diff --git a/.env.tpl b/.env.tpl
index 14dead88..d82901de 100644
--- a/.env.tpl
+++ b/.env.tpl
@@ -14,7 +14,7 @@
 EIPFS_INDEXER_SQS_ARN = 'arn:aws:sqs:us-west-2:505595374361:staging-ep-indexer-topic'
 EIPFS_INDEXER_SQS_URL = 'https://sqs.us-west-2.amazonaws.com/505595374361/staging-ep-indexer-topic'
 
-ACCESS_SERVICE_DID = ''
+PROVIDERS = ''
 UPLOAD_API_DID = ''
 ACCESS_SERVICE_URL = ''
 POSTMARK_TOKEN = ''
@@ -26,6 +26,7 @@ R2_REGION = ''
 R2_SATNAV_BUCKET_NAME = ''
 R2_SECRET_ACCESS_KEY = ''
 R2_UCAN_BUCKET_NAME = ''
+R2_DELEGATION_BUCKET_NAME = ''
 SATNAV_BUCKET_NAME = ''
 
 # Following variables are only required to run integration tests
diff --git a/README.md b/README.md
index e0f1b2ce..8714cc02 100644
--- a/README.md
+++ b/README.md
@@ -104,10 +104,6 @@ The root domain to deploy the w3up API to. e.g `up.web3.storage`. The value shou
 
 The domain to deploy the roundabout API to. e.g `roundabout.web3.storage`. The value should match a hosted zone configured in route53 that your aws account has access to.
 
-#### `ACCESS_SERVICE_DID`
-
-DID of the w3access service.
-
 #### `ACCESS_SERVICE_URL`
 
 URL of the w3access service.
@@ -140,6 +136,14 @@ Bucket name to replicate written .idx files.
 
 Bucket name to replicate root CID to car CIDs mapping.
 
+#### `R2_DELEGATION_BUCKET_NAME`
+
+Bucket name where delegations are stored.
+
+#### `PROVIDERS`
+
+A comma-separated string of ServiceDIDs in use.
+
 #### `SENTRY_DSN`
 
 Data source name for Sentry application monitoring service.
diff --git a/stacks/upload-api-stack.js b/stacks/upload-api-stack.js
index b22544e9..1f539e08 100644
--- a/stacks/upload-api-stack.js
+++ b/stacks/upload-api-stack.js
@@ -71,7 +71,6 @@ export function UploadApiStack({ stack, app }) {
           VERSION: pkg.version,
           COMMIT: git.commmit,
           STAGE: stack.stage,
-          ACCESS_SERVICE_DID: process.env.ACCESS_SERVICE_DID ?? '',
           ACCESS_SERVICE_URL: process.env.ACCESS_SERVICE_URL ?? '',
           POSTMARK_TOKEN: process.env.POSTMARK_TOKEN ?? '',
           PROVIDERS: process.env.PROVIDERS ?? '',
diff --git a/upload-api/functions/ucan-invocation-router.js b/upload-api/functions/ucan-invocation-router.js
index f7d27feb..edf72b50 100644
--- a/upload-api/functions/ucan-invocation-router.js
+++ b/upload-api/functions/ucan-invocation-router.js
@@ -23,6 +23,7 @@ import { createSubscriptionTable } from '../tables/subscription.js'
 import { createConsumerTable } from '../tables/consumer.js'
 import { createRateLimitTable } from '../tables/rate-limit.js'
 import { createSpaceMetricsTable } from '../tables/space-metrics.js'
+import { mustGetEnv } from './utils.js'
 
 Sentry.AWSLambda.init({
   environment: process.env.SST_STAGE,
@@ -80,28 +81,28 @@ const codec = Codec.inbound({
  */
 export async function ucanInvocationRouter(request) {
   const {
-    STORE_TABLE_NAME: storeTableName = '',
-    STORE_BUCKET_NAME: storeBucketName = '',
-    UPLOAD_TABLE_NAME: uploadTableName = '',
-    CONSUMER_TABLE_NAME: consumerTableName = '',
-    SUBSCRIPTION_TABLE_NAME: subscriptionTableName = '',
-    DELEGATION_TABLE_NAME: delegationTableName = '',
-    SPACE_METRICS_TABLE_NAME: spaceMetricsTableName = '',
-    RATE_LIMIT_TABLE_NAME: rateLimitTableName = '',
-    R2_ENDPOINT: r2DelegationBucketEndpoint = '',
-    R2_ACCESS_KEY_ID: r2DelegationBucketAccessKeyId = '',
-    R2_SECRET_ACCESS_KEY: r2DelegationBucketSecretAccessKey = '',
-    R2_DELEGATION_BUCKET_NAME: r2DelegationBucketName = '',
-    INVOCATION_BUCKET_NAME: invocationBucketName = '',
-    TASK_BUCKET_NAME: taskBucketName = '',
-    WORKFLOW_BUCKET_NAME: workflowBucketName = '',
-    UCAN_LOG_STREAM_NAME: streamName = '',
-    POSTMARK_TOKEN: postmarkToken = '',
-    PROVIDERS: providers = '',
+    storeTableName,
+    storeBucketName,
+    uploadTableName,
+    consumerTableName,
+    subscriptionTableName,
+    delegationTableName,
+    spaceMetricsTableName,
+    rateLimitTableName,
+    r2DelegationBucketEndpoint,
+    r2DelegationBucketAccessKeyId,
+    r2DelegationBucketSecretAccessKey,
+    r2DelegationBucketName,
+    invocationBucketName,
+    taskBucketName,
+    workflowBucketName,
+    streamName,
+    postmarkToken,
+    providers,
     // set for testing
-    DYNAMO_DB_ENDPOINT: dbEndpoint,
-    ACCESS_SERVICE_URL: accessServiceURL = '',
-  } = process.env
+    dbEndpoint,
+    accessServiceURL,
+  } = getLambdaEnv()
 
   if (request.body === undefined) {
     return {
@@ -232,3 +233,29 @@ export const fromLambdaRequest = (request) => ({
   headers: /** @type {Record<string, string>} */ (request.headers),
   body: Buffer.from(request.body || '', 'base64'),
 })
+
+function getLambdaEnv () {
+  return {
+    storeTableName: mustGetEnv('STORE_TABLE_NAME'),
+    storeBucketName: mustGetEnv('STORE_BUCKET_NAME'),
+    uploadTableName: mustGetEnv('UPLOAD_TABLE_NAME'),
+    consumerTableName: mustGetEnv('CONSUMER_TABLE_NAME'),
+    subscriptionTableName: mustGetEnv('SUBSCRIPTION_TABLE_NAME'),
+    delegationTableName: mustGetEnv('DELEGATION_TABLE_NAME'),
+    spaceMetricsTableName: mustGetEnv('SPACE_METRICS_TABLE_NAME'),
+    rateLimitTableName: mustGetEnv('RATE_LIMIT_TABLE_NAME'),
+    r2DelegationBucketEndpoint: mustGetEnv('R2_ENDPOINT'),
+    r2DelegationBucketAccessKeyId: mustGetEnv('R2_ACCESS_KEY_ID'),
+    r2DelegationBucketSecretAccessKey: mustGetEnv('R2_SECRET_ACCESS_KEY'),
+    r2DelegationBucketName: mustGetEnv('R2_DELEGATION_BUCKET_NAME'),
+    invocationBucketName: mustGetEnv('INVOCATION_BUCKET_NAME'),
+    taskBucketName: mustGetEnv('TASK_BUCKET_NAME'),
+    workflowBucketName: mustGetEnv('WORKFLOW_BUCKET_NAME'),
+    streamName: mustGetEnv('UCAN_LOG_STREAM_NAME'),
+    postmarkToken: mustGetEnv('POSTMARK_TOKEN'),
+    providers: mustGetEnv('PROVIDERS'),
+    accessServiceURL: mustGetEnv('ACCESS_SERVICE_URL'),
+    // set for testing
+    dbEndpoint: process.env.DYNAMO_DB_ENDPOINT,
+  }
+}
diff --git a/upload-api/functions/utils.js b/upload-api/functions/utils.js
new file mode 100644
index 00000000..383b92cf
--- /dev/null
+++ b/upload-api/functions/utils.js
@@ -0,0 +1,9 @@
+/**
+ * @param {string} name 
+ * @returns {string}
+ */
+export function mustGetEnv (name) {
+  const value = process.env[name]
+  if (!value) throw new Error(`Missing env var: ${name}`)
+  return value
+}