Sandbox::https://github.com/inkeep/agents/blob/main/.env.example

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

# ============================================

# Inkeep Agents Environment Configuration

# ============================================

# This is the single source of truth for all environment variables in the monorepo.

# Setup Instructions:

# 1. Copy this file to .env and update values

# 3. For user-global settings across all repos, use ~/.inkeep/config

# Loading Priority (highest to lowest):

# 1. <path-to-package>/.env (package specific configuration)

# 2. .env (main configuration)

# 3. ~/.inkeep/config (user global settings)

# 4. .env.example (defaults shown here)

# ============ CORE ENVIRONMENT ============

# Environment mode: development | production | test

ENVIRONMENT=development

NODE_ENV=development

LOG_LEVEL=info

# ============ DATABASE ============

# Doltgres (PostgreSQL-compatible with Git version control)

INKEEP_AGENTS_MANAGE_DATABASE_URL=postgresql://appuser:password@localhost:5432/inkeep_agents

INKEEP_AGENTS_RUN_DATABASE_URL=postgresql://appuser:password@localhost:5433/inkeep_agents

# ============ API ENDPOINTS ============

# Management API (CRUD operations, configuration)

INKEEP_AGENTS_API_URL=http://localhost:3002

PUBLIC_INKEEP_AGENTS_API_URL=http://localhost:3002

# Port overrides for isolated/parallel dev environments (used by isolated-env.sh)

# AGENTS_API_PORT=3002

# MANAGE_UI_PORT=3000

# ============ TENANT CONFIGURATION ============

# Default tenant ID for development

TENANT_ID=default

# ============ AI PROVIDERS ============

# Required for agent execution

# Get your API keys from:

# Anthropic: https://console.anthropic.com/

# OpenAI: https://platform.openai.com/

ANTHROPIC_API_KEY=

OPENAI_API_KEY=

GOOGLE_GENERATIVE_AI_API_KEY=

# ============ PROMPT CACHING ============

# Deployment-level kill switch for Inkeep-attached Anthropic prompt caching at

# the main agent generation call sites. Default 'true' (caching enabled). Set

# to 'false' to disable globally — useful for A/B testing or self-host opt-out.

# Customer-set providerOptions.gateway.caching / providerOptions.anthropic.cacheControl

# still pass through to the model SDK unchanged when this is set to 'false'.

# INKEEP_PROMPT_CACHING_ENABLED=true

# ============ THIRD PARTY SERVICES ============

# Optional services (Nango, SigNoz, OTEL, Jaeger) are auto-configured by `pnpm setup-dev:optional`.

# You only need to set these manually if using cloud-hosted services.

# Nango (for MCP OAuth integrations)

NANGO_SECRET_KEY=

NANGO_SERVER_URL=http://localhost:3050

PUBLIC_NANGO_SERVER_URL=http://localhost:3050

PUBLIC_NANGO_CONNECT_BASE_URL=http://localhost:3051

# Nango for Slack App (separate from MCP integrations)

# Optional: Use a different Nango environment to isolate Slack auth from MCP auth

# If not set, falls back to NANGO_SECRET_KEY

# NANGO_SLACK_SECRET_KEY=

NANGO_SLACK_INTEGRATION_ID=

SIGNOZ_URL=http://localhost:3080

PUBLIC_SIGNOZ_URL=http://localhost:3080

SIGNOZ_API_KEY=

OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://localhost:14318/v1/traces

OTEL_SERVICE_NAME=inkeep-agents

# ============ MCP CONFIGURATION ============

# MCP OAuth Configuration

DEFAULT_OAUTH_CLIENT_ID=mcp-client

# OAuth Client Branding (customize OAuth consent screen)

OAUTH_CLIENT_NAME=Inkeep Agent Framework

OAUTH_CLIENT_URI=https://inkeep.com

OAUTH_CLIENT_LOGO_URI=https://inkeep.com/images/logos/inkeep-logo-blue.svg

# ============ Auth ==============

# Admin credentials for the Manage UI. Used by `pnpm db:auth:init` to create the admin user.

# In local development, the UI auto-logs in with these credentials — no manual sign-in needed.

INKEEP_AGENTS_MANAGE_UI_USERNAME=admin@example.com

INKEEP_AGENTS_MANAGE_UI_PASSWORD=change-me-Pass!@1234

BETTER_AUTH_SECRET=your-secret-key-change-in-production

SPICEDB_ENDPOINT=localhost:50051

SPICEDB_PRESHARED_KEY=dev-secret-key

# API bypass secret for local development and testing (skips auth)

INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET=test-bypass-secret-for-ci

# OAuth 2.1 client ID for the Support Copilot app (set after running `pnpm setup-oauth-client`)

# COPILOT_OAUTH_CLIENT_ID=

# Social sign-in providers (optional). When both client id and secret are set,

# the corresponding "Continue with X" button is enabled on the login screen.

# Google OAuth: https://console.cloud.google.com/apis/credentials

# PUBLIC_GOOGLE_CLIENT_ID=

# GOOGLE_CLIENT_SECRET=

# Microsoft Entra ID: https://portal.azure.com/ (App registrations)

# PUBLIC_MICROSOFT_CLIENT_ID=

# MICROSOFT_CLIENT_SECRET=

# Credential Gateway client for server-to-server token exchange (set after running `pnpm setup-gateway-client`)

# COPILOT_GATEWAY_CLIENT_ID=

# COPILOT_GATEWAY_CLIENT_SECRET=

# ========== SERVICE TOKENS ================

# INKEEP_AGENTS_JWT_SIGNING_SECRET=

# Anonymous session JWT secret (for end-user anonymous sessions via app credentials)

# Generate with: openssl rand -base64 32

# INKEEP_ANON_JWT_SECRET=

# Anonymous session lifetime in seconds (default: 2592000 = 30 days, min: 60, max: 2592000 = 30 days)

# INKEEP_ANON_SESSION_LIFETIME_SECONDS=2592000

# ALTCHA Sentinel (hosted bot protection) — enables Sentinel bot protection for widget-based auth flows.

# Verification fails open when Sentinel is unreachable so a Sentinel outage doesn't block widget users.

# Requires an upstream proxy that sets x-real-ip; client-supplied x-forwarded-for is intentionally ignored.

# INKEEP_SENTINEL_API_KEY_ID=

# Restricted-tier API key secret (min 32 chars) — required by /v1/verify/signature query-param auth.

# INKEEP_SENTINEL_API_KEY_SECRET=

# Sentinel base URL (e.g. https://challenges.inkeep.com for prod, https://challenges-staging.inkeep.com for staging)

# INKEEP_SENTINEL_BASE_URL=

# Legacy PoW v1 Security Group (no HIS) — backward compatibility for embedded widgets that predate the

# pow→sentinel rename. Enables GET /run/auth/pow/challenge; solutions verified locally with the v1 secret.

# Both must be set together; shares INKEEP_SENTINEL_BASE_URL.

# INKEEP_SENTINEL_V1_API_KEY_ID=

# INKEEP_SENTINEL_V1_API_KEY_SECRET=

# Cloud-only — server secret key for Google reCAPTCHA v3 verification.

# When set, registers the Better Auth captcha plugin on /sign-in/email,

# /sign-up/email, and /request-password-reset endpoints. Unset = kill-switch off.

# Get keys from: https://www.google.com/recaptcha/admin

# INKEEP_RECAPTCHA_SECRET_KEY=

# Minimum reCAPTCHA v3 score (0.0-1.0) required to pass. Default 0.5.

# Lower at runtime if false-positive rate is higher than expected.

# INKEEP_RECAPTCHA_MIN_SCORE=0.5

# Temporary JWT Keys for Playground (generate with scripts/generate-jwt-keys.sh)

# INKEEP_AGENTS_TEMP_JWT_PRIVATE_KEY=

# INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY=

# Global playground app ID (created by db:auth:init, defaults to app_playground)

# INKEEP_PLAYGROUND_APP_ID=app_playground

# ========== ANALYTICS TOKENS ================

# PUBLIC_POSTHOG_KEY=

# PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

# PUBLIC_POSTHOG_SITE_TAG=

# ========== GITHUB APP CONFIGURATION ================

# Required for GitHub OIDC token exchange endpoint (/api/github/token-exchange)

# Used to exchange GitHub Actions OIDC tokens for installation access tokens

# Get these from your GitHub App settings: https://github.com/settings/apps

# GITHUB_APP_ID=123456

# GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

# Required for GitHub webhook verification (POST /api/github/webhooks)

# Used to verify webhook payloads from GitHub using HMAC-SHA256

# Get this from your GitHub App settings > Webhook > Secret

# GITHUB_WEBHOOK_SECRET=your-webhook-secret-here

# Required for GitHub App installation flow (GET /manage/tenants/:tenantId/github/install-url)

# Used to sign state JWT for OAuth-style installation flow (must be at least 32 characters)

# Generate with: openssl rand -base64 32

# GITHUB_STATE_SIGNING_SECRET=your-32-char-secret-here

# GitHub App name as shown in the URL: https://github.com/apps/{app-name}

# Used to generate the installation URL for GitHub App

# GITHUB_APP_NAME=your-github-app-name

# ============ EMAIL CONFIGURATION (Optional) ============

# When not configured, invitation links and password reset links

# are shown in the UI for manual sharing. Email is not required.

# Option 1: Resend (recommended for cloud deployments)

# RESEND_API_KEY=re_xxxxx

# Option 2: Generic SMTP (self-hosted, Mailgun, SendGrid, etc.)

SMTP_HOST=localhost

SMTP_PORT=1025

# SMTP_USER=

# SMTP_PASSWORD=

# SMTP_SECURE=false

# From address and display name

SMTP_FROM_ADDRESS=notifications@updates.inkeep.com

SMTP_FROM_NAME=Inkeep

# Reply-to address (optional, defaults to from address)

# SMTP_REPLY_TO=support@inkeep.com

# ============ COPILOT (Chat-to-Edit) ============

# Manage-UI: project-scoped app credential + JWT signing for copilot

# Generate keys with: pnpm generate:keys copilot

# PUBLIC_INKEEP_COPILOT_APP_ID=

# INKEEP_COPILOT_JWT_PRIVATE_KEY=

# INKEEP_COPILOT_JWT_KID=

# ============ FEATURE FLAGS ============

# Enable Work Apps section in the dashboard (Slack, etc.)

# On Inkeep Cloud, this is managed automatically per tenant.

# NEXT_PUBLIC_ENABLE_WORK_APPS=true

# ============ SLACK APP CONFIGURATION ============

# Get credentials from: https://api.slack.com/apps → Your App → Basic Information

# SLACK_CLIENT_ID=

# SLACK_CLIENT_SECRET=

# SLACK_SIGNING_SECRET=

# Your public URL for OAuth redirect (use ngrok for local dev)

# SLACK_APP_URL=https://your-app.ngrok.app

# UI URL for redirect after OAuth completes

# INKEEP_AGENTS_MANAGE_UI_URL=http://localhost:3000

# ============ SLACK SOCKET MODE (Local Development) ============

# Socket Mode lets you receive Slack events over WebSocket — no tunnel or public URL needed.

# Each developer needs their own Slack app with Socket Mode enabled.

# Run `pnpm setup-slack-dev` for guided setup, or see docs for manual setup.

# SLACK_APP_TOKEN=xapp-...

# SLACK_MCP_API_KEY=

# ============ SLACK EXECUTION MODE OVERRIDE ============

# When unset (or "false"), the Slack work-app forces executionMode="durable" on

# every /run/api/chat request, routing agent runs through Vercel Workflow.

# Set to "true" to disable that override and let each agent's own configured

# executionMode take effect. Workaround for the 2-minute idle stream timeout

# bug in older @workflow/world-vercel SDK versions where long sub-agent

# delegations or quiet long-running tools cause the stream to close silently.

# INKEEP_SLACK_DISABLE_DURABLE_EXECUTION=true

# ============ SENTRY (Error Monitoring) ============

# Optional: Sentry DSN for error monitoring. No-ops when not set.

# SENTRY_DSN=

# ============ BLOB STORAGE ============

# Used for persisting images and media from conversations.

# Provider selection order:

# 1) S3 when BLOB_STORAGE_S3_BUCKET is set

# May use any S3 compatible storage (AWS S3, Cloudflare R2, Google Cloud, Backblaze B2, DigitalOcean Spaces, etc.)

# 2) Vercel Blob when BLOB_READ_WRITE_TOKEN is set

# 3) Local filesystem fallback when neither of the above are set. Set BLOB_STORAGE_LOCAL_PATH to override default path for this directory.

# ===== Local filesystem configuration =====

BLOB_STORAGE_LOCAL_PATH=.blob-storage

# ===== Vercel Blob configuration =====

# BLOB_READ_WRITE_TOKEN=

# ===== S3 configuration =====

# Required for AWS S3:

# BLOB_STORAGE_S3_BUCKET=

# BLOB_STORAGE_S3_REGION=

# BLOB_STORAGE_S3_ACCESS_KEY_ID=

# BLOB_STORAGE_S3_SECRET_ACCESS_KEY=

# Optional for AWS S3 (may be required for S3-compatible providers):

# Custom endpoint URL. Often required for non-AWS providers (R2, MinIO, B2, Spaces, etc.).

# BLOB_STORAGE_S3_ENDPOINT=

# Path-style URLs. Default false for AWS S3. Some S3-compatible providers require true.

# BLOB_STORAGE_S3_FORCE_PATH_STYLE=false

# Expiry in seconds for S3 presigned media URLs. Default 7200 (2 hours). Range: 60–604800.

# BLOB_STORAGE_PRESIGNED_URL_EXPIRY_SECONDS=7200

FilesExpand file tree

.env.example

Latest commit

History

.env.example

File metadata and controls