# Configuration

Understand the TOML configuration, required identity values and the boot-plan check.

Cambium reads one TOML configuration. Defaults fill many operational settings; identity, rights and workflow settings still require explicit operator choices. The boot-plan check reports the effective configuration.

## Locate the file

An explicit configuration path must exist. Without one, the platform's Cambium data directory supplies the location. Unknown keys are refused by name, so a misspelt key does not silently become a default.

Read the configuration and report the boot plan without opening the store.

```text
cambium --check --config <PATH>
```

- `--config <PATH>`: An explicit TOML configuration file. If omitted, the platform data directory supplies its location.


For a misspelt key, the refusal identifies the key:

**Unknown configuration key**

```text
unknown configuration key `store.long_wait_intervl_ms`; cambium reads only the keys in docs/CONFIG.md
```


The message names a repository path. Use the [configuration values below](/cambium/operations/configuration/#review-the-values) to look up the supported keys.

## Review the values

- `identity.oidc_issuer`: The configured sign-in issuer. It must agree with the client registered at that issuer.
- `identity.client_id`: The application client identifier issued by the sign-in provider.
- `identity.client_secret_path`: An existing private credential file. Reference it by path; do not paste its contents.
- `registry.signing_key_path`: The registry signing seed. Preserve it when restoring an existing installation.
- `store.path`: The durable store directory.
- `store.long_wait_interval_ms`: The explicitly supplied interval for reporting waits in the store.
- `door.listen`: The HTTP listening address.
- `live.listen`: The live WebSocket listening address.
- `rights.mode`: An explicit on or off. On delegates admission to Lys; off is not an alternate credential.
- `aion.url`: The workflow service address in the current configuration shape.
- `log.level`: The level of event lines emitted on standard error.


The sign-in client id and issuer must agree with the provider registration. A secret path is not the secret itself. Preserve existing registry signing material; replacing it changes the identity behind existing passes.

## Optional capabilities

Google Drive and Calendar consent has its own Google client. Voice requires a configured LiveKit deployment. A capability's absent configuration is not a reason to invent credentials or borrow the identity client's secret.

## Check before service changes

Read the entire plan and every refusal before making a service change.

Use [Command line](/cambium/reference/cli/) to inspect the released command shapes.