Environment variables

Every sample on this site configures from the environment, so nothing prints a literal endpoint or credential.

The two that always matter

Variable	Value
VECTADYNE_MCP_URL	The MCP endpoint. https://api.vectadyne.ai/mcp unless you were given another
VECTADYNE_TOKEN	A bearer token for a principal in your tenant

https://api.vectadyne.ai is the canonical origin — the REST API is /v1 on the same host, and it is the OAuth issuer every discovery document is built from.

Machine credentials

Use these instead of VECTADYNE_TOKEN for anything unattended. The SDK exchanges them for a short-lived token and refreshes it transparently.

Variable
VECTADYNE_CLIENT_ID	Machine principal client id
VECTADYNE_CLIENT_SECRET	Its secret — a secret, unlike the URL
VECTADYNE_TOKEN_URL	Token endpoint. Derived from the MCP URL if unset

See Enrol a machine principal.

Support differs by SDK

	Reads the environment	How
Go	✅	vectadyne.Config{}.FromEnv()
Python	✅	AgentConfig.from_env()
TypeScript	❌	no facade — read process.env yourself

The TypeScript gap is real and listed rather than discovered:

const mcpUrl = process.env.VECTADYNE_MCP_URL;
const token = process.env.VECTADYNE_TOKEN;
if (!mcpUrl || !token) {
  throw new Error("VECTADYNE_MCP_URL and VECTADYNE_TOKEN are required");
}
const client = new VectadyneMCPClient({ mcpUrl, token, app: "my-agent" });

Check both and fail loudly at startup. A client constructed with undefined fails later, further from the cause.

Explicit beats environment

In all three SDKs an explicitly-passed value wins over the environment. FromEnv() fills in what you did not supply; it does not override you.

cfg := vectadyne.Config{App: "release-bot"}.FromEnv().WithDefaults()
//                      ^ kept              ^ fills the rest  ^ defaults

What is a secret

Not a secret	Secret
VECTADYNE_MCP_URL	VECTADYNE_TOKEN
VECTADYNE_CLIENT_ID	VECTADYNE_CLIENT_SECRET
VECTADYNE_TOKEN_URL

In CI, put the URL and client id in variables and the token and secret in the secret store.

Credentials are typed values in the SDKs — every formatting path (%+v, repr, asdict, vars, an f-string) yields <redacted>, and reading the real value is an explicit, greppable call. Redaction is a property of the value, not of one display path.

Not for you

spec/reference/config.md in the server repository lists server-operator settings — latency budgets, backend selection, index tuning. None of it is settable by an integrator, and none of it is here.

Next

• Getting access · Enrol a machine principal · SDK parity