Your tenant's pod URL, e.g. https://pod104.myconnectsecure.com (Profile > API Documentation in the portal). Each tenant has its own pod; there is no working default.
CONNECTSECURE_TENANT
Yes
Tenant name you type on the ConnectSecure portal login screen.
CONNECTSECURE_CLIENT_ID
Yes
API client ID from Settings > Users > (user) > API Key. Secret.
CONNECTSECURE_CLIENT_SECRET
Yes
API client secret from Settings > Users > (user) > API Key. Secret.
CONNECTSECURE_ACCESS_TOKEN
No
Optional. A pre-minted JWT from /w/authorize; while it is unexpired it is used instead of minting one. The tenant, client ID and secret are still needed so the CLI can mint a fresh token once it expires. Secret.
CONNECTSECURE_USER_ID
No
Optional user_id from /w/authorize. Only needed with a pre-minted access token; minting fills it automatically.
CONNECTSECURE_MCP_READ_ONLY
No
Set to 1 to make the MCP server refuse every write and hide the sync, export and tail tools (import is never an MCP tool). Credential reads are still answered.
CONNECTSECURE_USER_AGENT
No
Overrides the User-Agent the CLI sends on ConnectSecure requests.
CONNECTSECURE_MCP_HTTP_TOKEN
No
Required only when running the MCP server with --transport http. Not needed for the default local stdio transport. Secret.
PRINTING_PRESS_CLIENT_PROFILE
No
Optional: binds the MCP server to a tenant-gated Printing Press client profile. This connector registers none; leave unset. Secret.
