diff --git a/.github/workflows/backend_tests.yml b/.github/workflows/backend_tests.yml
index f1d9a1c71..cc11adb63 100644
--- a/.github/workflows/backend_tests.yml
+++ b/.github/workflows/backend_tests.yml
@@ -78,12 +78,12 @@ jobs:
           - { python: "3.11", os: "ubuntu-latest", session: "docs-build" }
 
     env:
-      NOXSESSION: ${{ matrix.session }}
-      SPIFF_DATABASE_TYPE: ${{ matrix.database }}
-      FORCE_COLOR: "1"
-      PRE_COMMIT_COLOR: "always"
-      DB_PASSWORD: password
       FLASK_SESSION_SECRET_KEY: super_secret_key
+      FORCE_COLOR: "1"
+      NOXSESSION: ${{ matrix.session }}
+      PRE_COMMIT_COLOR: "always"
+      SPIFFWORKFLOW_BACKEND_DATABASE_PASSWORD: password
+      SPIFFWORKFLOW_BACKEND_DATABASE_TYPE: ${{ matrix.database }}
 
     steps:
       - name: Check out the repository
diff --git a/docker-compose.yml b/docker-compose.yml
index 31e348b51..95b87b393 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,9 +7,9 @@ services:
         condition: service_healthy
     environment:
       APPLICATION_ROOT: "/"
-      PORT0: "${SPIFF_FRONTEND_PORT:-8001}"
+      PORT0: "${SPIFFWORKFLOW_FRONTEND_PORT:-8001}"
     ports:
-      - "${SPIFF_FRONTEND_PORT:-8001}:${SPIFF_FRONTEND_PORT:-8001}/tcp"
+      - "${SPIFFWORKFLOW_FRONTEND_PORT:-8001}:${SPIFFWORKFLOW_FRONTEND_PORT:-8001}/tcp"
 
   spiffworkflow-backend:
     container_name: spiffworkflow-backend
@@ -18,24 +18,25 @@ services:
       spiffworkflow-db:
         condition: service_healthy
     environment:
-      APPLICATION_ROOT: "/"
+      SPIFFWORKFLOW_BACKEND_APPLICATION_ROOT: "/"
       SPIFFWORKFLOW_BACKEND_ENV: "local_development"
       FLASK_DEBUG: "0"
       FLASK_SESSION_SECRET_KEY: "${FLASK_SESSION_SECRET_KEY:-super_secret_key}"
-      OPEN_ID_SERVER_URL: "http://localhost:${SPIFF_BACKEND_PORT:-8000}/openid"
-      SPIFFWORKFLOW_FRONTEND_URL: "http://localhost:${SPIFF_FRONTEND_PORT:-8001}"
       # WARNING: Frontend is a static site which assumes frontend port - 1 on localhost.
       SPIFFWORKFLOW_BACKEND_URL: "http://localhost:${SPIFF_BACKEND_PORT:-8000}"
-      SPIFFWORKFLOW_BACKEND_PORT: "${SPIFF_BACKEND_PORT:-8000}"
-      SPIFFWORKFLOW_BACKEND_UPGRADE_DB: "true"
+
+      SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR: "/app/process_models"
+      SPIFFWORKFLOW_BACKEND_CONNECTOR_PROXY_URL: "http://spiffworkflow-connector:8004"
       SPIFFWORKFLOW_BACKEND_DATABASE_URI: "mysql+mysqlconnector://root:${SPIFF_MYSQL_PASS:-my-secret-pw}@spiffworkflow-db:${SPIFF_MYSQL_PORT:-8003}/spiffworkflow_backend_development"
-      BPMN_SPEC_ABSOLUTE_DIR: "/app/process_models"
       SPIFFWORKFLOW_BACKEND_LOAD_FIXTURE_DATA: "false"
+      SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_ID: "spiffworkflow-backend"
+      SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_SECRET_KEY: "my_open_id_secret_key"
+      SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL: "http://localhost:${SPIFF_BACKEND_PORT:-8000}/openid"
       SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME: "example.yml"
-      RUN_BACKGROUND_SCHEDULER: "true"
-      OPEN_ID_CLIENT_ID: "spiffworkflow-backend"
-      OPEN_ID_CLIENT_SECRET_KEY: "my_open_id_secret_key"
-      CONNECTOR_PROXY_URL: "http://spiffworkflow-connector:8004"
+      SPIFFWORKFLOW_BACKEND_PORT: "${SPIFF_BACKEND_PORT:-8000}"
+      SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER: "true"
+      SPIFFWORKFLOW_BACKEND_UPGRADE_DB: "true"
+      SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND: "http://localhost:${SPIFFWORKFLOW_FRONTEND_PORT:-8001}"
     ports:
       - "${SPIFF_BACKEND_PORT:-8000}:${SPIFF_BACKEND_PORT:-8000}/tcp"
     volumes:
diff --git a/spiffworkflow-backend/bin/boot_server_in_docker b/spiffworkflow-backend/bin/boot_server_in_docker
index c0b233a8f..2976e27d8 100755
--- a/spiffworkflow-backend/bin/boot_server_in_docker
+++ b/spiffworkflow-backend/bin/boot_server_in_docker
@@ -10,12 +10,12 @@ set -o errtrace -o errexit -o nounset -o pipefail
 # run migrations
 export FLASK_APP=/app/src/spiffworkflow_backend
 
-if [[ "${WAIT_FOR_DB_TO_BE_READY:-}" == "true" ]]; then
+if [[ "${SPIFFWORKFLOW_BACKEND_WAIT_FOR_DB_TO_BE_READY:-}" == "true" ]]; then
   echo 'Waiting for db to be ready...'
   poetry run python ./bin/wait_for_db_to_be_ready.py
 fi
 
-if [[ "${DOWNGRADE_DB:-}" == "true" ]]; then
+if [[ "${SPIFFWORKFLOW_BACKEND_DOWNGRADE_DB:-}" == "true" ]]; then
   echo 'Downgrading database...'
   poetry run flask db downgrade
 fi
@@ -40,8 +40,8 @@ fi
 
 additional_args=""
 
-if [[ "${APPLICATION_ROOT:-}" != "/" ]]; then
-  additional_args="${additional_args} -e SCRIPT_NAME=${APPLICATION_ROOT}"
+if [[ "${SPIFFWORKFLOW_BACKEND_APPLICATION_ROOT:-}" != "/" ]]; then
+  additional_args="${additional_args} -e SCRIPT_NAME=${SPIFFWORKFLOW_BACKEND_APPLICATION_ROOT}"
 fi
 
 # HACK: if loading fixtures for acceptance tests when we do not need multiple workers
@@ -56,8 +56,8 @@ if [[ "${SPIFFWORKFLOW_BACKEND_RUN_DATA_SETUP:-}" != "false" ]]; then
 fi
 
 # Assure that the the Process Models Directory is initialized as a git repo
-git init "${BPMN_SPEC_ABSOLUTE_DIR}"
-git config --global --add safe.directory "${BPMN_SPEC_ABSOLUTE_DIR}"
+git init "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR}"
+git config --global --add safe.directory "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR}"
 
 export IS_GUNICORN="true"
 # THIS MUST BE THE LAST COMMAND!
diff --git a/spiffworkflow-backend/bin/build_and_run_with_docker_compose b/spiffworkflow-backend/bin/build_and_run_with_docker_compose
index c986e3941..58fd61f04 100755
--- a/spiffworkflow-backend/bin/build_and_run_with_docker_compose
+++ b/spiffworkflow-backend/bin/build_and_run_with_docker_compose
@@ -7,8 +7,8 @@ function error_handler() {
 trap 'error_handler ${LINENO} $?' ERR
 set -o errtrace -o errexit -o nounset -o pipefail
 
-BPMN_SPEC_ABSOLUTE_DIR=$(./bin/find_sample_process_models)
-export BPMN_SPEC_ABSOLUTE_DIR
+SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR=$(./bin/find_sample_process_models)
+export SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR
 
 if [[ -z "${SPIFFWORKFLOW_BACKEND_DOCKER_COMPOSE_PROFILE:-}" ]]; then
   export SPIFFWORKFLOW_BACKEND_DOCKER_COMPOSE_PROFILE=run
diff --git a/spiffworkflow-backend/bin/deploy b/spiffworkflow-backend/bin/deploy
index 466bb6d14..ebfd9a553 100755
--- a/spiffworkflow-backend/bin/deploy
+++ b/spiffworkflow-backend/bin/deploy
@@ -31,16 +31,16 @@ if [[ -z "${SPIFFWORKFLOW_BACKEND_DOCKER_COMPOSE_PROFILE:-}" ]]; then
   export SPIFFWORKFLOW_BACKEND_DOCKER_COMPOSE_PROFILE=run
 fi
 
-if [[ -z "${SPIFFWORKFLOW_FRONTEND_URL:-}" ]]; then
-  export SPIFFWORKFLOW_FRONTEND_URL='http://167.172.242.138:7001'
+if [[ -z "${SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND:-}" ]]; then
+  export SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND='http://167.172.242.138:7001'
 fi
 
 if [[ -z "${SPIFFWORKFLOW_BACKEND_URL:-}" ]]; then
   export SPIFFWORKFLOW_BACKEND_URL='http://167.172.242.138:7000'
 fi
 
-if [[ -z "${OPEN_ID_SERVER_URL:-}" ]]; then
-  export OPEN_ID_SERVER_URL='http://167.172.242.138:7002'
+if [[ -z "${SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL:-}" ]]; then
+  export SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL='http://167.172.242.138:7002'
 fi
 
 git pull
diff --git a/spiffworkflow-backend/bin/find_sample_process_models b/spiffworkflow-backend/bin/find_sample_process_models
index 525996399..ead42ca0b 100755
--- a/spiffworkflow-backend/bin/find_sample_process_models
+++ b/spiffworkflow-backend/bin/find_sample_process_models
@@ -7,19 +7,19 @@ function error_handler() {
 trap 'error_handler ${LINENO} $?' ERR
 set -o errtrace -o errexit -o nounset -o pipefail
 
-if [[ -z "${BPMN_SPEC_ABSOLUTE_DIR:-}" ]]; then
+if [[ -z "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-}" ]]; then
   script_dir="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 
-  BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../../sample-process-models"
-  if [[ ! -d "$BPMN_SPEC_ABSOLUTE_DIR" ]]; then
-    BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../sample-process-models"
-    if [[ ! -d "$BPMN_SPEC_ABSOLUTE_DIR" ]]; then
-      >&2 echo "ERROR: Could not find a location for the sample processes. Last tried: $BPMN_SPEC_ABSOLUTE_DIR"
+  SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../../sample-process-models"
+  if [[ ! -d "$SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR" ]]; then
+    SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../sample-process-models"
+    if [[ ! -d "$SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR" ]]; then
+      >&2 echo "ERROR: Could not find a location for the sample processes. Last tried: $SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
       exit 1
     fi
   fi
 
-  pushd "$BPMN_SPEC_ABSOLUTE_DIR" >/dev/null 2>&1
+  pushd "$SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR" >/dev/null 2>&1
   if [[ "$(git rev-parse --abbrev-ref HEAD)" == "main" ]]; then
     >&2 echo "ERROR: please do not use the main branch of sample-process-models. use dev"
     exit 1
@@ -27,4 +27,4 @@ if [[ -z "${BPMN_SPEC_ABSOLUTE_DIR:-}" ]]; then
   popd >/dev/null 2>&1
 fi
 
-realpath "$BPMN_SPEC_ABSOLUTE_DIR"
+realpath "$SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
diff --git a/spiffworkflow-backend/bin/get_bpmn_json_for_process_instance b/spiffworkflow-backend/bin/get_bpmn_json_for_process_instance
index 3cfedccc1..d4e3d8ed0 100644
--- a/spiffworkflow-backend/bin/get_bpmn_json_for_process_instance
+++ b/spiffworkflow-backend/bin/get_bpmn_json_for_process_instance
@@ -9,8 +9,8 @@ from spiffworkflow_backend.models.process_instance import ProcessInstanceModel
 def main(process_instance_id: str):
     """Main."""
     os.environ["SPIFFWORKFLOW_BACKEND_ENV"] = "local_development"
-    if os.environ.get("BPMN_SPEC_ABSOLUTE_DIR") is None:
-      os.environ["BPMN_SPEC_ABSOLUTE_DIR"] = "hey"
+    if os.environ.get("SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR") is None:
+      os.environ["SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"] = "hey"
     flask_env_key = "FLASK_SESSION_SECRET_KEY"
     os.environ[flask_env_key] = "whatevs"
     app = create_app()
diff --git a/spiffworkflow-backend/bin/git_commit_bpmn_models_repo b/spiffworkflow-backend/bin/git_commit_bpmn_models_repo
index 3a2e01504..b475427a7 100755
--- a/spiffworkflow-backend/bin/git_commit_bpmn_models_repo
+++ b/spiffworkflow-backend/bin/git_commit_bpmn_models_repo
@@ -21,8 +21,8 @@ if [[ -z "${5:-}" ]]; then
   exit 1
 fi
 
-if [[ -z "$git_commit_password" && -z "${GIT_SSH_PRIVATE_KEY:-}" ]]; then
-  >&2 echo "ERROR: A git password or GIT_SSH_PRIVATE_KEY must be provided"
+if [[ -z "$git_commit_password" && -z "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY:-}" ]]; then
+  >&2 echo "ERROR: A git password or SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY must be provided"
   exit 1
 fi
 
@@ -43,10 +43,10 @@ function run() {
     git config --local user.name "$git_commit_username"
     git config --local user.email "$git_commit_email"
 
-    if [[ -n "${GIT_SSH_PRIVATE_KEY:-}" ]]; then
+    if [[ -n "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY:-}" ]]; then
       tmpfile=$(mktemp /tmp/tmp_git.XXXXXX)
       chmod 600 "$tmpfile"
-      echo "$GIT_SSH_PRIVATE_KEY" >"$tmpfile"
+      echo "$SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY" >"$tmpfile"
       export GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${tmpfile} -F /dev/null"
     else
       PAT="${git_commit_username}:${git_commit_password}"
@@ -57,7 +57,7 @@ function run() {
     git commit -m "$git_commit_message"
     git push --set-upstream origin "$git_branch"
 
-    if [[ -z "${GIT_SSH_PRIVATE_KEY:-}" ]]; then
+    if [[ -z "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY:-}" ]]; then
       git config --unset --local http.extraHeader
     fi
   fi
diff --git a/spiffworkflow-backend/bin/recreate_db b/spiffworkflow-backend/bin/recreate_db
index 8a4e4b5a9..8a78a9b8c 100755
--- a/spiffworkflow-backend/bin/recreate_db
+++ b/spiffworkflow-backend/bin/recreate_db
@@ -9,18 +9,18 @@ set -o errtrace -o errexit -o nounset -o pipefail
 
 export FLASK_SESSION_SECRET_KEY="this_is_recreate_db_secret_key"
 
-if [[ -z "${BPMN_SPEC_ABSOLUTE_DIR:-}" ]]; then
+if [[ -z "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-}" ]]; then
   script_dir="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 
-  BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../../sample-process-models"
-  if [[ ! -d "$BPMN_SPEC_ABSOLUTE_DIR" ]]; then
-    BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../sample-process-models"
-    if [[ ! -d "$BPMN_SPEC_ABSOLUTE_DIR" ]]; then
-      >&2 echo "ERROR: Could not find a location for the sample processes. Last tried: $BPMN_SPEC_ABSOLUTE_DIR"
+  SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../../sample-process-models"
+  if [[ ! -d "$SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR" ]]; then
+    SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR="${script_dir}/../../sample-process-models"
+    if [[ ! -d "$SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR" ]]; then
+      >&2 echo "ERROR: Could not find a location for the sample processes. Last tried: $SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
       exit 1
     fi
   fi
-  export BPMN_SPEC_ABSOLUTE_DIR
+  export SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR
 fi
 
 tasks=""
@@ -40,7 +40,7 @@ if [[ "${1:-}" == "clean" ]]; then
 
   # TODO: check to see if the db already exists and we can connect to it. also actually clean it up.
   # start postgres in background with one db
-  if [[ "${SPIFF_DATABASE_TYPE:-}" == "postgres" ]]; then
+  if [[ "${SPIFFWORKFLOW_BACKEND_DATABASE_TYPE:-}" == "postgres" ]]; then
     if ! docker exec -it postgres-spiff psql -U spiffworkflow_backend spiffworkflow_backend_testing -c "select 1"; then
       docker run --name postgres-spiff -p 5432:5432 -e POSTGRES_PASSWORD=spiffworkflow_backend -e POSTGRES_USER=spiffworkflow_backend -e POSTGRES_DB=spiffworkflow_backend_testing -d postgres
       sleep 4 # classy
diff --git a/spiffworkflow-backend/bin/run_server_locally b/spiffworkflow-backend/bin/run_server_locally
index 213a4f396..d27ddf3b0 100755
--- a/spiffworkflow-backend/bin/run_server_locally
+++ b/spiffworkflow-backend/bin/run_server_locally
@@ -17,11 +17,11 @@ if [[ -z "${SPIFFWORKFLOW_BACKEND_ENV:-}" ]]; then
   export SPIFFWORKFLOW_BACKEND_ENV=local_development
 fi
 
-BPMN_SPEC_ABSOLUTE_DIR=$(./bin/find_sample_process_models)
-export BPMN_SPEC_ABSOLUTE_DIR
+SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR=$(./bin/find_sample_process_models)
+export SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR
 
 export FLASK_SESSION_SECRET_KEY=super_secret_key
-export APPLICATION_ROOT="/"
+export SPIFFWORKFLOW_BACKEND_APPLICATION_ROOT="/"
 
 if [[ -n "${SPIFFWORKFLOW_BACKEND_LOAD_FIXTURE_DATA:-}" ]]; then
   ./bin/boot_server_in_docker
@@ -29,13 +29,13 @@ else
   export FLASK_DEBUG=1
 
   if [[ "${SPIFFWORKFLOW_BACKEND_RUN_DATA_SETUP:-}" != "false" ]]; then
-    RUN_BACKGROUND_SCHEDULER=false SPIFFWORKFLOW_BACKEND_FAIL_ON_INVALID_PROCESS_MODELS=false poetry run python bin/save_all_bpmn.py
+    SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER=false SPIFFWORKFLOW_BACKEND_FAIL_ON_INVALID_PROCESS_MODELS=false poetry run python bin/save_all_bpmn.py
   fi
 
-  if [[ -z "${RUN_BACKGROUND_SCHEDULER:-}" ]]; then
-    RUN_BACKGROUND_SCHEDULER=true
+  if [[ -z "${SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER:-}" ]]; then
+    SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER=true
   fi
 
   # this line blocks
-  RUN_BACKGROUND_SCHEDULER="${RUN_BACKGROUND_SCHEDULER}" FLASK_APP=src/spiffworkflow_backend poetry run flask run -p 7000
+  SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER="${SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER}" FLASK_APP=src/spiffworkflow_backend poetry run flask run -p 7000
 fi
diff --git a/spiffworkflow-backend/bin/save_to_secrets_from_file b/spiffworkflow-backend/bin/save_to_secrets_from_file
index 5a28c66aa..5fa1b0bd2 100644
--- a/spiffworkflow-backend/bin/save_to_secrets_from_file
+++ b/spiffworkflow-backend/bin/save_to_secrets_from_file
@@ -11,8 +11,8 @@ from spiffworkflow_backend.services.secret_service import SecretService
 def main(env_file: str):
     """Main."""
     os.environ["SPIFFWORKFLOW_BACKEND_ENV"] = "local_development"
-    if os.environ.get("BPMN_SPEC_ABSOLUTE_DIR") is None:
-      os.environ["BPMN_SPEC_ABSOLUTE_DIR"] = "hey"
+    if os.environ.get("SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR") is None:
+      os.environ["SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"] = "hey"
     flask_env_key = "FLASK_SESSION_SECRET_KEY"
     os.environ[flask_env_key] = "whatevs"
     app = create_app()
diff --git a/spiffworkflow-backend/docker-compose.yml b/spiffworkflow-backend/docker-compose.yml
index 4ec1028f9..8fe552812 100644
--- a/spiffworkflow-backend/docker-compose.yml
+++ b/spiffworkflow-backend/docker-compose.yml
@@ -50,25 +50,25 @@ services:
     build:
       context: .
     environment:
-      - APPLICATION_ROOT=/
-      - SPIFFWORKFLOW_BACKEND_ENV=${SPIFFWORKFLOW_BACKEND_ENV:-local_development}
       - FLASK_DEBUG=0
       - FLASK_SESSION_SECRET_KEY=${FLASK_SESSION_SECRET_KEY:-super_secret_key}
-      - OPEN_ID_SERVER_URL=${OPEN_ID_SERVER_URL:-http://localhost:7002/realms/spiffworkflow}
-      - SPIFFWORKFLOW_FRONTEND_URL=${SPIFFWORKFLOW_FRONTEND_URL:-http://localhost:7001}
-      - SPIFFWORKFLOW_BACKEND_URL=${SPIFFWORKFLOW_BACKEND_URL:-http://localhost:7000}
-      - SPIFFWORKFLOW_BACKEND_PORT=7000
-      - SPIFFWORKFLOW_BACKEND_UPGRADE_DB=true
+      - SPIFFWORKFLOW_BACKEND_APPLICATION_ROOT=/
+      - SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR=/app/process_models
       - SPIFFWORKFLOW_BACKEND_DATABASE_URI=mysql+mysqlconnector://root:${SPIFFWORKFLOW_BACKEND_MYSQL_ROOT_DATABASE:-my-secret-pw}@localhost:7003/${SPIFFWORKFLOW_BACKEND_DATABASE_NAME:-spiffworkflow_backend_development}
-      - BPMN_SPEC_ABSOLUTE_DIR=/app/process_models
+      - SPIFFWORKFLOW_BACKEND_ENV=${SPIFFWORKFLOW_BACKEND_ENV:-local_development}
       - SPIFFWORKFLOW_BACKEND_LOAD_FIXTURE_DATA=${SPIFFWORKFLOW_BACKEND_LOAD_FIXTURE_DATA:-false}
+      - SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL=${SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL:-http://localhost:7002/realms/spiffworkflow}
       - SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME=${SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME:-acceptance_tests.yml}
-      - RUN_BACKGROUND_SCHEDULER=true
+      - SPIFFWORKFLOW_BACKEND_PORT=7000
+      - SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER=true
+      - SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND=${SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND:-http://localhost:7001}
+      - SPIFFWORKFLOW_BACKEND_UPGRADE_DB=true
+      - SPIFFWORKFLOW_BACKEND_URL=${SPIFFWORKFLOW_BACKEND_URL:-http://localhost:7000}
     ports:
       - "7000:7000"
     network_mode: host
     volumes:
-      - ${BPMN_SPEC_ABSOLUTE_DIR:-../../sample-process-models}:/app/process_models
+      - ${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-../../sample-process-models}:/app/process_models
       - ./log:/app/log
     healthcheck:
       test: curl localhost:7000/v1.0/status --fail
@@ -82,7 +82,7 @@ services:
     profiles:
       - debug
     volumes:
-      - ${BPMN_SPEC_ABSOLUTE_DIR:-../../sample-process-models}:/app/process_models
+      - ${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-../../sample-process-models}:/app/process_models
       - ./:/app
     command: /app/bin/boot_in_docker_debug_mode
 
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/__init__.py b/spiffworkflow-backend/src/spiffworkflow_backend/__init__.py
index eb759d460..92c11037a 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/__init__.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/__init__.py
@@ -115,7 +115,7 @@ def create_app() -> flask.app.Flask:
     # need to continually keep asking for the same path.
     origins_re = [
         r"^https?:\/\/%s(.*)" % o.replace(".", r"\.")
-        for o in app.config["CORS_ALLOW_ORIGINS"]
+        for o in app.config["SPIFFWORKFLOW_BACKEND_CORS_ALLOW_ORIGINS"]
     ]
     CORS(app, origins=origins_re, max_age=3600, supports_credentials=True)
 
@@ -128,7 +128,7 @@ def create_app() -> flask.app.Flask:
 
     # do not start the scheduler twice in flask debug mode
     if (
-        app.config["RUN_BACKGROUND_SCHEDULER"]
+        app.config["SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER"]
         and os.environ.get("WERKZEUG_RUN_MAIN") != "true"
     ):
         start_scheduler(app)
@@ -147,13 +147,15 @@ def get_hacked_up_app_for_script() -> flask.app.Flask:
     os.environ["SPIFFWORKFLOW_BACKEND_ENV"] = "local_development"
     flask_env_key = "FLASK_SESSION_SECRET_KEY"
     os.environ[flask_env_key] = "whatevs"
-    if "BPMN_SPEC_ABSOLUTE_DIR" not in os.environ:
+    if "SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR" not in os.environ:
         home = os.environ["HOME"]
         full_process_model_path = (
             f"{home}/projects/github/sartography/sample-process-models"
         )
         if os.path.isdir(full_process_model_path):
-            os.environ["BPMN_SPEC_ABSOLUTE_DIR"] = full_process_model_path
+            os.environ["SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"] = (
+                full_process_model_path
+            )
         else:
             raise Exception(f"Could not find {full_process_model_path}")
     app = create_app()
@@ -198,20 +200,28 @@ def configure_sentry(app: flask.app.Flask) -> None:
                 return None
         return event
 
-    sentry_errors_sample_rate = app.config.get("SENTRY_ERRORS_SAMPLE_RATE")
+    sentry_errors_sample_rate = app.config.get(
+        "SPIFFWORKFLOW_BACKEND_SENTRY_ERRORS_SAMPLE_RATE"
+    )
     if sentry_errors_sample_rate is None:
-        raise Exception("SENTRY_ERRORS_SAMPLE_RATE is not set somehow")
+        raise Exception(
+            "SPIFFWORKFLOW_BACKEND_SENTRY_ERRORS_SAMPLE_RATE is not set somehow"
+        )
 
-    sentry_traces_sample_rate = app.config.get("SENTRY_TRACES_SAMPLE_RATE")
+    sentry_traces_sample_rate = app.config.get(
+        "SPIFFWORKFLOW_BACKEND_SENTRY_TRACES_SAMPLE_RATE"
+    )
     if sentry_traces_sample_rate is None:
-        raise Exception("SENTRY_TRACES_SAMPLE_RATE is not set somehow")
+        raise Exception(
+            "SPIFFWORKFLOW_BACKEND_SENTRY_TRACES_SAMPLE_RATE is not set somehow"
+        )
 
     # profiling doesn't work on windows, because of an issue like https://github.com/nvdv/vprof/issues/62
     # but also we commented out profiling because it was causing segfaults (i guess it is marked experimental)
     # profiles_sample_rate = 0 if sys.platform.startswith("win") else 1
 
     sentry_sdk.init(
-        dsn=app.config.get("SENTRY_DSN"),
+        dsn=app.config.get("SPIFFWORKFLOW_BACKEND_SENTRY_DSN"),
         integrations=[
             FlaskIntegration(),
         ],
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/__init__.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/__init__.py
index e0c18ee55..bdd02909f 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/__init__.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/__init__.py
@@ -17,17 +17,17 @@ def setup_database_uri(app: Flask) -> None:
     """Setup_database_uri."""
     if app.config.get("SPIFFWORKFLOW_BACKEND_DATABASE_URI") is None:
         database_name = f"spiffworkflow_backend_{app.config['ENV_IDENTIFIER']}"
-        if app.config.get("SPIFF_DATABASE_TYPE") == "sqlite":
+        if app.config.get("SPIFFWORKFLOW_BACKEND_DATABASE_TYPE") == "sqlite":
             app.config["SQLALCHEMY_DATABASE_URI"] = (
                 f"sqlite:///{app.instance_path}/db_{app.config['ENV_IDENTIFIER']}.sqlite3"
             )
-        elif app.config.get("SPIFF_DATABASE_TYPE") == "postgres":
+        elif app.config.get("SPIFFWORKFLOW_BACKEND_DATABASE_TYPE") == "postgres":
             app.config["SQLALCHEMY_DATABASE_URI"] = (
                 f"postgresql://spiffworkflow_backend:spiffworkflow_backend@localhost:5432/{database_name}"
             )
         else:
             # use pswd to trick flake8 with hardcoded passwords
-            db_pswd = os.environ.get("DB_PASSWORD")
+            db_pswd = app.config.get("SPIFFWORKFLOW_BACKEND_DATABASE_PASSWORD")
             if db_pswd is None:
                 db_pswd = ""
             app.config["SQLALCHEMY_DATABASE_URI"] = (
@@ -52,15 +52,20 @@ def load_config_file(app: Flask, env_config_module: str) -> None:
 
 
 def _set_up_tenant_specific_fields_as_list_of_strings(app: Flask) -> None:
-    tenant_specific_fields = app.config.get("OPEN_ID_TENANT_SPECIFIC_FIELDS")
+    tenant_specific_fields = app.config.get(
+        "SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS"
+    )
 
     if tenant_specific_fields is None or tenant_specific_fields == "":
-        app.config["OPEN_ID_TENANT_SPECIFIC_FIELDS"] = []
+        app.config["SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS"] = []
     else:
-        app.config["OPEN_ID_TENANT_SPECIFIC_FIELDS"] = tenant_specific_fields.split(",")
-        if len(app.config["OPEN_ID_TENANT_SPECIFIC_FIELDS"]) > 3:
+        app.config["SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS"] = (
+            tenant_specific_fields.split(",")
+        )
+        if len(app.config["SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS"]) > 3:
             raise ConfigurationError(
-                "OPEN_ID_TENANT_SPECIFIC_FIELDS can have a maximum of 3 fields"
+                "SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS can have a"
+                " maximum of 3 fields"
             )
 
 
@@ -116,8 +121,10 @@ def setup_config(app: Flask) -> None:
     # src/spiffworkflow_backend/config/secrets.py
     app.config.from_pyfile(os.path.join("config", "secrets.py"), silent=True)
 
-    if app.config["BPMN_SPEC_ABSOLUTE_DIR"] is None:
-        raise ConfigurationError("BPMN_SPEC_ABSOLUTE_DIR config must be set")
+    if app.config["SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"] is None:
+        raise ConfigurationError(
+            "SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR config must be set"
+        )
 
     app.config["PROCESS_UUID"] = uuid.uuid4()
 
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/default.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/default.py
index 8002a9982..4aeecd371 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/default.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/default.py
@@ -2,44 +2,52 @@
 import re
 from os import environ
 
-BPMN_SPEC_ABSOLUTE_DIR = environ.get("BPMN_SPEC_ABSOLUTE_DIR")
+SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR = environ.get(
+    "SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
+)
 cors_allow_all = "*"
-CORS_ALLOW_ORIGINS = re.split(
-    r",\s*", environ.get("CORS_ALLOW_ORIGINS", default=cors_allow_all)
+SPIFFWORKFLOW_BACKEND_CORS_ALLOW_ORIGINS = re.split(
+    r",\s*",
+    environ.get("SPIFFWORKFLOW_BACKEND_CORS_ALLOW_ORIGINS", default=cors_allow_all),
 )
 
-RUN_BACKGROUND_SCHEDULER = (
-    environ.get("RUN_BACKGROUND_SCHEDULER", default="false") == "true"
+SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER = (
+    environ.get("SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER", default="false")
+    == "true"
 )
-SPIFFWORKFLOW_FRONTEND_URL = environ.get(
-    "SPIFFWORKFLOW_FRONTEND_URL", default="http://localhost:7001"
+SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND = environ.get(
+    "SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND", default="http://localhost:7001"
 )
 SPIFFWORKFLOW_BACKEND_URL = environ.get(
     "SPIFFWORKFLOW_BACKEND_URL", default="http://localhost:7000"
 )
 # service task connector proxy
-CONNECTOR_PROXY_URL = environ.get(
-    "CONNECTOR_PROXY_URL", default="http://localhost:7004"
+SPIFFWORKFLOW_BACKEND_CONNECTOR_PROXY_URL = environ.get(
+    "SPIFFWORKFLOW_BACKEND_CONNECTOR_PROXY_URL", default="http://localhost:7004"
 )
 
 # Open ID server
-OPEN_ID_SERVER_URL = environ.get(
-    "OPEN_ID_SERVER_URL",
-    default="http://localhost:7002/realms/spiffworkflow"
-    # "OPEN_ID_SERVER_URL", default="http://localhost:7000/openid"
+# use "http://localhost:7000/openid" for running with simple openid
+# server hosted by spiffworkflow-backend
+SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL = environ.get(
+    "SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL",
+    default="http://localhost:7002/realms/spiffworkflow",
 )
 
-# Replace above line with this to use the built-in Open ID Server.
-# OPEN_ID_SERVER_URL = environ.get("OPEN_ID_SERVER_URL", default="http://localhost:7000/openid")
-OPEN_ID_CLIENT_ID = environ.get("OPEN_ID_CLIENT_ID", default="spiffworkflow-backend")
-OPEN_ID_CLIENT_SECRET_KEY = environ.get(
-    "OPEN_ID_CLIENT_SECRET_KEY", default="JXeQExm0JhQPLumgHtIIqf52bDalHz0q"
+SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_ID = environ.get(
+    "SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_ID", default="spiffworkflow-backend"
+)
+SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_SECRET_KEY = environ.get(
+    "SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_SECRET_KEY",
+    default="JXeQExm0JhQPLumgHtIIqf52bDalHz0q",
 )  # noqa: S105
 
 # Tenant specific fields is a comma separated list of field names that we will convert to list of strings
 # and store in the user table's tenant_specific_field_n columns. You can have up to three items in this
 # comma-separated list.
-OPEN_ID_TENANT_SPECIFIC_FIELDS = environ.get("OPEN_ID_TENANT_SPECIFIC_FIELDS")
+SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS = environ.get(
+    "SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS"
+)
 
 SPIFFWORKFLOW_BACKEND_LOG_TO_FILE = (
     environ.get("SPIFFWORKFLOW_BACKEND_LOG_TO_FILE", default="false") == "true"
@@ -50,13 +58,21 @@ SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = environ.get(
 )
 
 # Sentry Configuration
-SENTRY_DSN = environ.get("SENTRY_DSN", default="")
-SENTRY_ERRORS_SAMPLE_RATE = environ.get(
-    "SENTRY_ERRORS_SAMPLE_RATE", default="1"
+SPIFFWORKFLOW_BACKEND_SENTRY_DSN = environ.get(
+    "SPIFFWORKFLOW_BACKEND_SENTRY_DSN", default=""
+)
+SPIFFWORKFLOW_BACKEND_SENTRY_ERRORS_SAMPLE_RATE = environ.get(
+    "SPIFFWORKFLOW_BACKEND_SENTRY_ERRORS_SAMPLE_RATE", default="1"
 )  # send all errors
-SENTRY_TRACES_SAMPLE_RATE = environ.get(
-    "SENTRY_TRACES_SAMPLE_RATE", default="0.01"
+SPIFFWORKFLOW_BACKEND_SENTRY_TRACES_SAMPLE_RATE = environ.get(
+    "SPIFFWORKFLOW_BACKEND_SENTRY_TRACES_SAMPLE_RATE", default="0.01"
 )  # send 1% of traces
+SPIFFWORKFLOW_BACKEND_SENTRY_ORGANIZATION_SLUG = environ.get(
+    "SPIFFWORKFLOW_BACKEND_SENTRY_ORGANIZATION_SLUG", default=None
+)
+SPIFFWORKFLOW_BACKEND_SENTRY_PROJECT_SLUG = environ.get(
+    "SPIFFWORKFLOW_BACKEND_SENTRY_PROJECT_SLUG", default=None
+)
 
 SPIFFWORKFLOW_BACKEND_LOG_LEVEL = environ.get(
     "SPIFFWORKFLOW_BACKEND_LOG_LEVEL", default="info"
@@ -64,31 +80,55 @@ SPIFFWORKFLOW_BACKEND_LOG_LEVEL = environ.get(
 
 # When a user clicks on the `Publish` button, this is the default branch this server merges into.
 # I.e., dev server could have `staging` here. Staging server might have `production` here.
-GIT_BRANCH_TO_PUBLISH_TO = environ.get("GIT_BRANCH_TO_PUBLISH_TO")
-GIT_BRANCH = environ.get("GIT_BRANCH")
-GIT_CLONE_URL_FOR_PUBLISHING = environ.get("GIT_CLONE_URL")
-GIT_COMMIT_ON_SAVE = environ.get("GIT_COMMIT_ON_SAVE", default="false") == "true"
-GIT_SSH_PRIVATE_KEY = environ.get("GIT_SSH_PRIVATE_KEY")
-GIT_USERNAME = environ.get("GIT_USERNAME")
-GIT_USER_EMAIL = environ.get("GIT_USER_EMAIL")
+SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO"
+)
+SPIFFWORKFLOW_BACKEND_GIT_BRANCH = environ.get("SPIFFWORKFLOW_BACKEND_GIT_BRANCH")
+SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING = environ.get("GIT_CLONE_URL")
+SPIFFWORKFLOW_BACKEND_GIT_COMMIT_ON_SAVE = (
+    environ.get("SPIFFWORKFLOW_BACKEND_GIT_COMMIT_ON_SAVE", default="false") == "true"
+)
+SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY"
+)
+SPIFFWORKFLOW_BACKEND_GIT_USERNAME = environ.get("SPIFFWORKFLOW_BACKEND_GIT_USERNAME")
+SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL"
+)
+SPIFFWORKFLOW_BACKEND_GITHUB_WEBHOOK_SECRET = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GITHUB_WEBHOOK_SECRET", default=None
+)
+SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY", default=None
+)
+SPIFFWORKFLOW_BACKEND_GIT_USER_PASSWORD = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_USER_PASSWORD", default=None
+)
 
 # Database Configuration
-SPIFF_DATABASE_TYPE = environ.get(
-    "SPIFF_DATABASE_TYPE", default="mysql"
+SPIFFWORKFLOW_BACKEND_DATABASE_TYPE = environ.get(
+    "SPIFFWORKFLOW_BACKEND_DATABASE_TYPE", default="mysql"
 )  # can also be sqlite, postgres
 # Overide above with specific sqlalchymy connection string.
 SPIFFWORKFLOW_BACKEND_DATABASE_URI = environ.get(
     "SPIFFWORKFLOW_BACKEND_DATABASE_URI", default=None
 )
-SYSTEM_NOTIFICATION_PROCESS_MODEL_MESSAGE_ID = environ.get(
-    "SYSTEM_NOTIFICATION_PROCESS_MODEL_MESSAGE_ID",
+SPIFFWORKFLOW_BACKEND_SYSTEM_NOTIFICATION_PROCESS_MODEL_MESSAGE_ID = environ.get(
+    "SPIFFWORKFLOW_BACKEND_SYSTEM_NOTIFICATION_PROCESS_MODEL_MESSAGE_ID",
     default="Message_SystemMessageNotification",
 )
 
-ALLOW_CONFISCATING_LOCK_AFTER_SECONDS = int(
-    environ.get("ALLOW_CONFISCATING_LOCK_AFTER_SECONDS", default="600")
+SPIFFWORKFLOW_BACKEND_ALLOW_CONFISCATING_LOCK_AFTER_SECONDS = int(
+    environ.get(
+        "SPIFFWORKFLOW_BACKEND_ALLOW_CONFISCATING_LOCK_AFTER_SECONDS", default="600"
+    )
 )
 
 SPIFFWORKFLOW_BACKEND_DEFAULT_USER_GROUP = environ.get(
     "SPIFFWORKFLOW_BACKEND_DEFAULT_USER_GROUP", default="everybody"
 )
+
+# this is only used in CI. use SPIFFWORKFLOW_BACKEND_DATABASE_URI instead for real configuration
+SPIFFWORKFLOW_BACKEND_DATABASE_PASSWORD = environ.get(
+    "SPIFFWORKFLOW_BACKEND_DATABASE_PASSWORD", default=None
+)
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/demo.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/demo.py
index 06e9184d7..aec6a03bb 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/demo.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/demo.py
@@ -1,14 +1,15 @@
 """Demo environment."""
 from os import environ
 
-GIT_COMMIT_ON_SAVE = True
-GIT_USERNAME = "demo"
-GIT_USER_EMAIL = "demo@example.com"
+SPIFFWORKFLOW_BACKEND_GIT_COMMIT_ON_SAVE = True
+SPIFFWORKFLOW_BACKEND_GIT_USERNAME = "demo"
+SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL = "demo@example.com"
 SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = environ.get(
     "SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME",
     default="terraform_deployed_environment.yml",
 )
 
-RUN_BACKGROUND_SCHEDULER = (
-    environ.get("RUN_BACKGROUND_SCHEDULER", default="false") == "true"
+SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER = (
+    environ.get("SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER", default="false")
+    == "true"
 )
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/dev.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/dev.py
index cbbc269a8..7cc73bc8f 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/dev.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/dev.py
@@ -1,9 +1,14 @@
 """Dev."""
 from os import environ
 
-GIT_BRANCH_TO_PUBLISH_TO = environ.get("GIT_BRANCH_TO_PUBLISH_TO", default="staging")
-GIT_USERNAME = environ.get("GIT_USERNAME", default="sartography-automated-committer")
-GIT_USER_EMAIL = environ.get(
-    "GIT_USER_EMAIL", default="sartography-automated-committer@users.noreply.github.com"
+SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO", default="staging"
+)
+SPIFFWORKFLOW_BACKEND_GIT_USERNAME = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_USERNAME", default="sartography-automated-committer"
+)
+SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL",
+    default="sartography-automated-committer@users.noreply.github.com",
 )
 SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = "dev.yml"
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/local_development.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/local_development.py
index a1129c67e..e9e674ef2 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/local_development.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/local_development.py
@@ -9,11 +9,14 @@ SPIFFWORKFLOW_BACKEND_LOG_LEVEL = environ.get(
     "SPIFFWORKFLOW_BACKEND_LOG_LEVEL", default="debug"
 )
 
-RUN_BACKGROUND_SCHEDULER = (
-    environ.get("RUN_BACKGROUND_SCHEDULER", default="false") == "true"
+SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER = (
+    environ.get("SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER", default="false")
+    == "true"
 )
-GIT_CLONE_URL_FOR_PUBLISHING = environ.get(
+SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING = environ.get(
     "GIT_CLONE_URL", default="https://github.com/sartography/sample-process-models.git"
 )
-GIT_USERNAME = "sartography-automated-committer"
-GIT_USER_EMAIL = f"{GIT_USERNAME}@users.noreply.github.com"
+SPIFFWORKFLOW_BACKEND_GIT_USERNAME = "sartography-automated-committer"
+SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL = (
+    f"{SPIFFWORKFLOW_BACKEND_GIT_USERNAME}@users.noreply.github.com"
+)
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/qa1.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/qa1.py
index 8e8f4379c..b1592d93b 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/qa1.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/qa1.py
@@ -1,10 +1,15 @@
 """Qa1."""
 from os import environ
 
-GIT_BRANCH_TO_PUBLISH_TO = environ.get("GIT_BRANCH_TO_PUBLISH_TO", default="qa2")
-GIT_USERNAME = environ.get("GIT_USERNAME", default="sartography-automated-committer")
-GIT_USER_EMAIL = environ.get(
-    "GIT_USER_EMAIL", default=f"{GIT_USERNAME}@users.noreply.github.com"
+SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO", default="qa2"
+)
+SPIFFWORKFLOW_BACKEND_GIT_USERNAME = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_USERNAME", default="sartography-automated-committer"
+)
+SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL",
+    default=f"{SPIFFWORKFLOW_BACKEND_GIT_USERNAME}@users.noreply.github.com",
 )
 SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = environ.get(
     "SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME", default="qa1.yml"
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/qa2.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/qa2.py
index 561954f64..f81d88645 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/qa2.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/qa2.py
@@ -4,7 +4,11 @@ from os import environ
 SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = environ.get(
     "SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME", default="qa1.yml"
 )
-SPIFFWORKFLOW_FRONTEND_URL = "https://qa2.spiffworkflow.org"
-OPEN_ID_SERVER_URL = "https://qa2.spiffworkflow.org/keycloak/realms/spiffworkflow"
+SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND = "https://qa2.spiffworkflow.org"
+SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL = (
+    "https://qa2.spiffworkflow.org/keycloak/realms/spiffworkflow"
+)
 SPIFFWORKFLOW_BACKEND_URL = "https://qa2.spiffworkflow.org/api"
-CONNECTOR_PROXY_URL = "https://qa2.spiffworkflow.org/connector-proxy"
+SPIFFWORKFLOW_BACKEND_CONNECTOR_PROXY_URL = (
+    "https://qa2.spiffworkflow.org/connector-proxy"
+)
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/sartography.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/sartography.py
index 016076b93..f384622e6 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/sartography.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/sartography.py
@@ -2,9 +2,14 @@
 from os import environ
 
 environment_identifier_for_this_config_file_only = environ["SPIFFWORKFLOW_BACKEND_ENV"]
-OPEN_ID_SERVER_URL = f"https://keycloak.{environment_identifier_for_this_config_file_only}.spiffworkflow.org/realms/sartography"
-GIT_BRANCH = environ.get("GIT_BRANCH", default="main")
-GIT_CLONE_URL_FOR_PUBLISHING = environ.get(
+SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL = (
+    f"https://keycloak.{environment_identifier_for_this_config_file_only}"
+    ".spiffworkflow.org/realms/sartography"
+)
+SPIFFWORKFLOW_BACKEND_GIT_BRANCH = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_BRANCH", default="main"
+)
+SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING = environ.get(
     "GIT_CLONE_URL",
     default="https://github.com/sartography/sartography-process-models.git",
 )
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/staging.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/staging.py
index 807163315..56b4a3ff2 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/staging.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/staging.py
@@ -1,7 +1,11 @@
 """Staging."""
 from os import environ
 
-GIT_BRANCH = environ.get("GIT_BRANCH", default="staging")
-GIT_BRANCH_TO_PUBLISH_TO = environ.get("GIT_BRANCH_TO_PUBLISH_TO", default="main")
-GIT_COMMIT_ON_SAVE = False
+SPIFFWORKFLOW_BACKEND_GIT_BRANCH = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_BRANCH", default="staging"
+)
+SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO = environ.get(
+    "SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO", default="main"
+)
+SPIFFWORKFLOW_BACKEND_GIT_COMMIT_ON_SAVE = False
 SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = "staging.yml"
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/terraform_deployed_environment.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/terraform_deployed_environment.py
index efd451834..f75b5f06f 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/terraform_deployed_environment.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/terraform_deployed_environment.py
@@ -4,26 +4,35 @@ from os import environ
 # default.py already ensured that this key existed as was not None
 environment_identifier_for_this_config_file_only = environ["SPIFFWORKFLOW_BACKEND_ENV"]
 
-GIT_COMMIT_ON_SAVE = True
-GIT_USERNAME = "sartography-automated-committer"
-GIT_USER_EMAIL = f"{GIT_USERNAME}@users.noreply.github.com"
+SPIFFWORKFLOW_BACKEND_GIT_COMMIT_ON_SAVE = True
+SPIFFWORKFLOW_BACKEND_GIT_USERNAME = "sartography-automated-committer"
+SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL = (
+    f"{SPIFFWORKFLOW_BACKEND_GIT_USERNAME}@users.noreply.github.com"
+)
 SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = environ.get(
     "SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME",
     default="terraform_deployed_environment.yml",
 )
 
-RUN_BACKGROUND_SCHEDULER = (
-    environ.get("RUN_BACKGROUND_SCHEDULER", default="false") == "true"
+SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER = (
+    environ.get("SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER", default="false")
+    == "true"
 )
 
-OPEN_ID_SERVER_URL = f"https://keycloak.{environment_identifier_for_this_config_file_only}.spiffworkflow.org/realms/spiffworkflow"
-SPIFFWORKFLOW_FRONTEND_URL = (
+SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL = (
+    f"https://keycloak.{environment_identifier_for_this_config_file_only}"
+    ".spiffworkflow.org/realms/spiffworkflow"
+)
+SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND = (
     f"https://{environment_identifier_for_this_config_file_only}.spiffworkflow.org"
 )
 SPIFFWORKFLOW_BACKEND_URL = (
     f"https://api.{environment_identifier_for_this_config_file_only}.spiffworkflow.org"
 )
-CONNECTOR_PROXY_URL = f"https://connector-proxy.{environment_identifier_for_this_config_file_only}.spiffworkflow.org"
-GIT_CLONE_URL_FOR_PUBLISHING = environ.get(
+SPIFFWORKFLOW_BACKEND_CONNECTOR_PROXY_URL = (
+    f"https://connector-proxy.{environment_identifier_for_this_config_file_only}"
+    ".spiffworkflow.org"
+)
+SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING = environ.get(
     "GIT_CLONE_URL", default="https://github.com/sartography/sample-process-models.git"
 )
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/unit_testing.py b/spiffworkflow-backend/src/spiffworkflow_backend/config/unit_testing.py
index 77f123e98..e486fe769 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/config/unit_testing.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/unit_testing.py
@@ -15,11 +15,11 @@ SPIFFWORKFLOW_BACKEND_PERMISSIONS_FILE_NAME = environ.get(
 SPIFFWORKFLOW_BACKEND_LOG_LEVEL = environ.get(
     "SPIFFWORKFLOW_BACKEND_LOG_LEVEL", default="debug"
 )
-GIT_COMMIT_ON_SAVE = False
+SPIFFWORKFLOW_BACKEND_GIT_COMMIT_ON_SAVE = False
 
 # NOTE: set this here since nox shoves tests and src code to
 # different places and this allows us to know exactly where we are at the start
-BPMN_SPEC_ABSOLUTE_DIR = os.path.join(
+SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR = os.path.join(
     os.path.dirname(__file__),
     "..",
     "..",
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/exceptions/api_error.py b/spiffworkflow-backend/src/spiffworkflow_backend/exceptions/api_error.py
index bb6d84f4f..5fff05c2d 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/exceptions/api_error.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/exceptions/api_error.py
@@ -206,8 +206,12 @@ def handle_exception(exception: Exception) -> flask.wrappers.Response:
                 f" {exception.error_code}"
             )
 
-        organization_slug = current_app.config.get("SENTRY_ORGANIZATION_SLUG")
-        project_slug = current_app.config.get("SENTRY_PROJECT_SLUG")
+        organization_slug = current_app.config.get(
+            "SPIFFWORKFLOW_BACKEND_SENTRY_ORGANIZATION_SLUG"
+        )
+        project_slug = current_app.config.get(
+            "SPIFFWORKFLOW_BACKEND_SENTRY_PROJECT_SLUG"
+        )
         if organization_slug and project_slug:
             sentry_link = (
                 f"https://sentry.io/{organization_slug}/{project_slug}/events/{id}"
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py
index 82263475b..d50255a87 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py
@@ -305,7 +305,7 @@ def manual_complete_task(
 
 def _commit_and_push_to_git(message: str) -> None:
     """Commit_and_push_to_git."""
-    if current_app.config["GIT_COMMIT_ON_SAVE"]:
+    if current_app.config["SPIFFWORKFLOW_BACKEND_GIT_COMMIT_ON_SAVE"]:
         git_output = GitService.commit(message=message)
         current_app.logger.info(f"git output: {git_output}")
     else:
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_instances_controller.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_instances_controller.py
index c085c9e99..634d21285 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_instances_controller.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_instances_controller.py
@@ -136,7 +136,7 @@ def process_instance_run(
         finally:
             processor.unlock_process_instance("Web")
 
-        if not current_app.config["RUN_BACKGROUND_SCHEDULER"]:
+        if not current_app.config["SPIFFWORKFLOW_BACKEND_RUN_BACKGROUND_SCHEDULER"]:
             MessageService.process_message_instances()
 
     process_instance_api = ProcessInstanceService.processor_to_process_instance_api(
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_models_controller.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_models_controller.py
index 120db8cab..1e2a16a7c 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_models_controller.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_models_controller.py
@@ -225,10 +225,12 @@ def process_model_publish(
 ) -> flask.wrappers.Response:
     """Process_model_publish."""
     if branch_to_update is None:
-        branch_to_update = current_app.config["GIT_BRANCH_TO_PUBLISH_TO"]
+        branch_to_update = current_app.config[
+            "SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO"
+        ]
     if branch_to_update is None:
         raise MissingGitConfigsError(
-            "Missing config for GIT_BRANCH_TO_PUBLISH_TO. "
+            "Missing config for SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO. "
             "This is required for publishing process models"
         )
     process_model_identifier = _un_modify_modified_process_model_id(
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/service_tasks_controller.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/service_tasks_controller.py
index a1708ce8d..61c8f6dad 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/service_tasks_controller.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/service_tasks_controller.py
@@ -27,7 +27,9 @@ def authentication_list() -> flask.wrappers.Response:
     available_authentications = ServiceTaskService.authentication_list()
     response_json = {
         "results": available_authentications,
-        "connector_proxy_base_url": current_app.config["CONNECTOR_PROXY_URL"],
+        "connector_proxy_base_url": current_app.config[
+            "SPIFFWORKFLOW_BACKEND_CONNECTOR_PROXY_URL"
+        ],
         "redirect_url": f"{current_app.config['SPIFFWORKFLOW_BACKEND_URL']}/v1.0/authentication_callback",
     }
 
@@ -45,5 +47,5 @@ def authentication_callback(
         f"{service}/{auth_method}", response, g.user.id, create_if_not_exists=True
     )
     return redirect(
-        f"{current_app.config['SPIFFWORKFLOW_FRONTEND_URL']}/admin/configuration"
+        f"{current_app.config['SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND']}/admin/configuration"
     )
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/tasks_controller.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/tasks_controller.py
index e40bf0577..c5dab9546 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/tasks_controller.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/tasks_controller.py
@@ -674,7 +674,7 @@ def _get_potential_owner_usernames(assigned_user: AliasedClass) -> Any:
     potential_owner_usernames_from_group_concat_or_similar = func.group_concat(
         assigned_user.username.distinct()
     ).label("potential_owner_usernames")
-    db_type = current_app.config.get("SPIFF_DATABASE_TYPE")
+    db_type = current_app.config.get("SPIFFWORKFLOW_BACKEND_DATABASE_TYPE")
 
     if db_type == "postgres":
         potential_owner_usernames_from_group_concat_or_similar = func.string_agg(
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/user.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/user.py
index 08727bdd8..7b9a268ae 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/user.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/user.py
@@ -186,7 +186,9 @@ def set_new_access_token_in_cookie(
     """
     tld = current_app.config["THREAD_LOCAL_DATA"]
     domain_for_frontend_cookie: Optional[str] = re.sub(
-        r"^https?:\/\/", "", current_app.config["SPIFFWORKFLOW_FRONTEND_URL"]
+        r"^https?:\/\/",
+        "",
+        current_app.config["SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND"],
     )
     if domain_for_frontend_cookie and domain_for_frontend_cookie.startswith(
         "localhost"
@@ -351,7 +353,7 @@ def logout(id_token: str, redirect_url: Optional[str]) -> Response:
 
 def logout_return() -> Response:
     """Logout_return."""
-    frontend_url = str(current_app.config["SPIFFWORKFLOW_FRONTEND_URL"])
+    frontend_url = str(current_app.config["SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND"])
     return redirect(f"{frontend_url}/")
 
 
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/scripts/get_frontend_url.py b/spiffworkflow-backend/src/spiffworkflow_backend/scripts/get_frontend_url.py
index b128214ab..503b9584f 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/scripts/get_frontend_url.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/scripts/get_frontend_url.py
@@ -28,4 +28,4 @@ class GetFrontendUrl(Script):
         **kwargs: Any
     ) -> Any:
         """Run."""
-        return current_app.config["SPIFFWORKFLOW_FRONTEND_URL"]
+        return current_app.config["SPIFFWORKFLOW_BACKEND_URL_FOR_FRONTEND"]
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/authentication_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/authentication_service.py
index 9e5cb6cee..143bb7655 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/services/authentication_service.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/authentication_service.py
@@ -63,17 +63,19 @@ class AuthenticationService:
     @staticmethod
     def client_id() -> str:
         """Returns the client id from the config."""
-        return current_app.config.get("OPEN_ID_CLIENT_ID", "")
+        return current_app.config.get("SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_ID", "")
 
     @staticmethod
     def server_url() -> str:
         """Returns the server url from the config."""
-        return current_app.config.get("OPEN_ID_SERVER_URL", "")
+        return current_app.config.get("SPIFFWORKFLOW_BACKEND_OPEN_ID_SERVER_URL", "")
 
     @staticmethod
     def secret_key() -> str:
         """Returns the secret key from the config."""
-        return current_app.config.get("OPEN_ID_CLIENT_SECRET_KEY", "")
+        return current_app.config.get(
+            "SPIFFWORKFLOW_BACKEND_OPEN_ID_CLIENT_SECRET_KEY", ""
+        )
 
     @classmethod
     def open_id_endpoint_for_name(cls, name: str) -> str:
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/authorization_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/authorization_service.py
index d00fc1620..9db4c39c6 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/services/authorization_service.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/authorization_service.py
@@ -107,7 +107,9 @@ class AuthorizationService:
             )
 
         received_sign = auth_header.split("sha256=")[-1].strip()
-        secret = current_app.config["GITHUB_WEBHOOK_SECRET"].encode()
+        secret = current_app.config[
+            "SPIFFWORKFLOW_BACKEND_GITHUB_WEBHOOK_SECRET"
+        ].encode()
         expected_sign = HMAC(key=secret, msg=request.data, digestmod=sha256).hexdigest()
         if not compare_digest(received_sign, expected_sign):
             raise TokenInvalidError(
@@ -504,7 +506,7 @@ class AuthorizationService:
         user_attributes["service_id"] = user_info["sub"]
 
         for field_index, tenant_specific_field in enumerate(
-            current_app.config["OPEN_ID_TENANT_SPECIFIC_FIELDS"]
+            current_app.config["SPIFFWORKFLOW_BACKEND_OPEN_ID_TENANT_SPECIFIC_FIELDS"]
         ):
             if tenant_specific_field in user_info:
                 field_number = field_index + 1
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/error_handling_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/error_handling_service.py
index ec1f5d36a..740aa1069 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/services/error_handling_service.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/error_handling_service.py
@@ -81,7 +81,7 @@ class ErrorHandlingService:
         )
         message_payload = {"message_text": message_text, "recipients": recipients}
         message_identifier = current_app.config[
-            "SYSTEM_NOTIFICATION_PROCESS_MODEL_MESSAGE_ID"
+            "SPIFFWORKFLOW_BACKEND_SYSTEM_NOTIFICATION_PROCESS_MODEL_MESSAGE_ID"
         ]
         message_model = MessageModel.query.filter_by(
             identifier=message_identifier
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/file_system_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/file_system_service.py
index ffca4f2c2..92dcb9bb4 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/services/file_system_service.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/file_system_service.py
@@ -40,7 +40,7 @@ class FileSystemService:
     @staticmethod
     def root_path() -> str:
         """Root_path."""
-        dir_name = current_app.config["BPMN_SPEC_ABSOLUTE_DIR"]
+        dir_name = current_app.config["SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"]
         # ensure this is a string - thanks mypy...
         return os.path.abspath(os.path.join(dir_name, ""))
 
@@ -66,7 +66,7 @@ class FileSystemService:
 
     @staticmethod
     def process_model_relative_path(spec: ProcessModelInfo) -> str:
-        """Get the file path to a process model relative to BPMN_SPEC_ABSOLUTE_DIR.
+        """Get the file path to a process model relative to SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR.
 
         If the full path is /path/to/process-group-a/group-b/process-model-a, it will return:
         process-group-a/group-b/process-model-a
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/git_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/git_service.py
index 3b8f518a4..37b04937a 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/services/git_service.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/git_service.py
@@ -37,7 +37,9 @@ class GitService:
     @classmethod
     def get_current_revision(cls) -> str:
         """Get_current_revision."""
-        bpmn_spec_absolute_dir = current_app.config["BPMN_SPEC_ABSOLUTE_DIR"]
+        bpmn_spec_absolute_dir = current_app.config[
+            "SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
+        ]
         # The value includes a carriage return character at the end, so we don't grab the last character
         with FileSystemService.cd(bpmn_spec_absolute_dir):
             return cls.run_shell_command_to_get_stdout(
@@ -52,7 +54,9 @@ class GitService:
         file_name: Optional[str] = None,
     ) -> str:
         """Get_instance_file_contents_for_revision."""
-        bpmn_spec_absolute_dir = current_app.config["BPMN_SPEC_ABSOLUTE_DIR"]
+        bpmn_spec_absolute_dir = current_app.config[
+            "SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
+        ]
         process_model_relative_path = FileSystemService.process_model_relative_path(
             process_model
         )
@@ -78,22 +82,29 @@ class GitService:
         cls.check_for_basic_configs()
         branch_name_to_use = branch_name
         if branch_name_to_use is None:
-            branch_name_to_use = current_app.config["GIT_BRANCH"]
+            branch_name_to_use = current_app.config["SPIFFWORKFLOW_BACKEND_GIT_BRANCH"]
         repo_path_to_use = repo_path
         if repo_path is None:
-            repo_path_to_use = current_app.config["BPMN_SPEC_ABSOLUTE_DIR"]
-        if repo_path_to_use is None:
-            raise ConfigurationError("BPMN_SPEC_ABSOLUTE_DIR config must be set")
-        if current_app.config["GIT_SSH_PRIVATE_KEY"]:
-            os.environ["GIT_SSH_PRIVATE_KEY"] = current_app.config[
-                "GIT_SSH_PRIVATE_KEY"
+            repo_path_to_use = current_app.config[
+                "SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
             ]
+        if repo_path_to_use is None:
+            raise ConfigurationError(
+                "SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR config must be set"
+            )
+        if current_app.config["SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY"]:
+            os.environ["SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY"] = (
+                current_app.config["SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY"]
+            )
 
         git_username = ""
         git_email = ""
-        if current_app.config["GIT_USERNAME"] and current_app.config["GIT_USER_EMAIL"]:
-            git_username = current_app.config["GIT_USERNAME"]
-            git_email = current_app.config["GIT_USER_EMAIL"]
+        if (
+            current_app.config["SPIFFWORKFLOW_BACKEND_GIT_USERNAME"]
+            and current_app.config["SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL"]
+        ):
+            git_username = current_app.config["SPIFFWORKFLOW_BACKEND_GIT_USERNAME"]
+            git_email = current_app.config["SPIFFWORKFLOW_BACKEND_GIT_USER_EMAIL"]
         shell_command_path = os.path.join(
             current_app.root_path, "..", "..", "bin", "git_commit_bpmn_models_repo"
         )
@@ -104,16 +115,16 @@ class GitService:
             branch_name_to_use,
             git_username,
             git_email,
-            current_app.config["GIT_USER_PASSWORD"],
+            current_app.config["SPIFFWORKFLOW_BACKEND_GIT_USER_PASSWORD"],
         ]
         return cls.run_shell_command_to_get_stdout(shell_command)
 
     @classmethod
     def check_for_basic_configs(cls) -> None:
         """Check_for_basic_configs."""
-        if current_app.config["GIT_BRANCH"] is None:
+        if current_app.config["SPIFFWORKFLOW_BACKEND_GIT_BRANCH"] is None:
             raise MissingGitConfigsError(
-                "Missing config for GIT_BRANCH. "
+                "Missing config for SPIFFWORKFLOW_BACKEND_GIT_BRANCH. "
                 "This is required for publishing process models"
             )
 
@@ -121,15 +132,18 @@ class GitService:
     def check_for_publish_configs(cls) -> None:
         """Check_for_configs."""
         cls.check_for_basic_configs()
-        if current_app.config["GIT_BRANCH_TO_PUBLISH_TO"] is None:
+        if current_app.config["SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO"] is None:
             raise MissingGitConfigsError(
-                "Missing config for GIT_BRANCH_TO_PUBLISH_TO. "
+                "Missing config for SPIFFWORKFLOW_BACKEND_GIT_BRANCH_TO_PUBLISH_TO. "
                 "This is required for publishing process models"
             )
-        if current_app.config["GIT_CLONE_URL_FOR_PUBLISHING"] is None:
+        if (
+            current_app.config["SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING"]
+            is None
+        ):
             raise MissingGitConfigsError(
-                "Missing config for GIT_CLONE_URL_FOR_PUBLISHING. "
-                "This is required for publishing process models"
+                "Missing config for SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING."
+                " This is required for publishing process models"
             )
 
     @classmethod
@@ -182,7 +196,10 @@ class GitService:
             )
 
         clone_url = webhook["repository"]["clone_url"]
-        if clone_url != current_app.config["GIT_CLONE_URL_FOR_PUBLISHING"]:
+        if (
+            clone_url
+            != current_app.config["SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING"]
+        ):
             raise GitCloneUrlMismatchError(
                 "Configured clone url does not match clone url from webhook:"
                 f" {clone_url}"
@@ -193,18 +210,20 @@ class GitService:
                 f"Could not find the 'ref' arg in the webhook boy: {webhook}"
             )
 
-        if current_app.config["GIT_BRANCH"] is None:
+        if current_app.config["SPIFFWORKFLOW_BACKEND_GIT_BRANCH"] is None:
             raise MissingGitConfigsError(
-                "Missing config for GIT_BRANCH. This is required for updating the"
-                " repository as a result of the webhook"
+                "Missing config for SPIFFWORKFLOW_BACKEND_GIT_BRANCH. This is required"
+                " for updating the repository as a result of the webhook"
             )
 
         ref = webhook["ref"]
-        git_branch = current_app.config["GIT_BRANCH"]
+        git_branch = current_app.config["SPIFFWORKFLOW_BACKEND_GIT_BRANCH"]
         if ref != f"refs/heads/{git_branch}":
             return False
 
-        with FileSystemService.cd(current_app.config["BPMN_SPEC_ABSOLUTE_DIR"]):
+        with FileSystemService.cd(
+            current_app.config["SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"]
+        ):
             cls.run_shell_command(["git", "pull"])
         return True
 
@@ -223,11 +242,13 @@ class GitService:
         # we are adding a guid to this so the flake8 issue has been mitigated
         destination_process_root = f"/tmp/{clone_dir}"  # noqa
 
-        git_clone_url = current_app.config["GIT_CLONE_URL_FOR_PUBLISHING"]
+        git_clone_url = current_app.config[
+            "SPIFFWORKFLOW_BACKEND_GIT_CLONE_URL_FOR_PUBLISHING"
+        ]
         if git_clone_url.startswith("https://"):
             git_clone_url = git_clone_url.replace(
                 "https://",
-                f"https://{current_app.config['GIT_USERNAME']}:{current_app.config['GIT_USER_PASSWORD']}@",
+                f"https://{current_app.config['SPIFFWORKFLOW_BACKEND_GIT_USERNAME']}:{current_app.config['SPIFFWORKFLOW_BACKEND_GIT_USER_PASSWORD']}@",
             )
         cmd = ["git", "clone", git_clone_url, destination_process_root]
 
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_processor.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_processor.py
index a1130d370..5aabe5acc 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_processor.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_processor.py
@@ -1301,7 +1301,9 @@ class ProcessInstanceProcessor:
         current_time_in_seconds = round(time.time())
         lock_expiry_in_seconds = (
             current_time_in_seconds
-            - current_app.config["ALLOW_CONFISCATING_LOCK_AFTER_SECONDS"]
+            - current_app.config[
+                "SPIFFWORKFLOW_BACKEND_ALLOW_CONFISCATING_LOCK_AFTER_SECONDS"
+            ]
         )
 
         query_text = text(
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/service_task_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/service_task_service.py
index 8d4fd43b4..5931989bc 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/services/service_task_service.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/service_task_service.py
@@ -18,7 +18,7 @@ class ConnectorProxyError(Exception):
 
 def connector_proxy_url() -> Any:
     """Returns the connector proxy url."""
-    return current_app.config["CONNECTOR_PROXY_URL"]
+    return current_app.config["SPIFFWORKFLOW_BACKEND_CONNECTOR_PROXY_URL"]
 
 
 class ServiceTaskDelegate: