| GOOGLE_CLIENT_ID | Yes | Google OAuth client ID (required for OAuth authentication modes) |
| GOOGLE_CLIENT_SECRET | No | Google OAuth client secret (optional for public clients) Secret. |
| GOOGLE_SERVICE_ACCOUNT_KEY_FILE | No | Path to service account JSON key file (required for service-account auth mode) |
| AUTH_MODE | No | Authentication mode |
| HEADLESS | No | Disable browser auto-open, return auth URL instead (true/false) |
| REDIRECT_URI | No | OAuth redirect URI (optional, default: ephemeral loopback) |
| RESOURCE_STORE_URI | No | Resource store URI for exported files (file://) |
| PORT | No | HTTP server port (overrides --port) |
| BASE_URL | No | Base URL for HTTP transport (used for OAuth/DCR endpoints and file links) |
| LOG_LEVEL | No | Logging level |
| GOOGLE_CLIENT_ID | Yes | Google OAuth client ID (required for OAuth authentication modes) |
| GOOGLE_CLIENT_SECRET | No | Google OAuth client secret (optional for public clients) Secret. |
| GOOGLE_SERVICE_ACCOUNT_KEY_FILE | No | Path to service account JSON key file (required for service-account auth mode) |
| AUTH_MODE | No | Authentication mode |
| HEADLESS | No | Disable browser auto-open, return auth URL instead (true/false) |
| REDIRECT_URI | No | OAuth redirect URI (optional, default: ephemeral loopback) |
| DCR_MODE | No | Dynamic Client Registration mode |
| DCR_VERIFY_URL | No | External verification endpoint URL (required for external DCR mode) |
| DCR_STORE_URI | No | DCR client storage URI (for self-hosted DCR mode) |
| RESOURCE_STORE_URI | No | Resource store URI for exported files (file://) |
| PORT | No | HTTP server port (overrides --port) |
| BASE_URL | No | Base URL for HTTP transport (used for OAuth/DCR endpoints and file links) |
| LOG_LEVEL | No | Logging level |