 7.
</Note>

## Pointing the SDK at Your Self-Hosted Endpoint

Both SDKs take the endpoint as a constructor argument — there is no environment variable that redirects it implicitly, and no "managed by default, opt out" behavior. You choose the endpoint every time you construct the client:

<CodeGroup>
  ```typescript Node theme={null}
  import { AgentStateClient } from "@sovseal/sdk";

  const client = new AgentStateClient({
    endpoint: "https://your-project-ref.supabase.co/functions/v1/v2-agent-state",
    apiKey: "your-self-hosted-key",
  });
  ```

  ```python Python theme={null}
  from sovseal import AgentStateClient

  client = AgentStateClient(
      endpoint="https://your-project-ref.supabase.co/functions/v1/v2-agent-state",
      api_key="your-self-hosted-key",
  )
  ```
</CodeGroup>

For local semantic memory (`store` / `recall`), see [ONEBRAIN's degradation contract](/platform/quickstart) — that path talks to the local native host over IPC and is independent of which replication endpoint you configure here.

## Payload Limits

The edge function enforces a **256 KB** hard cap on ciphertext per replicated chunk, regardless of deployment target. See [Limits & SLAs](/platform/features/limits-and-slas) — this is not configurable, self-hosted or not.