Rayfin

Environments and configuration

Every environment variable file, prefix, and resolution rule Rayfin tooling reads, from frontend-visible variables to interpolation in rayfin.yml.

Rayfin tooling reads and writes configuration through a small set of files and a handful of variable prefixes. This page covers the concepts you need while deploying — where each kind of value lives, what it's for, and how rayfin.yml pulls values in from the environment. For the complete, exhaustive variable-by-variable table, see Environment variables.

File locations

PathPurposeCommitted
rayfin/.envAll runtime and deployment values.No (gitignored)
rayfin/.env.exampleDocuments expected variables with placeholder values.Yes
rayfin/.deployments.jsonMulti-deployment registry (item IDs, API URLs, workspace IDs).No (gitignored)
rayfin/rayfin.ymlProject configuration, service toggles, frontend framework.Yes
.env.localFramework-specific frontend variables, auto-generated by rayfin env.No (gitignored)
~/.rayfin/auth-state.jsonCLI authentication state (tenant, account hints).N/A (user home)
~/.rayfin/token-cache.jsonEncrypted token cache (OS-backed encryption).N/A (user home)

Frontend-visible variables (RAYFIN_PUBLIC_*)

Variables prefixed RAYFIN_PUBLIC_ live in rayfin/.env and are the only variables exposed to frontend builds. rayfin up populates most of these after a deploy; rayfin env (run automatically by the scaffolded predev/prebuild scripts) maps them into a framework-specific .env.local.

VariableDescriptionPopulated by
RAYFIN_PUBLIC_API_URLRayfin backend URL, generated after rayfin up deploys to a Fabric app.rayfin up
RAYFIN_PUBLIC_PUBLISHABLE_KEYPublic key for Rayfin SDK initialization.rayfin up
RAYFIN_PUBLIC_ITEM_IDFabric app item ID. Used for Fabric brokered auth.rayfin up
RAYFIN_PUBLIC_WORKSPACE_IDFabric workspace ID. Used for Fabric brokered auth.rayfin up
RAYFIN_PUBLIC_TENANT_IDEntra ID tenant for workspace disambiguation.rayfin up
RAYFIN_PUBLIC_PORTAL_URLFabric portal base URL.rayfin up
RAYFIN_PUBLIC_SERVICE_MODErayfin (real backend) or mock (local testing).User-set
RAYFIN_PUBLIC_FRONTEND_PORTStable per-project frontend dev-server port, so the deployed backend can allow-list a deterministic origin.rayfin up

For Vite, RAYFIN_PUBLIC_API_URL becomes VITE_RAYFIN_API_URL, RAYFIN_PUBLIC_PUBLISHABLE_KEY becomes VITE_RAYFIN_PUBLISHABLE_KEY, and so on — a custom RAYFIN_PUBLIC_FOO becomes VITE_RAYFIN_FOO (Next.js: NEXT_PUBLIC_RAYFIN_FOO; plain: FOO). See Environment variables for the full per-framework mapping table, and rayfin env for the command that generates .env.local.

Tooling overrides

These configure CLI behavior and are never exposed to the frontend. Set them in rayfin/.env or as shell variables.

VariableDescriptionDefault
RAYFIN_FABRIC_API_URLFabric REST API base URL the CLI calls. Useful for routing through a credential proxy.https://api.fabric.microsoft.com/v1
RAYFIN_FABRIC_PORTAL_URLFabric portal base URL used for deep links and RAYFIN_PUBLIC_PORTAL_URL.https://app.fabric.microsoft.com/
RAYFIN_ENV_FILEPath to an alternate .env file. Equivalent to --env-file.rayfin/.env

Service configuration flags

Written to rayfin/.env based on your rayfin.yml settings, and read by the Rayfin WebService:

VariableSource (rayfin.yml)Values
Auth__Enabledservices.auth.enabledtrue / false
Data__Enabledservices.data.enabledtrue / false
Storage__Enabledservices.storage.enabledtrue / false

Shell-only variables

Read from the shell environment only — never written to a file. These are the ones you'll use most often around deployment and CI/CD:

VariableDescription
RAYFIN_TOKENPre-acquired token for headless or non-interactive usage, bypassing interactive login. Prefer rayfin login --service-principal unless a token is already available from an external source.
RAYFIN_TENANT_IDEntra ID tenant used by rayfin up. Equivalent to -t, --tenant <id> (precedence: flag > env var > signed-in tenant).
RAYFIN_ENCRYPTION_FALLBACK_ENABLEDSet to true to allow plaintext token cache on systems without OS credential storage. Development only.
RAYFIN_WORKSPACE_IDFabric workspace ID for non-interactive setup, used with RAYFIN_TOKEN.
RAYFIN_FEATURE_FLAGSComma-separated experimental feature names to enable.
RAYFIN_APPINSIGHTS_CONNECTION_STRINGOverride the telemetry endpoint for the CLI and VS Code extension.

Resolution priority

When the same variable is set in more than one place, Rayfin resolves it in this order (highest priority first):

  1. Shell environment variable.
  2. --env-file <path> CLI flag (or RAYFIN_ENV_FILE).
  3. rayfin/.env file.
  4. Default value (hardcoded, or from rayfin.yml interpolation).

Variable interpolation in rayfin.yml

rayfin.yml supports shell-style variable interpolation, so you can keep environment-specific values (connection strings, API keys, URLs) out of the checked-in config.

rayfin/rayfin.yml
services:
  data:
    host: ${DB_HOST}
    port: ${DB_PORT:-1433}
  • ${VAR} — substitutes the variable. Fails with a clear error if it is unset or empty.
  • ${VAR:-default} — substitutes the variable, or default if it is unset or empty (an empty string counts as unset).
rayfin/.env
DEFINED=value
EMPTY=
# UNDEFINED is not set
config1: ${DEFINED}             # → "value"
config2: ${EMPTY:-fallback}     # → "fallback" (empty, uses default)
config3: ${UNDEFINED:-fallback} # → "fallback" (unset, uses default)
config5: ${EMPTY}               # → Error! (empty without default)
config6: ${UNDEFINED}           # → Error! (unset without default)

When a value is entirely a variable reference, Rayfin coerces it to the matching YAML type — port: ${DB_PORT} with DB_PORT=1433 in .env becomes the number 1433, not the string "1433". Partial interpolation (http://localhost:${PORT}) always produces a string.

.env values are resolved with the same priority as everything else: shell environment first, then the .env file, then the :- default.

See Environment variable interpolation for the full syntax reference, including error handling details.

PromptMove a hard-coded value in rayfin.yml into .env
In my Rayfin project's rayfin/rayfin.yml, replace the hard-coded connection string under services.data with a ${DB_CONNECTION_STRING} interpolation. Add DB_CONNECTION_STRING to rayfin/.env with the current value, and add rayfin/.env to .gitignore if it isn't already there. Confirm rayfin.yml still resolves correctly by running `npx rayfin up -n` (dry run).
Something wrong on this page?Report an issueEdit this page

On this page