Configuration

Two sources, one rule: the environment wins. A deployment that pins a root or exports a key should not be overridden by a file someone edited through a browser, and every surface that shows a resolved value also shows which of the two it came from.

Environment

variable	what it does
`LANCE_ROOT`	the database to read. Wins over any saved connection
`LANCESCOPE_CONFIG`	where the settings file lives (default `~/.config/lancescope/settings.json`)
`ANTHROPIC_API_KEY`	enables the Claude path; beats a stored key
`LANCESCOPE_LLM_PROVIDER`	`auto` · `anthropic` · `ollama` · `openai-compat` · `none` (default: auto-detect)
`OLLAMA_HOST`	as Ollama itself defines it (default `http://localhost:11434`)
`LANCESCOPE_LLM_BASE_URL`	for an OpenAI-compatible endpoint
`LANCESCOPE_LLM_API_KEY`	for an OpenAI-compatible endpoint
`LANCESCOPE_CACHE`	cached answers (default `~/.cache/lancescope`)
`LANCESCOPE_SPEND_CEILING`	dollars, per process. Refuses before spending past it
`API_ORIGIN`	where the web app proxies `/api/*`
`LANCESCOPE_NO_PLUGINS`	refuse to load third-party source adapters. Also implied by kiosk mode

Storage credentials

Read from the environment, or from a .cred file written as KEY=value lines. The environment wins, and every surface that resolves one reports which of the two it came from — never the value.

Two places are searched, first that exists winning: .cred beside the project root, which is the one a checkout edits and desktop/sign.sh reads, and .cred beside settings.json. The second is there for the packaged app, which has no project root — so a token that only exists in a checkout cannot reach a build somebody installed. LANCESCOPE_CRED_FILE names a file outright and beats both.

Give it mode 600. It holds the same class of secret as settings.json, which is written 0600, but this one is written by hand — so the server checks at startup and says so rather than assuming.

These are exported into the process environment at startup rather than passed along, because the libraries that need them read the environment and nowhere else. That is also what makes them consistent: the same variable resolves the listing and the open, so a store that lists is a store that opens.

variable	for
`HF_TOKEN`	HuggingFace, for gated or private datasets and a higher rate limit
`HUGGING_FACE_HUB_TOKEN`	the same, under the name the Hub's own tools use
`AWS_ACCESS_KEY_ID`	S3, and any S3-compatible store
`AWS_SECRET_ACCESS_KEY`	S3, and any S3-compatible store
`AWS_SESSION_TOKEN`	S3 with temporary credentials
`AWS_REGION`	S3
`AWS_DEFAULT_REGION`	S3, if `AWS_REGION` is unset
`AWS_ENDPOINT`	an S3-compatible store — MinIO, R2, B2
`AWS_PROFILE`	a named profile from the shared AWS config
`AWS_ALLOW_HTTP`	an S3-compatible store reached over plain HTTP
`GOOGLE_APPLICATION_CREDENTIALS`	Google Cloud Storage, path to a key file
`GOOGLE_SERVICE_ACCOUNT`	Google Cloud Storage, path to a service account
`AZURE_STORAGE_ACCOUNT_NAME`	Azure — required for `az://`, which carries no account name of its own
`AZURE_STORAGE_ACCOUNT_KEY`	Azure
`AZURE_STORAGE_SAS_KEY`	Azure, with a shared access signature
`AZURE_STORAGE_TOKEN`	Azure, with a bearer token
`LANCEDB_API_KEY`	LanceDB Cloud and Enterprise
`LANCEDB_REGION`	LanceDB Cloud region (default `us-east-1`)
`LANCEDB_HOST_OVERRIDE`	replaces the LanceDB endpoint entirely, for Enterprise

S3-compatible stores — MinIO, Cloudflare R2, Backblaze B2 — need no scheme of their own: point AWS_ENDPOINT at them and use s3://.

Source adapters

Which schemes this build can list. A scheme with no adapter is saved and reported as unbrowsable rather than silently listing nothing; adding one is an installable package, documented in Write a source adapter.

scheme	listed through
(none — a local path)	a bounded directory walk
`hf://`	the HuggingFace Hub API
`s3://`	Lance's object store
`gs://`	Lance's object store
`az://`	Lance's object store
`abfss://`	Lance's object store
`db://`	a Lance namespace, over REST

GET /catalog/runtime reports the same list at run time, including any adapter that failed to load and why.

The settings file

Written at mode 0600, because a stored API key would be in it. It is the only file this project writes, and it is never written inside a dataset directory.

json

{
  "version": 1,
  "connections": [
    { "id": "…", "label": "…", "uri": "/path/to/tables", "added": "…" }
  ],
  "active_id": "…",
  "intelligence": {
    "enabled": true,
    "provider": "auto",
    "model": null,
    "model_fast": null,
    "spend_ceiling_usd": null
  }
}

Where the root comes from

In order, first match wins:

LANCE_ROOT
the active saved connection
the ingest output directory, only if it holds tables
nothing — and the console says so rather than showing an empty database