.env.example

# ============================================
# Inkeep Agents Environment Configuration
# ============================================
# This is the single source of truth for all environment variables in the monorepo.
#
# Setup Instructions:
# 1. Copy this file to .env and update values
# 3. For user-global settings across all repos, use ~/.inkeep/config
#
# Loading Priority (highest to lowest):
# 1. <path-to-package>/.env (package specific configuration)
# 2. .env (main configuration)
# 3. ~/.inkeep/config (user global settings)
# 4. .env.example (defaults shown here)

# ============ CORE ENVIRONMENT ============
# Environment mode: development | production | test
ENVIRONMENT=development
NODE_ENV=development
LOG_LEVEL=info

# ============ DATABASE ============
# Doltgres (PostgreSQL-compatible with Git version control)
INKEEP_AGENTS_MANAGE_DATABASE_URL=postgresql://appuser:password@localhost:5432/inkeep_agents
INKEEP_AGENTS_RUN_DATABASE_URL=postgresql://appuser:password@localhost:5433/inkeep_agents

# ============ API ENDPOINTS ============
# Management API (CRUD operations, configuration)
INKEEP_AGENTS_API_URL=http://localhost:3002
PUBLIC_INKEEP_AGENTS_API_URL=http://localhost:3002
# Port overrides for isolated/parallel dev environments (used by isolated-env.sh)
# AGENTS_API_PORT=3002
# MANAGE_UI_PORT=3000

# ============ TENANT CONFIGURATION ============
# Default tenant ID for development
TENANT_ID=default

# ============ AI PROVIDERS ============
# Required for agent execution
# Get your API keys from:
# Anthropic: https://console.anthropic.com/
# OpenAI: https://platform.openai.com/
ANTHROPIC_API_KEY=
OPENAI_API_KEY=
GOOGLE_GENERATIVE_AI_API_KEY=

# ============ THIRD PARTY SERVICES ============
# Optional services (Nango, SigNoz, OTEL, Jaeger) are auto-configured by `pnpm setup-dev:optional`.
# You only need to set these manually if using cloud-hosted services.

# Nango (for MCP OAuth integrations)
NANGO_SECRET_KEY=
NANGO_SERVER_URL=http://localhost:3050
PUBLIC_NANGO_SERVER_URL=http://localhost:3050
PUBLIC_NANGO_CONNECT_BASE_URL=http://localhost:3051

# Nango for Slack App (separate from MCP integrations)
# Optional: Use a different Nango environment to isolate Slack auth from MCP auth
# If not set, falls back to NANGO_SECRET_KEY
# NANGO_SLACK_SECRET_KEY=
NANGO_SLACK_INTEGRATION_ID=

SIGNOZ_URL=http://localhost:3080
PUBLIC_SIGNOZ_URL=http://localhost:3080
SIGNOZ_API_KEY=
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://localhost:14318/v1/traces
OTEL_SERVICE_NAME=inkeep-agents

# ============ MCP CONFIGURATION ============
# MCP OAuth Configuration
DEFAULT_OAUTH_CLIENT_ID=mcp-client

# OAuth Client Branding (customize OAuth consent screen)
OAUTH_CLIENT_NAME=Inkeep Agent Framework
OAUTH_CLIENT_URI=https://inkeep.com
OAUTH_CLIENT_LOGO_URI=https://inkeep.com/images/logos/inkeep-logo-blue.svg

# ============ Auth ==============
# Admin credentials for the Manage UI. Used by `pnpm db:auth:init` to create the admin user.
# In local development, the UI auto-logs in with these credentials — no manual sign-in needed.
INKEEP_AGENTS_MANAGE_UI_USERNAME=admin@example.com
INKEEP_AGENTS_MANAGE_UI_PASSWORD=adminADMIN!@12
BETTER_AUTH_SECRET=your-secret-key-change-in-production
SPICEDB_ENDPOINT=localhost:50051
SPICEDB_PRESHARED_KEY=dev-secret-key

# API bypass secret for local development and testing (skips auth)
INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET=test-bypass-secret-for-ci

# ========== SERVICE TOKENS ================
# INKEEP_AGENTS_JWT_SIGNING_SECRET=

# Anonymous session JWT secret (for end-user anonymous sessions via app credentials)
# Generate with: openssl rand -base64 32
# INKEEP_ANON_JWT_SECRET=
# Anonymous session lifetime in seconds (default: 2592000 = 30 days, min: 60, max: 2592000 = 30 days)
# INKEEP_ANON_SESSION_LIFETIME_SECONDS=2592000

# Proof-of-Work (ALTCHA) — enables PoW challenges for web_client apps
# Generate with: openssl rand -base64 32
# INKEEP_POW_HMAC_SECRET=
# PoW difficulty (maxnumber for challenge). Default: 50000
# INKEEP_POW_DIFFICULTY=50000
# PoW challenge expiry in seconds (min: 60, max: 3600). Default: 3600 (1 hour)
# INKEEP_POW_CHALLENGE_TTL_SECONDS=3600

# Temporary JWT Keys for Playground (generate with scripts/generate-jwt-keys.sh)
# INKEEP_AGENTS_TEMP_JWT_PRIVATE_KEY=
# INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY=
# Global playground app ID (created by db:auth:init, defaults to app_playground)
# INKEEP_PLAYGROUND_APP_ID=app_playground

# ========== ANALYTICS TOKENS ================
# PUBLIC_POSTHOG_KEY=
# PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
# PUBLIC_POSTHOG_SITE_TAG=

# ========== GITHUB APP CONFIGURATION ================
# Required for GitHub OIDC token exchange endpoint (/api/github/token-exchange)
# Used to exchange GitHub Actions OIDC tokens for installation access tokens
# Get these from your GitHub App settings: https://github.com/settings/apps
# GITHUB_APP_ID=123456
# GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

# Required for GitHub webhook verification (POST /api/github/webhooks)
# Used to verify webhook payloads from GitHub using HMAC-SHA256
# Get this from your GitHub App settings > Webhook > Secret
# GITHUB_WEBHOOK_SECRET=your-webhook-secret-here

# Required for GitHub App installation flow (GET /manage/tenants/:tenantId/github/install-url)
# Used to sign state JWT for OAuth-style installation flow (must be at least 32 characters)
# Generate with: openssl rand -base64 32
# GITHUB_STATE_SIGNING_SECRET=your-32-char-secret-here

# GitHub App name as shown in the URL: https://github.com/apps/{app-name}
# Used to generate the installation URL for GitHub App
# GITHUB_APP_NAME=your-github-app-name

# ============ EMAIL CONFIGURATION (Optional) ============
# When not configured, invitation links and password reset links
# are shown in the UI for manual sharing. Email is not required.

# Option 1: Resend (recommended for cloud deployments)
# RESEND_API_KEY=re_xxxxx

# Option 2: Generic SMTP (self-hosted, Mailgun, SendGrid, etc.)
SMTP_HOST=localhost
SMTP_PORT=1025
# SMTP_USER=
# SMTP_PASSWORD=
# SMTP_SECURE=false

# From address and display name
SMTP_FROM_ADDRESS=notifications@updates.inkeep.com
SMTP_FROM_NAME=Inkeep

# Reply-to address (optional, defaults to from address)
# SMTP_REPLY_TO=support@inkeep.com

# ============ COPILOT (Chat-to-Edit) ============
# When set, any authenticated user can access the copilot agent
# without being a member of its tenant or having SpiceDB permissions.
# INKEEP_COPILOT_TENANT_ID=
# INKEEP_COPILOT_PROJECT_ID=
# INKEEP_COPILOT_AGENT_ID=

# ============ FEATURE FLAGS ============
# Enable Work Apps section in the dashboard (Slack, etc.)
# On Inkeep Cloud, this is managed automatically per tenant.
# NEXT_PUBLIC_ENABLE_WORK_APPS=true

# ============ SLACK APP CONFIGURATION ============
# Get credentials from: https://api.slack.com/apps → Your App → Basic Information
# SLACK_CLIENT_ID=
# SLACK_CLIENT_SECRET=
# SLACK_SIGNING_SECRET=
# Your public URL for OAuth redirect (use ngrok for local dev)
# SLACK_APP_URL=https://your-app.ngrok.app
# UI URL for redirect after OAuth completes
# INKEEP_AGENTS_MANAGE_UI_URL=http://localhost:3000

# ============ SLACK SOCKET MODE (Local Development) ============
# Socket Mode lets you receive Slack events over WebSocket — no tunnel or public URL needed.
# Each developer needs their own Slack app with Socket Mode enabled.
# Run `pnpm setup-slack-dev` for guided setup, or see docs for manual setup.
# SLACK_APP_TOKEN=xapp-...
# SLACK_MCP_API_KEY=

# ============ SENTRY (Error Monitoring) ============
# Optional: Sentry DSN for error monitoring. No-ops when not set.
# SENTRY_DSN=

# ============ BLOB STORAGE ============
# Used for persisting images and media from conversations.
# Provider selection order:
# 1) S3 when BLOB_STORAGE_S3_BUCKET is set
#    May use any S3 compatible storage (AWS S3, Cloudflare R2, Google Cloud, Backblaze B2, DigitalOcean Spaces, etc.)
# 2) Vercel Blob when BLOB_READ_WRITE_TOKEN is set
# 3) Local filesystem fallback when neither of the above are set. Set BLOB_STORAGE_LOCAL_PATH to override default path for this directory.
# ===== Local filesystem configuration =====
BLOB_STORAGE_LOCAL_PATH=.blob-storage
# ===== Vercel Blob configuration =====
# BLOB_READ_WRITE_TOKEN=
# ===== S3 configuration =====
# Required for AWS S3:
# BLOB_STORAGE_S3_BUCKET=
# BLOB_STORAGE_S3_REGION=
# BLOB_STORAGE_S3_ACCESS_KEY_ID=
# BLOB_STORAGE_S3_SECRET_ACCESS_KEY=
# Optional for AWS S3 (may be required for S3-compatible providers):
# Custom endpoint URL. Often required for non-AWS providers (R2, MinIO, B2, Spaces, etc.).
# BLOB_STORAGE_S3_ENDPOINT=
# Path-style URLs. Default false for AWS S3. Some S3-compatible providers require true.
# BLOB_STORAGE_S3_FORCE_PATH_STYLE=false