| ONBOARD_CENTRAL_HOST | No | Loopback bind host used by the packaged runtime |
| ONBOARD_CENTRAL_PORT | No | Loopback bind port used by the packaged runtime |
| ONBOARD_CENTRAL_DATA_DIR | No | Private Central data directory; --data-dir/--data-root is the equivalent CLI input |
| ONBOARD_CENTRAL_LOG_LEVEL | No | Packaged runtime log level |
| ONBOARD_CENTRAL_ALLOWED_HOSTS | No | Optional comma-separated bare Host names accepted in addition to the bind host |
| ONBOARD_CENTRAL_TLS_CERTFILE | No | Optional TLS certificate path; requires ONBOARD_CENTRAL_TLS_KEYFILE |
| ONBOARD_CENTRAL_TLS_KEYFILE | No | Optional TLS private-key path; requires ONBOARD_CENTRAL_TLS_CERTFILE Secret. |
| CENTRAL_ADMISSION | No | Central admission policy; Pursers supports invite-only admission |
| CENTRAL_AUTH_MODE | No | Central authentication mode; Pursers supports JWT authentication |
| CENTRAL_JWKS_PATH | Yes | Path to the issuer public JWKS used to verify seat credentials |
| CENTRAL_JWT_AUDIENCE | No | MCP resource URL in audience and resource claims; defaults to the loopback bind URL |
| CENTRAL_JWT_CLOCK_SKEW | No | Allowed JWT clock skew in seconds |
| CENTRAL_JWT_ISSUER | Yes | Exact issuer URL in every accepted seat credential |
| CENTRAL_PRINCIPAL_STREAM_CAP | No | Maximum concurrent event streams accepted per principal |
| CENTRAL_REAPER_INTERVAL_S | No | Interval in seconds between expired-lease reaper sweeps |
| CENTRAL_REQUEST_STATE_KEY_FILE | No | Optional restart-safe request-state keyring path Secret. |
| PURSERS_LEGACY_TOOLS | No | String flag: use 1 to expose deprecated coordination tools; use 0 to keep them hidden |
| STORE_BACKEND | No | Central storage backend; Pursers supports SQLite |