Configuration

The entire stack is configured from one .env file at the repository root. You create it in the Quickstart by copying .env.example and replacing the REPLACE_ME_OPENSSL_* placeholders with generated secrets. Every option is documented inline in .env.example — this page covers the structure and the settings you’re most likely to change.

How values chain

Docker Compose interpolates the file in order, so derived values build on earlier ones — ports feed base URLs, base URLs feed callback and CORS URLs:

PLATFORM_API_PORT=3000
PLATFORM_API_BASE_URL="http://localhost:${PLATFORM_API_PORT}"
PLATFORM_API_ALLOW_ORIGINS="${PLATFORM_UI_BASE_URL}"
CREDENTIAL_OAUTH_OAUTH2_REDIRECT_URL="${PLATFORM_API_BASE_URL}/credential-oauth/oauth2/callback"

Change a value at the top of a chain and everything downstream follows. Service ports are fixed inside the containers (3000/3100/3200/3300/4000); container-to-container URLs use compose service names, browser-facing URLs use localhost.

Local-friendly defaults

Out of the box everything works without any external accounts:

• Email — EMAIL_SENDER_PROVIDER=log: emails (magic links, verifications) are written to the service logs instead of being sent. Switch to smtp, resend, or sendgrid for real delivery.
• File storage — FILE_GATEWAY_STORAGE_DRIVER=local: uploads go to the container filesystem. s3 (any S3-compatible store) and bunny (Bunny.net) are also supported.
• AI generation — WORKFLOWS_GENERATION_ENABLED=false: generating workflows from a chat prompt is off until you configure an LLM provider.

Settings you’ll likely change

AI features

Two features use an LLM and are configured independently, each supporting gemini or local (any OpenAI-compatible endpoint, e.g. LM Studio):

• Function calling (FUNCTION_CALLING_*) — powers “describe it, don’t configure it”: filling node parameters from natural-language instructions.
• Workflow generation (WORKFLOWS_GENERATION_*) — generating whole workflows from a chat prompt; set WORKFLOWS_GENERATION_ENABLED=true and provide an API key.

OAuth integrations

Nodes that authenticate via OAuth (Google, Slack, Discord, …) need an OAuth app per provider. Set the provider’s client ID/secret in .env; the callback URL is derived from PLATFORM_API_BASE_URL (.../credential-oauth/oauth2/callback). API-key based credentials need no configuration — users paste their keys in the UI.

MCP

mcp-api serves the MCP servers and the OAuth 2.1 authorization server MCP clients sign in through. MCP_SERVER_URL_TEMPLATE is the public URL of one server ({serverId} is substituted); MCP_OAUTH_ISSUER_URL and MCP_OAUTH_RESOURCE_URL are the public base URL of mcp-api; MCP_OAUTH_CONSENT_URL_TEMPLATE points at the consent page of the web UI ({requestId} is substituted). All three must be reachable by the user’s browser and by the MCP client, so behind a reverse proxy they carry the published hostnames, not localhost. MCP_OAUTH_SIGNING_KEY signs access tokens (generated by the setup script); the *_TTL values bound access tokens, refresh tokens, authorization codes and pending consents. See Using the MCP server.

Backing services

CACHE_TYPE, BROKER_TYPE, TASK_RUNNER_LEADER_PROVIDER and SEMAPHORE_PROVIDER each accept memory (the default — state lives in the process, which is what a single instance wants) or redis (shared across instances). Compose starts a backing service only when something is configured to use it, so a default install runs no Redis at all. See Scaling out.

Task runner

TASK_RUNNER_MODE selects how workflows execute:

• embedded (default) — execution runs inside platform-api; fewer moving parts, and no queue to operate.
• queue — tasks go through a Redis Streams queue consumed by task-worker; scale workers independently.

Keeping .env in sync

After pulling a new version, diff your .env against .env.example for new options. Values are read once at container start — restart the stack after changing them.