Core Application Settings
Required Variables
These variables must be set in production environments:Secret key for authenticating the admin client with the Notify API.Security: This value must be kept secure and should be unique per environment.
URL of the Notify API backend service.Default (development):
http://localhost:6011Example: https://api.notifications.service.gov.ukFlask secret key used for securely signing session cookies and CSRF tokens.Security: Must be a cryptographically random string. Never commit this to version control.
Salt value used for additional cryptographic operations with itsdangerous library.Security: Should be a unique random string per environment.
Application URLs
The base URL where the admin application is accessible.Default:
http://localhost:6012Production example: https://www.notifications.service.gov.ukHTTP protocol to use for generated URLs.Default:
httpOptions: http, httpsTemplate Preview Service
URL of the template preview service for rendering email and letter templates.Default:
http://localhost:6013API key for authenticating with the template preview service.Default:
my-secret-keyLogging and Monitoring
The environment name for the application.Default:
developmentOptions: development, test, sandbox, productionLog level for HTTP request logging.Default:
INFOOptions: DEBUG, INFO, WARNING, ERROR, CRITICALEnable eventlet statistics collection.Default:
0 (disabled)Options: 0 (disabled), 1 (enabled)Antivirus Integration
URL of the antivirus scanning service for uploaded files.Default (development):
http://localhost:6016API key for authenticating with the antivirus service.Default (development):
test-keyRedis Configuration
Connection URL for Redis, used for session storage and caching.Default (development):
redis://localhost:6379/0Format: redis://host:port/databaseEnable or disable Redis usage.Default:
1 (enabled in production), 0 in development unless explicitly setOptions: 0 (disabled), 1 (enabled)In production, Redis is enabled by default. In development, you must explicitly set
REDIS_ENABLED=1 to use Redis.AWS S3 Bucket Configuration
See AWS Setup for detailed information on configuring AWS credentials.S3 bucket for storing uploaded CSV files for batch sending.Default:
local-notifications-csv-uploadDevelopment: development-notifications-csv-uploadS3 bucket for storing contact list files.Default:
local-contact-listDevelopment: development-contact-listS3 bucket for storing email and letter branding logos.Default:
public-logos-localDevelopment: public-logos-toolsS3 bucket for storing Memorandum of Understanding documents.Default:
local-mouDevelopment: notify.tools-mouS3 bucket for temporarily storing uploaded letter PDFs.Default:
local-transient-uploaded-lettersDevelopment: development-transient-uploaded-lettersS3 bucket for backing up original precompiled letter files.Default:
local-precompiled-originals-backup-lettersDevelopment: development-letters-precompiled-originals-backupS3 bucket for storing letter attachments.Default:
local-letter-attachmentsDevelopment: development-letter-attachmentsS3 bucket for storing generated report files for download.Default:
local-report-requests-downloadDevelopment: development-report-requests-downloadS3 bucket for storing email template attachment files.Default:
local-template-email-filesDevelopment: development-template-email-filesCDN and Assets
Domain for serving static assets (CSS, JavaScript, images).Default:
"" (empty string, assets served from same domain)Example: static.notifications.service.gov.ukPath or URL for static assets.Default:
/static/Production example: https://static.notifications.service.gov.uk/CDN domain for serving logo images.Default:
static-logos.notify.toolsUI Customization
Background color for the application header.Default:
#81878b (grey)Sandbox: #F499BE (pink)Format: Hex color codeSupport and Ticketing
API key for integrating with Zendesk support ticketing system.Required for: Submitting support tickets and feedback from the admin interface.
Add environment prefix to Zendesk ticket subjects.Default:
1 (enabled)Options: 0 (disabled), 1 (enabled)Email Validation
Timeout in seconds for reply-to email address validation.Default:
45Billing Configuration
JSON string containing billing account details displayed to services.Format: JSON object with fields:
account_number, sort_code, IBAN, swift, notify_billing_email_addressDefault:Development-Only Variables
These variables are only used in development/test environments:The server name/domain for the application in development.Environment: Development only
Path to the Flask application entry point.Default:
application.pyEnvironment: Development onlyEnable Flask debug mode with enhanced error pages.Options:
0 (disabled), 1 (enabled)Environment: Development onlyControl the Werkzeug debugger PIN requirement.Options:
off (disable PIN), or leave unset for default behaviorEnvironment: Development onlyConfiguration Classes
The application uses different configuration classes based on theNOTIFY_ENVIRONMENT variable:
Base Config
Used in production. Requires all security-critical variables to be set explicitly.Development
Extends Base Config with development-friendly defaults:DEBUG = TrueSESSION_COOKIE_SECURE = False(allows HTTP)- Development S3 bucket names
- Default API endpoints pointing to localhost
Test
Extends Development with test-specific settings:TESTING = TrueWTF_CSRF_ENABLED = False(for easier testing)- Test-specific S3 bucket names
- Mock API endpoints
Sandbox
Extends Base Config for the sandbox environment:- Pink header color for visual distinction
- HTTPS enforcement
- Sandbox-specific S3 buckets
Environment File Example
For local development, create anenvironment.sh file:
Security Considerations
Rotate
SECRET_KEY, DANGEROUS_SALT, and all API keys regularly, especially after team member departures or suspected compromise.Related Documentation
- AWS Setup - AWS credentials and S3 bucket configuration
- Session Management - Session configuration and security