Configuration Reference

The complete environment variable and secrets reference for the server, worker, web, and migration components.

This page is the authoritative reference for every environment variable the platform reads, split into non-secret configuration and secrets.

How configuration reaches the pods

There are two channels, and they are separate on purpose:

Non-secret configuration is set per component under server.config, web.config, and worker.config in your Helm values. The chart renders these directly as environment variables on the corresponding pods. The server and web pods also receive PORT automatically.
Secrets live in your cloud secrets manager and are synchronized into a Kubernetes Secret (see Secrets). You attach that Secret to each component with server.envFrom, worker.envFrom, and web.envFrom.

The chart does not attach the secret to pods for you. If envFrom is not set on a component, that component starts without its secrets and will fail to reach the database. Make sure the secret name in envFrom matches the secret you actually created.

Most helm_config_values (the non-secret cloud wiring: bucket names, KMS key references, region, scheduler ARNs, auth pool IDs) are emitted directly by Terraform as an output you can feed into *.config. See Terraform.

Server configuration

Required (all clouds)

Variable	Description
`CLOUD_PROVIDER`	`aws` or `gcp`
`SERVERLESS_ENVIRONMENT`	`true` or `false` (self-hosted is `false`)
`AUTH_PROVIDER`	`firebase` or `cognito`
`SERVER_URL`	Public URL of the API
`WEB_URL`	Public URL of the web app
`SYSTEM_ADMIN_EMAILS`	Comma-separated list of system administrator emails
`SCHEDULER_SERVICE_URL`	Callback URL scheduled jobs invoke
`STORAGE_USER_FILES_BUCKET`	User files bucket name
`STORAGE_DOCUMENTS_BUCKET`	Documents bucket name
`STORAGE_TENANT_MIGRATIONS_BUCKET`	Tenant migrations bucket name
`STORAGE_EXPORTS_BUCKET`	Exports bucket name
`KMS_SECRETS_KEYRING`, `KMS_SECRETS_KEY`	KMS keyring/key for secret encryption
`KMS_CONNECTIONS_KEYRING`, `KMS_CONNECTIONS_KEY`	KMS keyring/key for connection credentials
`KMS_ENVIRONMENT_KEYRING`, `KMS_ENVIRONMENT_KEY`	KMS keyring/key for environment data

Required on AWS

AWS_REGION, AWS_COGNITO_USER_POOL_ID, AWS_COGNITO_REGION, AWS_SCHEDULER_EVENT_SOURCE, AWS_SCHEDULER_GROUP_NAME, AWS_SCHEDULER_ROLE_ARN, AWS_SCHEDULER_TARGET_ARN.

Required on GCP

GOOGLE_CLOUD_PROJECT, GCP_REGION, GCP_SERVICE_ACCOUNT, KMS_LOCATION_ID.

Required when using Firebase auth

FIREBASE_API_KEY, FIREBASE_AUTH_DOMAIN, FIREBASE_PROJECT_ID, FIREBASE_STORAGE_BUCKET, FIREBASE_MESSAGING_SENDER_ID, FIREBASE_APP_ID, FIREBASE_MEASUREMENT_ID.

Optional

Variable	Default	Description
`SELF_HOSTING`	`false`	Restricts tenant deletion to a superuser; single-org mode
`LOG_LEVEL`	`info`	Log verbosity: `trace`, `debug`, `info`, `warn`, `error`, `fatal`. Step-by-step tracing is logged at `debug`, so `info` keeps normal operation quiet. Raise to `debug` to diagnose, then lower it again — `debug` is very verbose on hot paths.
`TEMPORAL_HOST`		Temporal endpoint host:port
`TEMPORAL_NAMESPACE`		Temporal namespace
`TEMPORAL_TASK_QUEUE`		Task queue name
`TEMPORAL_TLS`	`false`	Enable TLS to Temporal
`TEMPORAL_TLS_CA`, `TEMPORAL_TLS_CERT`		mTLS CA and client cert paths
`REDIS_HOST`		Enables the centralized cache (cross-instance AI rate limiting and env-change cache invalidation). Active only when set and `SERVERLESS_ENVIRONMENT=false`
`REDIS_PORT`	`6379`
`REDIS_TLS`	`false`
`REDIS_USERNAME`		Redis 6+ ACL user. Leave unset to authenticate as the default user
`DEFAULT_LLM_MODEL_FAMILY`	`haiku`	One of `haiku`, `sonnet`, `gpt`, `gpt-mini`, `gemini-pro`, `gemini-flash`, `kimi`, `glm`
`VECTOR_EMBEDDING_PROVIDER`	`openai`	`openai`, `azure`, or `bedrock`
`VECTOR_EMBEDDING_MODEL`	`text-embedding-3-small`
`VECTOR_EMBEDDING_API_ENDPOINT`		Azure endpoint
`VECTOR_EMBEDDING_REGION`		Bedrock region (falls back to `AWS_REGION`)
`VECTOR_EMBEDDING_DIMENSIONS`		For models that support configurable dimensions

Worker configuration

The worker runs activities; it does not serve the UI or handle auth, so it needs a smaller set.

Required (all clouds)

CLOUD_PROVIDER, SERVERLESS_ENVIRONMENT, SERVER_URL, STORAGE_USER_FILES_BUCKET, STORAGE_DOCUMENTS_BUCKET, STORAGE_TENANT_MIGRATIONS_BUCKET, and the six KMS_*_KEYRING / KMS_*_KEY variables (secrets, connections, environment).

Cloud-specific

AWS: AWS_REGION.
GCP: GOOGLE_CLOUD_PROJECT, GCP_REGION, GCP_SERVICE_ACCOUNT, KMS_LOCATION_ID.

Optional

The Temporal group (TEMPORAL_HOST, TEMPORAL_NAMESPACE, TEMPORAL_TASK_QUEUE, TEMPORAL_TLS, TEMPORAL_TLS_CA, TEMPORAL_TLS_CERT), the Redis group (REDIS_HOST, REDIS_PORT, REDIS_TLS, REDIS_USERNAME), and DEFAULT_LLM_MODEL_FAMILY.

Web configuration

Required

Variable	Description
`AUTH_PROVIDER`	`firebase` or `cognito`
`SERVER_URL`	Public URL of the API
`WEB_URL`	Public URL of the web app
`SYSTEM_ADMIN_EMAILS`	Comma-separated administrator emails

Cloud-specific

AWS (Cognito): AWS_COGNITO_USER_POOL_ID, AWS_COGNITO_CLIENT_ID, AWS_COGNITO_DOMAIN.
Firebase: the same seven FIREBASE_* variables as the server.

Optional

Variable	Default	Description
`TEMPORAL_WORKFLOW_URL`		Temporal UI URL for deep links
`SELF_HOSTING`	`false`	Hides tenant/user switching and invitations
`LOGIN_EMAIL_PASSWORD_ENABLED`	`true`	Email/password login
`LOGIN_GOOGLE_ENABLED`	`false`	Google OAuth login
`LOGIN_MICROSOFT_ENABLED`	`false`	Microsoft OAuth login
`LOGIN_OKTA_ENABLED`	`false`	Okta OIDC login

Secrets

Secrets are supplied through the secret channel, not *.config. Two are required; the rest are optional and only needed for the features that use them.

Required (server and worker)

Secret	Description
`PG_BASE_URL`	PostgreSQL connection URL, for example `postgresql://user:pass@host:5432/workflows?sslmode=require`
`TEMPORAL_API_KEY`	Temporal Cloud API key (or use mTLS certs instead)

Optional (provider and integration keys)

LLM providers: OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, DEEPSEEK_API_KEY, CEREBRAS_API_KEY, MOONSHOTAI_API_KEY, ZHIPU_API_KEY.

Embeddings: VECTOR_EMBEDDING_API_KEY (falls back to OPENAI_API_KEY).

Tools and integrations: GOOGLE_MAPS_API_KEY, BRAVE_SEARCH_API_KEY, AIRTABLE_API_KEY, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET, TWILIO_ACCOUNT_SID, TWILIO_API_KEY_SID, TWILIO_API_KEY_SECRET, TWILIO_AUTH_TOKEN, TWILIO_PHONE_NUMBER, RESEND_API_KEY, SENDGRID_API_KEY, ELEVENLABS_API_KEY.

Provisioning (multi-tenant Neon setups): NEON_API_KEY, NEON_PROJECT, NEON_BRANCH, NEON_OWNER_NAME.

Other: SYSTEM_DB_NAME (defaults to system), REDIS_PASSWORD (only if your Redis requires auth).

The web component only reads one optional secret, ELEVENLABS_API_KEY (for the voice feature). All other secrets are consumed by the server and worker.

Migration job configuration

The migration job connects to PostgreSQL and applies schema changes. It reads a minimal set:

Variable	Required	Description
`PG_BASE_URL`	Yes	PostgreSQL URL without a database name, for example `postgresql://user:pass@host:5432`
`SYSTEM_DB_NAME`	No	Database name, defaults to `system`
`SEED_DATA`	No	JSON describing tenants and accounts to seed on first run

Seeding users requires the auth provider to be reachable: on Cognito set AUTH_PROVIDER=cognito, AWS_COGNITO_USER_POOL_ID, and AWS_COGNITO_REGION; on Firebase set AUTH_PROVIDER=firebase and GOOGLE_APPLICATION_CREDENTIALS (path to a service account JSON). Seed operations are upserts, so re-running is safe.

On this page