Configuration

Platform API (Container App settings)

Set by the installer; listed for completeness.

Setting	Meaning
SPRIG_TENANT_ID	Entra tenant id
SPRIG_SUBSCRIPTION_ID	Target subscription
SPRIG_API_CLIENT_ID	The sprig-platform-api app registration (token audience)
SPRIG_API_CLIENT_SECRET	Key Vault-backed reference to <prefix>-platform-api-client-secret; the platform identity can read only this secret
SPRIG_STORAGE_ACCOUNT	Metadata/audit storage account
SPRIG_SOURCE_STORAGE_ACCOUNT	Dedicated source-retention storage account (per-app containers of published source archives)
SPRIG_APPS_DOMAIN	Optional apps domain used to return canonical published app URLs; omitted until public app DNS is configured
SPRIG_LOCATION	Region for created resources
SPRIG_PREFIX	Resource name prefix (default sprig)
AZURE_CLIENT_ID	The control-plane writer managed identity

Gateway (Container App settings)

Set by the installer/deployer; listed for completeness (gateway/src/Gateway/appsettings.json).

Setting	Meaning
Gateway:AppsDomain	The apps domain every published app is a subdomain of
Gateway:ReleaseVersion	The installed signed release version shown in the admin console
Gateway:ReleaseImage	The exact digest-pinned gateway image shown in the admin console
Gateway:Mcp:ResourceUrl	The gateway’s own MCP URL - must match the sprig-gateway Application ID URI byte-exact
Gateway:Mcp:FunctionAppBaseUrl	Where control tools delegate to
Gateway:Auth:TenantId / ClientId / ClientSecret	The gateway’s own OIDC app registration, for browser sign-in
Gateway:Dab:InternalUrl	Where the data proxy forwards to
Gateway:Data:BuildClientAppIds	The connector/CLI client ids that mark a request as build mode
AZURE_CLIENT_ID	The bundle-read-only serving managed identity

Shared data service (DAB Container App settings)

Set by the installer/deployer; listed for completeness.

Setting	Meaning
AZURE_CLIENT_ID	The bundle-read-only serving managed identity
SPRIG_STORAGE_ACCOUNT	Storage account containing the versioned DAB configuration
DAB_CONFIG_VERSION	Immutable configuration revision to load
DAB_OBO_CLIENT_ID / DAB_OBO_TENANT_ID / DAB_OBO_CLIENT_SECRET	On-behalf-of credentials used to query an authorized source as the signed-in caller; the serving identity can read only <prefix>-obo-client-secret

Builder machines

There’s nothing to configure. claude.ai holds your session in its own OAuth token store: no local file, no secret on your machine. Claude Code caches its own MCP session after claude mcp login sprig; that’s Claude Code’s own credential store, not a sprig-specific config file. See Builder setup for the one-time connection steps.