> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lowkey.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Lowkey environment variables: installer and runtime

> Shell variables that control the Lowkey installer, plus the runtime variables set on your EC2 instance for each agent pack after deploy completes.

Lowkey uses environment variables in two places: on your local machine to control the installer, and on the EC2 instance at runtime to configure each agent pack. This page documents both sets.

## Installer variables (local shell)

Set these in your shell before piping the installer to bash. They influence how `install.sh` behaves during the deploy.

| Variable                            | Effect                                                                                                                         |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| `AWS_REGION` / `AWS_DEFAULT_REGION` | Sets the AWS region for deployment. Overrides the default from your AWS CLI profile.                                           |
| `AWS_PROFILE`                       | Uses the named AWS CLI profile for all AWS API calls made during installation.                                                 |
| `DEBUG_IN_REPO=1`                   | Runs the installer from the current working directory instead of cloning from GitHub. Equivalent to passing `--debug-in-repo`. |

### Precedence for installer configuration

When a value can come from multiple sources, the installer resolves it in this order:

1. **Explicit CLI flag** (e.g. `--profile builder`) — highest priority
2. **Environment variable** (e.g. `AWS_REGION`)
3. **Pack manifest default** (`packs/<pack>/manifest.yaml`) — lowest priority

## Deploy-time parameters

The installer computes these values from your pack, profile, and flags, then passes them to CloudFormation or Terraform. You don't set these directly — they are documented here as a reference for the CloudFormation parameters and Terraform variables that control your deployment.

| Setting               | CloudFormation parameter | How to set it                                               |
| --------------------- | ------------------------ | ----------------------------------------------------------- |
| Agent pack            | `PackName`               | `--pack <name>` flag                                        |
| Permission profile    | `ProfileName`            | `--profile <name>` flag                                     |
| Bedrock region        | `BedrockRegion`          | `AWS_REGION` env var or advanced mode                       |
| Default AI model      | `DefaultModel`           | Set automatically per pack; override in advanced mode       |
| Model access mode     | `ModelMode`              | `bedrock` (default), `litellm`, or `api-key`; advanced mode |
| LiteLLM proxy URL     | `LiteLLMBaseUrl`         | Advanced mode                                               |
| LiteLLM API key       | `LiteLLMApiKey`          | Advanced mode (marked NoEcho in CloudFormation)             |
| LiteLLM model alias   | `LiteLLMModel`           | Advanced mode                                               |
| Provider API key      | `ProviderApiKey`         | Advanced mode (marked NoEcho in CloudFormation)             |
| Kiro API secret       | `KiroFromSecret`         | `--kiro-from-secret <secret-id>` flag                       |
| OpenClaw gateway port | `OpenClawGatewayPort`    | Advanced mode (default: `3001`)                             |

<Note>
  `LiteLLMApiKey` and `ProviderApiKey` are `NoEcho: true` in CloudFormation — they don't appear in stack history or `describe-stacks` output. However, they do pass through UserData. For long-lived secrets, use the `--kiro-from-secret` / Secrets Manager pattern instead. See [Managing secrets with AWS Secrets Manager](/reference/secrets-manager).
</Note>

## Instance variables — per-pack runtime

Once the agent pack is installed and running, pack-specific variables are sourced from shell profiles on the instance. These are what each agent actually reads at runtime.

<Tabs>
  <Tab title="openclaw">
    ```bash theme={null}
    OPENCLAW_GATEWAY_URL=http://localhost:3001
    OPENCLAW_GATEWAY_TOKEN=<auto-generated at install time>
    AWS_DEFAULT_REGION=<from pack config>
    ```
  </Tab>

  <Tab title="claude-code">
    ```bash theme={null}
    ANTHROPIC_MODEL=us.anthropic.claude-sonnet-4-6
    ANTHROPIC_DEFAULT_HAIKU_MODEL=us.anthropic.claude-haiku-4-5-20251001-v1:0
    AWS_DEFAULT_REGION=<from pack config>
    CLAUDE_CODE_USE_BEDROCK=1
    ```
  </Tab>

  <Tab title="codex-cli">
    Codex CLI reads `~/.codex/config.toml`, which is managed by the pack. It also reads `OPENAI_API_KEY` if set at runtime. No environment variables are written by the pack itself — you authenticate by running `codex login` after connecting via SSM.
  </Tab>

  <Tab title="kiro-cli">
    ```bash theme={null}
    KIRO_API_KEY=<resolved from Secrets Manager at install time>
    ```

    The key is written to `~/.kiro/env` with `0600` permissions and sourced from `~/.bash_profile`. The raw key is never in UserData or Terraform state.
  </Tab>

  <Tab title="bedrockify-backed packs">
    Applies to `hermes`, `pi`, `ironclaw`, and `nemoclaw`. These packs route model calls through the bedrockify proxy running on port 8090:

    ```bash theme={null}
    OPENAI_API_BASE=http://localhost:8090/v1
    OPENAI_BASE_URL=http://localhost:8090/v1
    # Pack-specific model variable, for example:
    # LLM_MODEL for ironclaw
    # HERMES_MODEL for hermes
    ```
  </Tab>
</Tabs>