Configuration (environment)

Var	Default	Meaning
`DSH_GW_RP_ID`	`ds.tokencv.com`	WebAuthn Relying Party ID — the exact public host in the address bar. Passkeys are scoped to it.
`DSH_GW_ORIGIN`	`https://`	Expected origin of WebAuthn responses.
`DSH_GW_RP_NAME`	`DeepSeek Harness`	Display name in the OS passkey picker and login page.
`DSH_GW_TARGET`	`http://127.0.0.1:3080`	The dsh web app to proxy authed traffic to.
`DSH_GW_HOST` / `DSH_GW_PORT`	`127.0.0.1` / `3090`	Where the gateway listens.
`DSH_GW_STATE_DIR`	`~/.dsh-gateway/state`	Credentials, sessions, signing secret. `dsh-approve` must be given the same value.
`DSH_GW_PUBLIC_DIR`	`
/public`	Login page assets.
`DSH_GW_USER_NAME` / `DSH_GW_USER_DISPLAY`	`herb` / `Herb`	The single account passkeys enrol under.
`DSH_GW_COOKIE_NAME`	`dsh_auth`	Session cookie name.
`DSH_SESSION_TTL_HOURS`	`24`	Cookie freshness before the passkey must be re-proven.
`DSH_BIND_SESSION_IP`	`0`	`1` refuses a cookie replayed from a different IP (off by default — roaming changes IPs).

dsh-auth-gateway