Configuration

Watcher is configured in two places, and they have different jobs:

Where	What belongs there
Environment variables	Secrets and deployment settings — keys, the database, ports, origins
Watch definitions (in the database)	What to watch, how often, and how sure to be

Secrets never live in watch definitions

Every secret enters through the environment, or through the encrypted key store. No API key, token or password belongs in a watch, and none is ever returned by the API.

Environment variablesEvery variable Watcher reads, with defaults and what happens when it is missing.

Watch schemaEvery field of a watch and of a source, including collection hints.

Models and keysUse-case categories, model choice, key pools and rotation.

ChannelsDelivery channel types and per-channel routing.