Skip to main content
Production deployment must provide an identity adapter and server secrets. The local fallback session is deliberately unavailable on a public production host.

​
Application security settings

Use independent random values for the signing, HMAC, and delivery settings. Store them in the deployment secret manager. If GEO_OPERATION_TOKEN_SECRET is absent, the application creates apps/web/data/.operation-token-secret with mode 0600. That file must persist across restarts and instances, so an environment-managed secret is easier to operate in a replicated deployment.

​
Operator integrations

Configure the integrations used by the chosen workflows: These are operator secrets. The worker resolves them from the process or operator root environment. Workspace credential storage is not consulted for OpenRouter, Exa, AgentMail, or PageSpeed.

​
Local operator mode

Set GEO_OPERATOR_MODE=local only for local development. Fallback access is accepted when:
  • The environment is not production
  • The request host is an exact loopback host
  • The direct peer is loopback
The local session lasts eight hours and uses signed origin and CSRF state.
Local mode is not a production authentication provider. The production service hook must map a verified identity email to active workspace memberships.

​
Worker and metering boundary

The web application launches only allowlisted CLI jobs. A worker receives a signed operation token and calls metering endpoints over loopback to:
  • Heartbeat its lease
  • Authorize the next provider call
  • Record an idempotent cost event
  • Seal its manifest
  • Settle or release the reservation
Do not expose these loopback endpoints through a public proxy.

​
Trusted proxy behavior

By default, the direct peer IP is the client IP. Forwarded IP headers are honored only when GEO_TRUST_PROXY=1 and the direct proxy peer is loopback. This rule protects API key CIDR restrictions from spoofed forwarding headers.

​
Data and permissions

The web database contains credentials, encrypted pending key deliveries, sessions, chat, billing, and team data. Worker log files are private and created with mode 0600. Back up both application and pipeline databases consistently, but do not merge them. See Data model for ownership boundaries.