Lowkey environment variables: installer and runtime

Lowkey uses environment variables in two places: on your local machine to control the installer, and on the EC2 instance at runtime to configure each agent pack. This page documents both sets.

Installer variables (local shell)

Set these in your shell before piping the installer to bash. They influence how install.sh behaves during the deploy.

Variable	Effect
`AWS_REGION` / `AWS_DEFAULT_REGION`	Sets the AWS region for deployment. Overrides the default from your AWS CLI profile.
`AWS_PROFILE`	Uses the named AWS CLI profile for all AWS API calls made during installation.
`DEBUG_IN_REPO=1`	Runs the installer from the current working directory instead of cloning from GitHub. Equivalent to passing `--debug-in-repo`.

Precedence for installer configuration

When a value can come from multiple sources, the installer resolves it in this order:

Explicit CLI flag (e.g. --profile builder) — highest priority
Environment variable (e.g. AWS_REGION)
Pack manifest default (packs/<pack>/manifest.yaml) — lowest priority

Deploy-time parameters

The installer computes these values from your pack, profile, and flags, then passes them to CloudFormation or Terraform. You don’t set these directly — they are documented here as a reference for the CloudFormation parameters and Terraform variables that control your deployment.

Setting	CloudFormation parameter	How to set it
Agent pack	`PackName`	`--pack <name>` flag
Permission profile	`ProfileName`	`--profile <name>` flag
Bedrock region	`BedrockRegion`	`AWS_REGION` env var or advanced mode
Default AI model	`DefaultModel`	Set automatically per pack; override in advanced mode
Model access mode	`ModelMode`	`bedrock` (default), `litellm`, or `api-key`; advanced mode
LiteLLM proxy URL	`LiteLLMBaseUrl`	Advanced mode
LiteLLM API key	`LiteLLMApiKey`	Advanced mode (marked NoEcho in CloudFormation)
LiteLLM model alias	`LiteLLMModel`	Advanced mode
Provider API key	`ProviderApiKey`	Advanced mode (marked NoEcho in CloudFormation)
Kiro API secret	`KiroFromSecret`	`--kiro-from-secret <secret-id>` flag
OpenClaw gateway port	`OpenClawGatewayPort`	Advanced mode (default: `3001`)

LiteLLMApiKey and ProviderApiKey are NoEcho: true in CloudFormation — they don’t appear in stack history or describe-stacks output. However, they do pass through UserData. For long-lived secrets, use the --kiro-from-secret / Secrets Manager pattern instead. See Managing secrets with AWS Secrets Manager.

Instance variables — per-pack runtime

Once the agent pack is installed and running, pack-specific variables are sourced from shell profiles on the instance. These are what each agent actually reads at runtime.

openclaw
claude-code
codex-cli
kiro-cli
bedrockify-backed packs

OPENCLAW_GATEWAY_URL=http://localhost:3001
OPENCLAW_GATEWAY_TOKEN=<auto-generated at install time>
AWS_DEFAULT_REGION=<from pack config>

ANTHROPIC_MODEL=us.anthropic.claude-sonnet-4-6
ANTHROPIC_DEFAULT_HAIKU_MODEL=us.anthropic.claude-haiku-4-5-20251001-v1:0
AWS_DEFAULT_REGION=<from pack config>
CLAUDE_CODE_USE_BEDROCK=1

Codex CLI reads ~/.codex/config.toml, which is managed by the pack. It also reads OPENAI_API_KEY if set at runtime. No environment variables are written by the pack itself — you authenticate by running codex login after connecting via SSM.

KIRO_API_KEY=<resolved from Secrets Manager at install time>

The key is written to ~/.kiro/env with 0600 permissions and sourced from ~/.bash_profile. The raw key is never in UserData or Terraform state.

Applies to hermes, pi, ironclaw, and nemoclaw. These packs route model calls through the bedrockify proxy running on port 8090:

OPENAI_API_BASE=http://localhost:8090/v1
OPENAI_BASE_URL=http://localhost:8090/v1
# Pack-specific model variable, for example:
# LLM_MODEL for ironclaw
# HERMES_MODEL for hermes

CLI

Deploy

Security

​Installer variables (local shell)

​Precedence for installer configuration

​Deploy-time parameters

​Instance variables — per-pack runtime

Installer variables (local shell)

Precedence for installer configuration

Deploy-time parameters

Instance variables — per-pack runtime