Add JWT_SIGNING_KEY setting and use it

Expose JWT_SIGNING_KEY from config.settings (read from ENV) and update src/app/container.py to import and check that setting instead of calling os.getenv directly. Remove the now-unused os import. This centralizes environment access for the JWT signing key and ensures RSA keypair generation is skipped when JWT_SIGNING_KEY is provided (and IBM auth is disabled).

Author: edwinjosechittilappilly

src/app/container.py

@@ -3,11 +3,10 @@
 Returns a dict consumed by routes (via FastAPI Depends) and the lifespan hook.
 """
 
-import os
-
 from api.connector_router import ConnectorRouter
 from config.settings import (
     INGESTION_TIMEOUT,
+    JWT_SIGNING_KEY,
     SESSION_SECRET,
     clients,
     config_manager,
@@ -47,7 +46,7 @@ async def initialize_services():
 
     # Generate JWT keys if they don't exist, a JWT signing key isn't specified,
     # and IBM auth is not enabled (IBM mode delegates all auth to Traefik)
-    if not os.getenv("JWT_SIGNING_KEY") and not IBM_AUTH_ENABLED:
+    if not JWT_SIGNING_KEY and not IBM_AUTH_ENABLED:
         generate_jwt_keys()
 
     # Initialize clients (now async to generate Langflow API key)

src/config/settings.py

@@ -57,6 +57,10 @@
 # Allow explicit key via environment; generation will be skipped if set
 LANGFLOW_KEY = os.getenv("LANGFLOW_KEY")
 SESSION_SECRET = os.getenv("SESSION_SECRET", "your-secret-key-change-in-production")
+# Optional explicit JWT signing key. When set (and IBM auth is off),
+# RSA keypair generation is skipped. Read here so callers don't poke
+# os.environ directly.
+JWT_SIGNING_KEY = os.getenv("JWT_SIGNING_KEY")
 GOOGLE_OAUTH_CLIENT_ID = os.getenv("GOOGLE_OAUTH_CLIENT_ID")
 GOOGLE_OAUTH_CLIENT_SECRET = os.getenv("GOOGLE_OAUTH_CLIENT_SECRET")