Configuration reference

This reference is generated from the platform's own @ConfigurationProperties classes -- 86 config classes binding 497 properties under the oauthy.* namespace across the services -- plus 20 operator-critical infrastructure settings. It is the set of knobs an operator (a self-managed customer or a Thoryn SRE) actually sets to run the platform, not an exhaustive dump of every internal Spring property.

The oauthy.* namespace

All of the platform's own configuration lives under a single prefix, oauthy.*, grouped by the service that reads it. A property's canonical form is a dotted, kebab-case key (oauthy.identity.magic-link.token-ttl); Spring's relaxed binding accepts the equivalent uppercase environment variable (OAUTHY_IDENTITY_MAGIC_LINK_TOKEN_TTL), which is how the Helm chart injects it.

How configuration flows

Configuration reaches a running service in three layers, each overriding the one before it:

1. application.yml defaults baked into each service image -- safe for local development, never sufficient for production.
2. Environment variables injected by the Helm chart (deploy/helm/thoryn/values.yaml -> the deployment templates), including the required values that fail chart rendering when unset.
3. Kubernetes Secrets for credentials (database passwords, Redis ACL passwords, Vault / OpenBao auth) -- mounted or referenced, never checked into source.

Responsibility split (managed vs. self-managed)

Concern	Thoryn-managed SaaS	Self-managed
Datastores, Redis, secret backend	Thoryn operates them	You provision and point the URLs at them
The oauthy.* behaviour knobs	Thoryn sets platform defaults; tenants self-serve tenant config through the console	You own every value
The required deploy-time values	Thoryn sets them per environment	You must set them or the deploy fails
Schema migrations (Flyway)	Run automatically on deploy	Run automatically on deploy

Pages

Area	What it configures	Config classes	Properties
Authorization hub	The OAuth 2.0 / OIDC identity broker (Spring Authorization Server). Tenancy, rate limiting, client provisioning, and security-event forwarding.	11	52
Product API	The customer-plane management API (resource server): FGA, DSAR, audit export, capability entitlement, multi-issuer token validation, and the idp-facade.	14	67
Identity service	Thoryn's own OIDC federation member: login, registration, password reset, magic link, WebAuthn, lockout, sessions, and user import.	47	268
Federation members	Per-provider OIDC / SAML connectors a tenant attaches (Entra ID, Okta, Google, Apple, GitHub, LDAP, ERP, SAML, ...).	9	100
API gateway	The public ingress for product-api (Spring Cloud Gateway): edge IP filtering.	2	4
Platform (shared libraries)	Cross-cutting configuration shared by several services: outbound-URL SSRF guard, URL-safety validation, and GeoIP.	3	6
Infrastructure	Datastores, Redis, Flyway, Vault/OpenBao, and the required deploy-time Helm values	—	20 settings

Coverage boundary

In scope

• Every @ConfigurationProperties(prefix = "oauthy.*") data class across servers/ and core/ -- the platform's own configuration namespace.
• A curated, operator-critical set of standard spring.* / env-var infrastructure knobs (datasource / R2DBC, Redis, Flyway, Vault / OpenBao) and the three deploy-time required Helm values.

Out of scope (deliberately)

• The parallel thoryn.* platform namespace (email / SMTP, SMS, registration, incidents, security-events, capability-families, workload-federation). It is platform-owned configuration too and is the primary candidate for a follow-up that widens this reference.
• The bare / legacy non-oauthy.* prefixes (federation, federation.vault, headless.session, hub.par, gateway, audit.unified, synthetic-monitor, actuator.api-docs, spring.flyway).
• Every other internal Spring / Spring Boot property. Those are framework knobs, not platform configuration, and documenting them here would be noise.

eIDAS / verifiable-credential configuration is out of scope for this repository (that surface moved to the thoryn-vc-broker repo).