{"templateId":"markdown","versions":[{"version":"v1.43","label":"v1.43 LTS","link":"/products/custody/developer-experience/sdks/configuration","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.42","label":"v1.42 STS","link":"/products/custody/v1.42/developer-experience/sdks/configuration","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.41","label":"v1.41 STS","link":"/products/custody/v1.41/developer-experience/sdks/configuration","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/developer-experience/sdks/configuration","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/developer-experience/sdks/configuration","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/developer-experience/sdks/configuration","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/developer-experience/sdks/configuration","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["tabs","tab"]},"type":"markdown"},"seo":{"title":"Configure the SDK","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"configure-the-sdk","__idx":0},"children":["Configure the SDK"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each ","Ripple Custody"," SDK reads its settings from a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," file, from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_*"]}," environment variables, or from values you set in code. This page describes where each SDK looks, which keys and variables it recognizes, and how to configure TLS. For a minimal working setup, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/get-started/integrate-via-sdk"},"children":["Integrate via SDK"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configuration-sources-and-precedence","__idx":1},"children":["Configuration sources and precedence"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In all three SDKs, an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_*"]}," environment variable overrides the matching key in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]},", and a key in the file overrides the built-in default. This order lets you keep non-secret settings in a file and supply secrets and per-environment values through the environment."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":""},"children":[]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"TypeScript"},"children":["TypeScript"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Java"},"children":["Java"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Python"},"children":["Python"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Load from file and environment"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loadConfiguration()"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loadConfiguration(path)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyClientConfig.loadConfiguration()"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loadConfiguration(Path)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["load_configuration()"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["load_configuration(config_file)"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Load from environment only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loadConfiguration()"]}," with no file present"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyClientConfig.fromEnvironment()"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["load_configuration()"]}," with no file present"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Configure in code"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["generateNewConfiguration()"]}," and a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Configuration"]}," object"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ApiClient.newBuilder()"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyClientConfig"]}," setters"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Configuration(...)"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuration-file-location","__idx":2},"children":["Configuration file location"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All three SDKs search for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," in the following order and use the first file that exists:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The path you pass to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loadConfiguration"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["load_configuration"]}," in Python)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The path in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CONFIG_FILE"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["./config.toml"]}," in the working directory."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["~/.config/ripple-custody/config.toml"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If an SDK finds no file, it continues with environment variables only. It fails only when a required setting is missing from every source. In Java, a named file replaces the default locations: the SDK doesn't search them."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuration-file-format","__idx":3},"children":["Configuration file format"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All keys are top-level ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["key = value"]}," pairs. The SDKs share one set of key names, so the same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," file works in each language. To get a key name, drop the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_"]}," prefix from the environment variable and lowercase the rest, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_API_BASE_URL"]}," becomes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api_base_url"]},". The following keys keep the prefix: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_user_id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_domain_id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_validate_addresses"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_verify_derived_addresses"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_enforce_immutable_endpoints"]},"."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Unknown keys."]}," All three SDKs reject a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," file with keys that they don't recognize. The error names the key and, for a renamed key, the name to use instead."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Secrets."]}," Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CLIENT_SECRET"]}," as an environment variable. It has no configuration file key, and the Java SDK rejects ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," in the file."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TOML support."]}," The Java SDK parses a subset of TOML: strings, booleans, and numbers. It doesn't accept arrays or multi-line strings. To put a PEM certificate in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ca_cert_data"]},", write it as one string with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["\\n"]}," escapes."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"environment-variable-and-key-reference","__idx":4},"children":["Environment variable and key reference"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following tables list the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_*"]}," environment variables by area, with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," key for each. \"Environment only\" means the setting has no configuration file key."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"connection-and-authentication","__idx":5},"children":["Connection and authentication"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variable"},"children":["Variable"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"config.toml key"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CONFIG_FILE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Environment only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Path to the configuration file."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_API_BASE_URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api_base_url"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Base URL of the ","Ripple Custody"," API. Required."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_OIDC_ISSUER_URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oidc_issuer_url"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenID Connect (OIDC) issuer URL. The SDK discovers the token endpoint from the issuer's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/.well-known/openid-configuration"]}," document."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_TOKEN_ENDPOINT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token_endpoint"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OAuth token endpoint URL. Takes precedence over discovery."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CLIENT_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OAuth client ID for the client-credentials grant."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CLIENT_SECRET"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Environment only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OAuth client secret for the client-credentials grant. TypeScript also accepts ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," in the file and logs a warning."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each SDK finds the token endpoint from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_TOKEN_ENDPOINT"]}," or, through discovery, from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_OIDC_ISSUER_URL"]},". Set one of them."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each SDK chooses the OAuth grant from the credentials you set. When ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CLIENT_ID"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CLIENT_SECRET"]}," are both set and not empty, the SDK uses the client-credentials grant. Otherwise, it uses the signed-challenge grant, with the client ID ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customer_api"]},". Setting a client secret without a client ID is an error. In TypeScript and Python, a client ID without a secret is also an error, so don't set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," for the signed-challenge grant."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For details about both grants, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/developer-experience/sdks/authentication-and-signing"},"children":["Authentication and signing"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"signing-and-identity","__idx":6},"children":["Signing and identity"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variable"},"children":["Variable"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"config.toml key"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_PRIVATE_KEY_FILE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["private_key_file"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Path to a PEM private key (P-256, secp256k1, or Ed25519). The SDK uses it to sign the login challenge and intents."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_KMS_PROVIDER"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kms_provider"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Sign with a key management service (KMS) instead of a key file: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hashicorp"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["aws"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["azure"]},". The Java SDK has no built-in KMS signer. Use the Java examples instead, as described in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#kms-provider-variables"},"children":["KMS provider variables"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_USER_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_user_id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your user ID. The SDK uses it as the author of intents."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_DOMAIN_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_domain_id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your domain ID. The SDK uses it as the author's domain and the default target domain."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Set either a private key file or a KMS provider, not both. All three SDKs reject a configuration that sets both."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All three SDKs look up your user through the API when you don't set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_USER_ID"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_DOMAIN_ID"]},". If you belong to several domains, set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_DOMAIN_ID"]}," to choose one. Otherwise, the lookup fails."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"verification-and-safety-checks","__idx":7},"children":["Verification and safety checks"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variable"},"children":["Variable"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"config.toml key"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_NOTARY_API_PUBLIC_KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["notary_api_public_key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Notary API public key, base64-encoded DER. Required while response verification is on."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_VERIFY_RESPONSES"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["verify_responses"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify the signature on API responses. Default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_VALIDATE_ADDRESSES"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_validate_addresses"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check destination address formats before submitting an intent. Default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_VERIFY_DERIVED_ADDRESSES"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_verify_derived_addresses"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Re-derive generated unspent transaction output (UTXO) account addresses from the account's extended public key and compare them with the server's. Default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_ENFORCE_IMMUTABLE_ENDPOINTS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rc_enforce_immutable_endpoints"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},": the SDK refuses an endpoint update that changes its address, ledger, or parameters. Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}," to log a warning and submit the update instead."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For more information about the endpoint check, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/accounts-and-assets/endpoints/manage-endpoints#sdk-endpoint-immutability-check"},"children":["SDK endpoint immutability check"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each SDK pins one notary API public key. When the notary key rotates, replace the key and restart the client, as described in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/operations-and-maintenance/security-maintenance/notary-key-rotation-and-migration#update-the-notary-key-pinned-in-sdk-clients"},"children":["Notary key rotation and migration"]},". For how verification works, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/developer-experience/sdks/response-verification"},"children":["Response verification"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In TypeScript, the derived-address check runs only when you pass your own address-derivation function to the address methods. The Java SDK accepts the setting but doesn't perform the check yet."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"tls","__idx":8},"children":["TLS"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variable"},"children":["Variable"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"config.toml key"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_VERIFY_SSL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["verify_ssl"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify the server's TLS certificate. Default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_TLS_MIN_VERSION"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tls_min_version"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Minimum TLS version: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TLSv1_2"]}," (default) or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TLSv1_3"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_SSL_CA_CERT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ssl_ca_cert"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Path to a PEM CA bundle to trust instead of the system trust store."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CA_CERT_DATA"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ca_cert_data"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CA bundle content, as an alternative to a file."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CERT_FILE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cert_file"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client certificate (PEM) for mutual TLS."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_KEY_FILE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["key_file"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client private key (PEM) for mutual TLS."]}]}]}]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Certificate verification."]}," Turn it off only for local development. All three SDKs log a warning when it's off."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Minimum version."]}," TLS 1.2 is the minimum in all three SDKs."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Custom CA."]}," In TypeScript and Python, set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_SSL_CA_CERT"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CA_CERT_DATA"]},", not both. The Java SDK accepts both together."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mutual TLS."]}," Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_CERT_FILE"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_KEY_FILE"]}," together. All three SDKs reject a configuration that sets only one."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Custom HTTP client."]}," If you supply your own HTTP client or transport, your client handles TLS, and these settings don't apply. For more information, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/developer-experience/sdks/errors-and-http"},"children":["Errors and HTTP behavior"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"other-settings","__idx":9},"children":["Other settings"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variable"},"children":["Variable"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"config.toml key"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["config.toml"]}," key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_USER_AGENT_SUFFIX"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user_agent_suffix"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Text appended to the SDK's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User-Agent"]}," header, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["my-app/1.0"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_LOG_LEVEL_NPM"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Environment only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TypeScript only. SDK log level: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["warn"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["info"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["http"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["verbose"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["debug"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["silly"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_ALLOW_INSECURE_HTTP"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Environment only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TypeScript only. Set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1"]}," to accept an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["http://"]}," API URL when the host isn't public. For local development only."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Boolean values are ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"kms-provider-variables","__idx":10},"children":["KMS provider variables"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_KMS_PROVIDER"]},", the TypeScript and Python SDKs read the provider's settings from environment variables only. The variable names differ between the two SDKs."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Provider"},"children":["Provider"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"TypeScript"},"children":["TypeScript"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Python"},"children":["Python"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hashicorp"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_ADDR"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_TOKEN"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_TRANSIT_KEY_NAME"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_NAMESPACE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_ADDR"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_TOKEN"]}," (or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_ROLE_ID"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_SECRET_ID"]},"), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_TRANSIT_KEY_NAME"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_TRANSIT_MOUNT_POINT"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_NAMESPACE"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["aws"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_KMS_KEY_ID"]}," (or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KMS_KEY_ID"]},"), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AWS_REGION"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AWS_KMS_KEY_ID"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AWS_REGION"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AWS_PROFILE"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["azure"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_VAULT_URL"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_KEY_NAME"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_KEY_VAULT_URL"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_KEY_NAME"]},", and optionally ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_USE_MANAGED_IDENTITY"]}," or the service principal variables ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_TENANT_ID"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_CLIENT_ID"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_CLIENT_SECRET"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Java SDK recognizes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_KMS_PROVIDER"]}," but has no built-in KMS signers, so it fails with an error that names the matching example. The Java examples show how to build each signer and read their own environment variables:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Provider"},"children":["Provider"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Java example"},"children":["Java example"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variables"},"children":["Variables"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hashicorp"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Example08HashiCorpVaultTransit"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_ADDR"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_TOKEN"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VAULT_TRANSIT_KEY_NAME"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["azure"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Example09AzureKeyVaultKeys"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_KEY_VAULT_URL"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_KEY_NAME"]},", and the tenant, client, and secret variables"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["aws"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Example10AwsKms"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AWS_REGION"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AWS_KMS_KEY_ID"]},", and the standard AWS credentials"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The examples aren't in the Java package. To get them, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/developer-experience/sdks#examples"},"children":["Examples"]},". For key requirements and setup, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/developer-experience/sdks/authentication-and-signing"},"children":["Authentication and signing"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/developer-experience/sdks/hashicorp-vault"},"children":["HashiCorp Vault"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configure-in-code","__idx":11},"children":["Configure in code"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can build the configuration in code instead of loading it, for example when your application reads settings from its own secret store. The following examples sign with a local private key and set the same values as the quickstart configuration:"]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"TypeScript","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"import { readFileSync } from 'node:fs';\nimport {\n  type Configuration,\n  CustodyClient,\n  generateNewConfiguration,\n  makeSoftwareSigner,\n} from '@ripple/ripple-custody-client-lib-typescript';\n\nconst apiBaseUrl = 'https://<api-host>';\nconst oidcIssuerUrl = 'https://<auth-host>/realms/<realm>';\nconst notaryApiPublicKey = '<notary-api-public-key>';\nconst signer = makeSoftwareSigner(readFileSync('/path/to/signing-key.pem', 'utf-8'));\n\nconst config: Configuration = {\n  apiBaseUrl,\n  oidcIssuerUrl,\n  readPublicKey: signer.readPublicKey,\n  signString: signer.signString,\n  rcDomainId: '<your-domain-id>',\n  rcValidateAddresses: true,\n  rcVerifyDerivedAddresses: true,\n  rcEnforceImmutableEndpoints: true,\n  verifyResponses: true,\n  notaryApiPublicKey,\n  _sdkConfig: generateNewConfiguration({\n    apiBaseUrl,\n    oidcIssuerUrl,\n    readPublicKey: signer.readPublicKey,\n    signString: signer.signString,\n    notaryApiPublicKey,\n    // TLS options: verifySsl, tlsMinVersion, sslCaCert, caCertData, certFile, keyFile\n  }),\n};\n\nconst client = new CustodyClient(config);\n","lang":"typescript"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["generateNewConfiguration"]}," builds the HTTP and authentication layer. The outer object holds the settings that the client's methods use. Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["verifyResponses"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["notaryApiPublicKey"]}," to the same values in both."]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Java","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"java","header":{"controls":{"copy":{}}},"source":"import com.ripple.custody.CustodyClient;\nimport com.ripple.custody.CustodyClientConfig;\nimport com.ripple.custody.auth.ChallengeSigner;\nimport com.ripple.custody.auth.SoftwarePemSigner;\nimport com.ripple.custody.invoker.ApiClient;\nimport com.ripple.custody.models.CoreUserReference;\nimport java.nio.file.Files;\nimport java.nio.file.Path;\nimport java.util.UUID;\n\nChallengeSigner signer =\n    SoftwarePemSigner.fromPem(Files.readString(Path.of(\"/path/to/signing-key.pem\")));\n\nApiClient apiClient = ApiClient.newBuilder()\n    .tokenEndpoint(\"<token-endpoint-url>\")\n    .clientId(\"customer_api\")\n    .grantType(\"password\")\n    .signer(signer)\n    // TLS options: .verifySsl(...), .sslCaCert(...), .caCertData(...), .certFile(...), .keyFile(...)\n    .build();\napiClient.setBasePath(\"https://<api-host>\");\n\nUUID domainId = UUID.fromString(\"<your-domain-id>\");\nUUID userId = UUID.fromString(\"<your-user-id>\");\n\nCustodyClientConfig config = new CustodyClientConfig()\n    .apiClient(apiClient)\n    .signer(signer::signChallenge)\n    .author(new CoreUserReference().id(userId).domainId(domainId))\n    .defaultDomainId(domainId)\n    .notaryApiPublicKey(\"<notary-api-public-key>\");\n\nCustodyClient client = new CustodyClient(config);\n","lang":"java"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The same key signs the login challenge (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ApiClient"]},") and intents (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyClientConfig.signer"]},")."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can also combine the two approaches: load a configuration with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyClientConfig.loadConfiguration()"]},", adjust it with the setters, such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["notaryApiPublicKey(...)"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["defaultDomainId(...)"]},", and then call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyClient.fromConfig(config)"]},"."]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Python","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"python","header":{"controls":{"copy":{}}},"source":"from ripple_custody_client_lib_python import Configuration, CustodyClient\n\nconfig = Configuration(\n    host=\"https://<api-host>\",\n    oidc_issuer_url=\"https://<auth-host>/realms/<realm>\",\n    rc_user_id=\"<your-user-id>\",\n    rc_domain_id=\"<your-domain-id>\",\n    notary_api_public_key=\"<notary-api-public-key>\",\n    # TLS options: verify_ssl, tls_min_version, ssl_ca_cert, ca_cert_data, cert_file, key_file\n)\nconfig.sign_string = sign            # (message: str) -> base64-encoded signature\nconfig.read_public_key = public_key  # () -> base64-encoded DER public key\n\nclient = CustodyClient(config)\n","lang":"python"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["sign"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["public_key"]}," are your own functions, backed by whatever holds your key. For ready-made signers, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/developer-experience/sdks/authentication-and-signing"},"children":["Authentication and signing"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Pass ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["notary_api_public_key"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["verify_responses"]}," to the constructor. The SDK checks them together when it creates the object, so setting one afterward can fail."]}]}]}]},"headings":[{"value":"Configure the SDK","id":"configure-the-sdk","depth":1},{"value":"Configuration sources and precedence","id":"configuration-sources-and-precedence","depth":2},{"value":"Configuration file location","id":"configuration-file-location","depth":3},{"value":"Configuration file format","id":"configuration-file-format","depth":3},{"value":"Environment variable and key reference","id":"environment-variable-and-key-reference","depth":2},{"value":"Connection and authentication","id":"connection-and-authentication","depth":3},{"value":"Signing and identity","id":"signing-and-identity","depth":3},{"value":"Verification and safety checks","id":"verification-and-safety-checks","depth":3},{"value":"TLS","id":"tls","depth":3},{"value":"Other settings","id":"other-settings","depth":3},{"value":"KMS provider variables","id":"kms-provider-variables","depth":3},{"value":"Configure in code","id":"configure-in-code","depth":2}],"frontmatter":{"seo":{"title":"Configure the SDK"}},"lastModified":"2026-10-23T09:06:20.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/developer-experience/sdks/configuration","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}