OrcFlows is configured entirely through environment variables, loaded from a .env file in the project root (via Viper). Copy .env.example to .env and adjust as needed. All values below have working local defaults — you only need to set what your workflows actually use.
App & server
| Variable | Default | Description |
|---|
APP_ENV | development | development or production. Affects logging and error verbosity. |
SERVER_PORT | 3001 | Port the API server listens on. |
GRPC_PORT | :50051 | Port for the internal gRPC server. |
Database & cache
| Variable | Default | Description |
|---|
DATABASE_URL | postgres://goagents:goagents@localhost:5433/goagents?sslmode=disable | PostgreSQL connection string. Stores tenants, users, workflows, executions metadata, secrets (encrypted), knowledge bases, and embeddings. |
REDIS_URL | redis://localhost:6380 | Used for caching and rate limiting. |
Temporal (durable execution)
| Variable | Default | Description |
|---|
TEMPORAL_HOST_PORT | localhost:7233 | Temporal server address. |
TEMPORAL_NAMESPACE | default | Temporal namespace for this deployment. |
TEMPORAL_TASK_QUEUE | goagents-main | Task queue the worker polls and the API enqueues to. |
TEMPORAL_ENCRYPTION_KEY | (none) | Optional base64-encoded 32-byte AES-256 key (openssl rand -base64 32) to encrypt workflow payloads at rest in Temporal's datastore. |
Auth (JWT)
| Variable | Default | Description |
|---|
JWT_SECRET | (must change) | Signing secret for session JWTs. Must be 32+ characters in production — also used to derive the AES-256 key that encrypts secrets in Postgres. |
JWT_EXPIRY_HOURS | 24 | Session token lifetime. |
Observability
| Variable | Default | Description |
|---|
OTEL_ENABLED | false | Enable OpenTelemetry tracing/metrics export. |
OTEL_EXPORTER_OTLP_ENDPOINT | http://localhost:4318 | OTLP collector endpoint. |
LLM providers
LLM and Agent nodes can use credentials configured per-workflow via the Secrets UI, or fall back to platform-level keys:
| Variable | Description |
|---|
ANTHROPIC_API_KEY | Default Claude API key for LLM/Agent nodes and the AI Workflow Generator. |
OPENAI_API_KEY | Default OpenAI API key. |
OrcFlows also supports NVIDIA NIM (https://integrate.api.nvidia.com/v1) as a model provider — configure via a secret named for the connector rather than an env var. See AI Agents & Tools.
OAuth providers
OrcFlows ships first-class OAuth integrations for connectors and "Sign in with X". Each provider needs its own app registration with the provider's developer console, using the redirect URLs below (adjust the host for production).
Google (Gmail, Sheets, Calendar, Drive + Sign-in)
| Variable | Default | Description |
|---|
GOOGLE_CLIENT_ID | (none) | OAuth client ID. |
GOOGLE_CLIENT_SECRET | (none) | OAuth client secret. |
GOOGLE_REDIRECT_URL | http://localhost:3001/api/v1/oauth/google/callback | Callback for connecting Google connectors (Gmail, Sheets, Calendar, Drive). |
GOOGLE_AUTH_REDIRECT_URL | http://localhost:3001/api/v1/auth/google/callback | Separate callback for "Sign in / up with Google" — register both redirect URIs with the same OAuth client. |
Google tokens expire and are refreshed automatically using the stored refresh_token.
Notion
| Variable | Default | Description |
|---|
NOTION_CLIENT_ID | (none) | OAuth client ID. |
NOTION_CLIENT_SECRET | (none) | OAuth client secret. |
NOTION_REDIRECT_URL | http://localhost:3001/api/v1/oauth/notion/callback | Callback URL — workspace-level access, tokens never expire. |
Slack
| Variable | Default | Description |
|---|
SLACK_CLIENT_ID | (none) | OAuth client ID. |
SLACK_CLIENT_SECRET | (none) | OAuth client secret. |
SLACK_REDIRECT_URL | http://localhost:3001/api/v1/oauth/slack/callback | Callback URL — issues a bot token (xoxb-...) that never expires. |
All three providers share a single oauth_connections table. GET /api/v1/oauth/status reports whether each provider is configured, and the Settings → Connections tab shows a "Connect" button for each.
SSO (SAML/OIDC, Enterprise plan)
| Variable | Default | Description |
|---|
SSO_REDIRECT_URL | http://localhost:3001/api/v1/auth/sso/callback | Callback URL registered with your identity provider. |
SSO_FRONTEND_URL | http://localhost:5173 | Where users land after a successful SSO login. |
SSO configuration itself (per-tenant IdP metadata) is managed via /api/v1/sso/config, restricted to the tenant owner, and gated behind the Enterprise plan (sso_enabled in plan limits).
GitHub
| Variable | Default | Description |
|---|
GITHUB_TOKEN | (none) | Optional personal access token used by the GitHub connector to raise the unauthenticated API rate limit from 10 to 5,000 requests/hour. |
Browser automation
| Variable | Default | Description |
|---|
PLAYWRIGHT_WS_ENDPOINT | http://127.0.0.1:9222 | CDP WebSocket endpoint of a remote Chromium instance (the chromium container) used by browser-automation agent tools. |
Knowledge Base / vector search
| Variable | Default | Description |
|---|
WEAVIATE_URL | http://localhost:8082 | Weaviate endpoint for enterprise-grade ANN vector search. By default, OrcFlows uses its own Postgres float4[] embeddings with a cosine_similarity SQL function — no extra service required. |
Workspace file storage (S3 / MinIO)
| Variable | Default | Description |
|---|
S3_ENDPOINT | http://localhost:9000 | S3-compatible endpoint. Leave empty to use real AWS S3. |
S3_BUCKET | goagents-workspaces | Bucket for files generated/used during workflow runs (PDFs, screenshots, uploads). |
S3_REGION | us-east-1 | Bucket region. |
S3_ACCESS_KEY / S3_SECRET_KEY | goagents / goagents-secret | Credentials. |
S3_USE_PATH_STYLE | true | Path-style addressing (required for MinIO; set false for AWS). |
Billing (Stripe)
| Variable | Description |
|---|
STRIPE_SECRET_KEY | Enables platform billing. Without it, all tenants stay on the Free plan and upgrade is disabled. |
STRIPE_WEBHOOK_SECRET | Verifies /webhooks/stripe signatures. |
STRIPE_PRICE_ID_PRO / STRIPE_PRICE_ID_ENTERPRISE | Stripe Price IDs for the Pro and Enterprise plans. |
STRIPE_SUCCESS_URL / STRIPE_CANCEL_URL / STRIPE_PORTAL_RETURN_URL | Frontend redirect URLs after checkout/portal sessions. |
See Billing & Plans for the plan ladder.
LiveKit (real-time voice)
| Variable | Description |
|---|
LIVEKIT_API_KEY / LIVEKIT_API_SECRET | Credentials for your LiveKit server (cloud or self-hosted). |
LIVEKIT_WS_URL | wss://... — used by client SDKs to join rooms. |
LIVEKIT_HTTP_URL | https://... — used by server-side REST calls (token generation, egress, SIP, dispatch). |
Required for any livekit-* node and the /webhooks/livekit push-webhook endpoint. The bundled docker-compose.yml includes a dev LiveKit server (--dev mode, api_key=devkey / secret=secret) on ports 7880-7882.
Vault (legacy — not used for secrets)
.env.example still lists VAULT_ADDR / VAULT_TOKEN and the docker-compose.yml may still start a Vault container, but secrets are stored in PostgreSQL, encrypted with AES-256-GCM using a key derived from JWT_SECRET. Vault is not required.
Next steps