Environment Variables Reference

Prisme.ai services can be configured through various environment variables. This reference provides a comprehensive list of available configuration options for your deployment.

Configuration Methods

Docker Setup

In a Docker deployment, configure these variables in the root docker-compose.yml file. See the Docker Compose documentation for more details.

Developer Setup

In a development environment, create a services/*/.env file containing key/value pairs:

WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=someBucketName
...

To run a service directly from its Docker image, add an env_file option to its services/*/docker-compose.yml file:

console:
  entrypoint: npm start --prefix services/console
  restart: on-failure
  image: registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-console:latest
  ports:
    - "3000:3000"
  env_file: ./.env

Note 1: Default values may differ depending on the selected start mode (Docker or Developer), especially URL-related variables. Note 2: Relative paths start from the executing service directory.

Domains & URLs

Configure the URLs and domains used by Prisme.ai services.

Name	Service	Description	Default Value
INTERNAL_API_URL	All services	api-gateway internal URL for internal requests ending with `/v2` version suffix (i.e., contact fetching, public JWKS, runtime fetches)	http://localhost:3001/v2
API_URL	All services	api-gateway public URL ending with `/v2` version suffix	http://studio.local.prisme.ai:3001/v2
CONSOLE_URL	api-gateway, console, runtime	Console URL, used for emails, auth redirections & runtime variable `{{global.studioUrl}}`. Accepts a comma-separated list to expose the same frontend under several domains: every URL serves the same console and all of them call the single `API_URL`. All listed origins are auto-allowlisted for CORS and OIDC redirects.	http://studio.local.prisme.ai:3000

Databases & Storage

Redis Configuration

Name	Service	Description	Default Value
BROKER_HOST	api-gateway, workspaces, events, runtime	Redis broker URL (must be the same across services)	redis://localhost:6379/0
BROKER_PASSWORD	api-gateway, workspaces, events, runtime	Redis broker password
BROKER_TLS_CA_FILE	api-gateway, workspaces, events, runtime	Redis TLS CA filepath
BROKER_NAMESPACE	api-gateway, workspaces, events, runtime	Optional namespace to segment events when database instance is shared by multiple platforms
BROKER_TOPIC_MAXLEN	api-gateway, workspaces, events, runtime	Redis streams max length before getting truncated (Capped Streams)	10000
BROKER_EMIT_MAXLEN	api-gateway, workspaces, events, runtime	Maximum size (in bytes) of emitted events	100000
BROKER_EMIT_EXECUTED_AUTOMATION_MAXLEN	runtime	Maximum size (in bytes) of emitted runtime.automations.executed events	10000
SESSIONS_STORAGE_HOST	api-gateway	Redis URL for sessions storage	redis://localhost:6379/0
SESSIONS_STORAGE_PASSWORD	api-gateway	Redis password for sessions storage
SESSIONS_STORAGE_TLS_CA_FILE	api-gateway	Redis TLS CA filepath
CONTEXTS_CACHE_HOST	runtime	Redis URL for contexts persistence	redis://localhost:6379/0
CONTEXTS_CACHE_PASSWORD	runtime	Redis password for contexts persistence
CONTEXTS_CACHE_TLS_CA_FILE	runtime	Redis TLS CA filepath
EVENTS_TOPICS_CACHE_HOST	events	Redis URL for event userTopics persistence	BROKER_HOST variable
EVENTS_TOPICS_CACHE_PASSWORD	events	Redis password for event userTopics persistence
EVENTS_TOPICS_CACHE_TLS_CA_FILE	events	Redis TLS CA filepath

MongoDB/PostgreSQL Configuration

Name	Service	Description	Default Value
PERMISSIONS_STORAGE_DRIVER	api-gateway, workspaces, events, runtime	Database driver for permissions storage (must be the same for both workspaces & events): mongodb, postgresql	mongodb
PERMISSIONS_STORAGE_HOST	api-gateway, workspaces, events, runtime	Database URL for permissions storage (must be the same for both workspaces & events)	mongodb://localhost:27017/permissions
PERMISSIONS_STORAGE_TLS_CA_FILE	api-gateway, workspaces, events, runtime	Database TLS CA filepath
PERMISSIONS_STORAGE_TLS_SELF_SIGNED	api-gateway, workspaces, events, runtime	Set to true in order to disable server certificate validation	false
PERMISSIONS_STORAGE_DEBUG	workspaces, events, runtime	Enable database query logs	false
USERS_STORAGE_DRIVER	api-gateway	Database type for users storage: mongodb, postgresql	mongodb
USERS_STORAGE_HOST	api-gateway	Database URL for users storage	mongodb://localhost:27017/users
USERS_STORAGE_TLS_CA_FILE	api-gateway	Database TLS CA filepath
USERS_STORAGE_TLS_SELF_SIGNED	api-gateway	Set to true in order to disable server certificate validation	false
USERS_STORAGE_DEBUG	api-gateway	Enable database query logs	false
COLLECTIONS_STORAGE_DRIVER	runtime	Database type for collections storage: mongodb, postgresql	mongodb
COLLECTIONS_STORAGE_HOST	runtime	Database URL for collections storage	mongodb://localhost:27017/users
COLLECTIONS_STORAGE_TLS_CA_FILE	runtime	Database TLS CA filepath
COLLECTIONS_STORAGE_TLS_SELF_SIGNED	runtime	Set to true in order to disable server certificate validation	false
COLLECTIONS_STORAGE_DEBUG	runtime	Enable database query logs	false

Elasticsearch Configuration

Name	Service	Description	Default Value
EVENTS_STORAGE_DRIVER	events	Events storage driver (support elasticseach or opensearch)	elasticsearch
EVENTS_STORAGE_ES_HOST	events	Elasticsearch URL for events persistence	http://localhost:9200
EVENTS_STORAGE_ES_USER	events	Elasticsearch user for events persistence
EVENTS_STORAGE_ES_PASSWORD	events	Elasticsearch password for events persistence
EVENTS_STORAGE_ES_BULK_REFRESH	events	Enable Elastic “refresh” option when bulk inserting events (might cause overhead)	no
EVENTS_STORAGE_NAMESPACE	events	Elasticsearch indices name prefix	“

Storage Configuration

Prisme.ai supports multiple storage backends for workspaces and uploads. Available storage types are:

FILESYSTEM: Local file system storage
S3_LIKE: Amazon S3 or compatible services (MinIO, etc.)
AZURE_BLOB: Azure Blob Storage
GCS : Google Cloud Storage

Workspaces Storage

Name	Service	Description	Default Value
WORKSPACES_STORAGE_TYPE	runtime & workspaces	Storage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)	FILESYSTEM
WORKSPACES_STORAGE_FILESYSTEM_DIRPATH	runtime & workspaces	Directory path for filesystem storage	../../data/models/

Do not use FILESYSTEM for workspaces models in production. Filesystem writes are not atomic, so concurrent writes to the same workspace (multiple runtime / workspaces replicas, or an RWX volume shared across pods) can interleave and leave corrupted model YAML files. Use an object storage backend (S3_LIKE, AZURE_BLOB or GCS) instead, which writes each object atomically. Reserve FILESYSTEM for local development or single-replica evaluation setups.

S3-Compatible Storage for Workspaces

Name	Service	Description	Default Value
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEY	runtime & workspaces	S3 access key
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEY	runtime & workspaces	S3 secret key
WORKSPACES_STORAGE_S3_LIKE_ENDPOINT	runtime & workspaces	S3 endpoint
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME	runtime & workspaces	S3 bucket name
WORKSPACES_STORAGE_S3_LIKE_REGION	runtime & workspaces	S3 region
STORAGE_S3_LIKE_MAX_RETRIES	runtime & workspaces	Maximum retries on rate-limited S3 requests	5

Azure Blob Storage for Workspaces

Name	Service	Description	Default Value
WORKSPACES_STORAGE_AZURE_BLOB_CONTAINER	runtime & workspaces	Azure Blob container name	models
WORKSPACES_STORAGE_AZURE_BLOB_CONNECTION_STRING	runtime & workspaces	Azure Blob connection string
WORKSPACES_STORAGE_AZURE_BLOB_ACCOUNT_URL	runtime & workspaces	Account URL (`https://<account>.blob.core.windows.net/`). Required with an Azure identity, which replaces the connection string
WORKSPACES_STORAGE_AZURE_IDENTITY_CLIENT_ID	runtime & workspaces	Client id of a user-assigned managed identity (workload identity, Option B)
WORKSPACES_STORAGE_AZURE_SYSTEM_IDENTITY	runtime & workspaces	`true` to use the identity attached to the cluster (Option A)	false

GCS Storage for Workspaces

Name	Service	Description	Default Value
WORKSPACES_STORAGE_GCS_BUCKET	runtime & workspaces	GCS bucket name (required)
WORKSPACES_STORAGE_GCS_KEYFILEPATH	runtime & workspaces	Service account configuration filepath	`GOOGLE_APPLICATION_CREDENTIALS` environment variable
WORKSPACES_STORAGE_GCS_PROJECTID	runtime & workspaces	GCS project id, only required when using apiKey
WORKSPACES_STORAGE_GCS_APIKEY	runtime & workspaces	Api key
STORAGE_GCS_MAX_RETRIES	runtime & workspaces	Maximum retries on rate-limited GCS requests	5

If WORKSPACES_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only WORKSPACES_STORAGE_GCS_BUCKET is required.

File Uploads Storage

Name	Service	Description	Default Value
UPLOADS_STORAGE_TYPE	workspaces	Storage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)	FILESYSTEM
UPLOADS_STORAGE_FILESYSTEM_DIRPATH	workspaces	Directory path for filesystem storage	../../data/models/

S3-Compatible Storage for uploads

Name	Service	Description	Default Value
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEY	workspaces	S3 access key
UPLOADS_STORAGE_S3_LIKE_SECRET_KEY	workspaces	S3 secret key
UPLOADS_STORAGE_S3_LIKE_ENDPOINT	workspaces	S3 endpoint
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAME	workspaces	S3 bucket name
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BUCKET_NAME	workspaces	Optional. Separate bucket for public assets, used only if you want public files served directly by a CDN instead of being proxied by the api-gateway.
UPLOADS_STORAGE_S3_LIKE_REGION	workspaces	S3 region
STORAGE_S3_LIKE_MAX_RETRIES	workspaces	Maximum retries on rate-limited S3 requests	5
UPLOADS_STORAGE_S3_LIKE_BASE_URL	workspaces	Base download URL (if omitted, workspaces API will be used as proxy)

Azure Blob Storage for uploads

Name	Service	Description	Default Value
UPLOADS_STORAGE_AZURE_BLOB_CONTAINER	workspaces	Azure Blob container name	uploads
UPLOADS_STORAGE_AZURE_BLOB_CONNECTION_STRING	workspaces	Azure Blob connection string
UPLOADS_STORAGE_AZURE_BLOB_ACCOUNT_URL	workspaces	Account URL (`https://<account>.blob.core.windows.net/`). Required with an Azure identity, which replaces the connection string
UPLOADS_STORAGE_AZURE_IDENTITY_CLIENT_ID	workspaces	Client id of a user-assigned managed identity (workload identity, Option B)
UPLOADS_STORAGE_AZURE_SYSTEM_IDENTITY	workspaces	`true` to use the identity attached to the cluster (Option A)	false
UPLOADS_STORAGE_AZURE_BLOB_BASE_URL	workspaces	Base download URL (if omitted, workspaces API will be used as proxy)

With an Azure identity configured, the connection string is ignored (a warning is logged if one is still set) and the identity needs the Storage Blob Data Contributor role on the account. See Microsoft Entra ID passwordless auth.

GCS Storage for uploads

Name	Service	Description	Default Value
UPLOADS_STORAGE_GCS_BUCKET	workspaces	GCS bucket name (required)
UPLOADS_PUBLIC_STORAGE_GCS_BUCKET	workspaces	Optional. Separate bucket for public assets, used only if you want public files served directly by a CDN instead of being proxied by the api-gateway.
UPLOADS_STORAGE_GCS_KEYFILEPATH	workspaces	Service account configuration filepath	`GOOGLE_APPLICATION_CREDENTIALS` environment variable
UPLOADS_STORAGE_GCS_PROJECTID	workspaces	GCS project id, only required when using apiKey
UPLOADS_STORAGE_GCS_APIKEY	workspaces	Api key
STORAGE_GCS_MAX_RETRIES	workspaces	Maximum retries on rate-limited GCS requests	5
UPLOADS_STORAGE_GCS_BASE_URL	workspaces	Base download URL (if omitted, workspaces API will be used as proxy)

If UPLOADS_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only UPLOADS_STORAGE_GCS_BUCKET is required. Notes on uploads bucket: By default, a single private bucket holds both public and private uploads. Every download is proxied by the api-gateway, which checks the file’s visibility and serves public files without requiring authentication. No CDN, no public bucket, and no object-level ACLs are required. The default applies as long as UPLOADS_STORAGE_*_BASE_URL is left unset. If you want public files to be served directly from a CDN instead of through the api-gateway, you can opt into a two-bucket setup:

Keep the private bucket as-is (UPLOADS_STORAGE_S3_*).
Add a second bucket dedicated to public assets (UPLOADS_PUBLIC_STORAGE_S3_*), exposed through a CDN.
Set UPLOADS_STORAGE_S3_LIKE_BASE_URL (and/or UPLOADS_PUBLIC_STORAGE_S3_LIKE_BASE_URL) to the CDN’s public base URL; that is what tells the platform to hand out direct CDN URLs instead of proxying through the api-gateway.

You can reuse the same credentials for both buckets or provide separate ones:

UPLOADS_PUBLIC_STORAGE_S3_LIKE_BUCKET_NAME="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BASE_URL="your CDN public base URL"

Equivalent variables exist for GCS:

UPLOADS_PUBLIC_STORAGE_GCS_BUCKET="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_GCS_BASE_URL="your CDN public base URL"

To switch back to “everything through the api-gateway”, simply unset the UPLOADS_STORAGE_*_BASE_URL variables.

Authentication & Security

OIDC Configuration

Name	Service	Description	Default Value
OIDC_PROVIDER_URL	api-gateway, console, runtime	OIDC Authorization public server URL (rarely needs changing)	API_URL without base path
OIDC_INTERNAL_PROVIDER_URL	api-gateway	OIDC Authorization internal server URL (rarely needs changing)	By precedence: INTERNAL_API_URL, OIDC_PROVIDER_URL, or API_URL
OIDC_STUDIO_CLIENT_ID	api-gateway, console	Studio OIDC client ID	local-client-id
OIDC_STUDIO_CLIENT_SECRET	api-gateway	Studio OIDC client secret (known only by api-gateway)	local-client-id
OIDC_CLIENT_REGISTRATION_TOKEN	api-gateway	Access token required for OIDC clients registration API	local-client-id
OIDC_WELL_KNOWN_URL	api-gateway	OIDC provider configuration discovery URL (only for external providers)
OIDC_EXTERNAL_CLIENTS	api-gateway	JSON array of extra OIDC clients to declare, e.g. native mobile apps (see note below). Each entry needs at least `client_id` and `redirect_uris`; the rest defaults to a public PKCE native client. Defaults to a ready-to-use client for the Prisme.ai mobile app (`client_id: ai.prisme.app`); override to change or extend it.	Prisme.ai mobile client (see note)
OIDC_USERINFO_TIMEOUT	api-gateway	Timeout in milliseconds for the call to an external OIDC provider’s `userinfo_endpoint` (see Authentication)	5000
JWKS_URL	api-gateway	Endpoint for retrieving JWKS as part of the JWKS strategy	OIDC_INTERNAL_PROVIDER_URL/oidc/jwks

Declaring external OIDC clients (native mobile apps)

Besides the studio, whose redirect_uris are web console URLs, the api-gateway also ships a default native client for the Prisme.ai mobile app so it works out of the box — no configuration needed:

[
  {
    "client_id": "ai.prisme.app",
    "redirect_uris": ["ai.prisme.app://oauth/callback"],
    "post_logout_redirect_uris": ["ai.prisme.app://oauth/logout"]
  }
]

Set OIDC_EXTERNAL_CLIENTS to override this default and declare your own public clients — the variable replaces the built-in mobile client entirely, so re-add it if you still need it. The value is a JSON array of oidc-provider client metadata objects. Only client_id and redirect_uris are required; the api-gateway applies defaults so every entry is treated as a public PKCE native client:

Field	Default	Overridable
`application_type`	`native` (allows custom URI schemes and https claimed links)	yes
`grant_types`	`["authorization_code", "refresh_token"]`	yes
`response_types`	`["code"]`	yes
`allowedResources`	the platform API resource server	yes
`resourceScopes`	same broad scope set as the studio client	yes
`token_endpoint_auth_method`	`none` (public client) — forced, not configurable	no
`isInternalClient`	`false` — forced	no

PKCE is automatically required for these public clients — no extra setting needed.

For a native client, oidc-provider validates the redirect_uris per RFC 8252:

Custom URI scheme → must be reverse-domain (the scheme must contain a .). ai.prisme.app://oauth/callback is accepted, prisme://oauth/callback is rejected.
https → accepted (universal / claimed link), non-loopback hostname.
http → only for loopback addresses (127.0.0.1, [::1]).

An invalid redirect_uri makes the api-gateway fail to boot, so validate the value before deploying.

Example — override with a custom client (keeping the default mobile client too):

OIDC_EXTERNAL_CLIENTS='[
  {
    "client_id": "ai.prisme.app",
    "redirect_uris": ["ai.prisme.app://oauth/callback"],
    "post_logout_redirect_uris": ["ai.prisme.app://oauth/logout"]
  },
  {
    "client_id": "com.acme.myapp",
    "redirect_uris": ["com.acme.myapp://oauth/callback"]
  }
]'

The mobile app then drives the flow with PKCE (e.g. ASWebAuthenticationSession(callbackURLScheme: "ai.prisme.app") on iOS). Universal / app links (Apple apple-app-site-association, Android assetlinks.json) are not required for a custom scheme.

Session & Token Configuration

Name	Service	Description	Default Value
SESSION_COOKIES_MAX_AGE	api-gateway	Auth server session cookies expiration (in seconds)	2592000 (1 month)
ACCESS_TOKENS_MAX_AGE	api-gateway	Session expiration for both anonymous & authenticated sessions (in seconds)	2592000 (1 month)
SESSION_COOKIES_SIGN_SECRET	api-gateway	Session cookies signing secret
SOCKETIO_COOKIE_MAX_AGE	events	Socket.io cookie maxAge	Default from ‘cookie’ NodeJS module
WEB_SESSION_TICKET_TTL	api-gateway	Default lifetime of a web session ticket, in seconds (`POST /v2/user/webSessionTicket`)	60
WEB_SESSION_TICKET_MAX_TTL	api-gateway	Maximum lifetime a caller may request for a web session ticket, in seconds	300 (5 min)
WEB_SESSION_ALLOWED_REDIRECT_HOSTS	api-gateway	Extra hostnames accepted as a web session `redirect` target, on top of the platform’s own API, console and pages hosts. Comma separated, hostname only (no scheme)

Security Settings

Name	Service	Description	Default Value
CORS_ADDITIONAL_ALLOWED_ORIGINS	api-gateway	Additional allowed CORS origins (beyond `CONSOLE_URL` and workspace custom domains)
CSP_HEADER	console	Content Security Policy header for the frontend (if undefined, no CSP header is returned)
PASSWORD_MIN_LENGTH	api-gateway	Minimum length of a new password, counted after Unicode normalization. Values below 8 are ignored	8
PASSWORD_MAX_LENGTH	api-gateway	Maximum length of a new password. Capped to 72 bytes while `PASSWORD_PEPPER` is not set	128
PASSWORD_BREACH_CHECK	api-gateway	Breached password check: `local` (shipped list, no outbound call), `hibp` (also the Have I Been Pwned range API) or `off`	local
PASSWORD_BREACH_CHECK_URL	api-gateway	Range API used when `PASSWORD_BREACH_CHECK=hibp`, for example a self-hosted mirror	`https://api.pwnedpasswords.com/range/`
PASSWORD_BREACH_CHECK_TIMEOUT	api-gateway	Timeout of the range API call in milliseconds, after which the shipped list alone is used	2000
PASSWORD_PEPPER	api-gateway	Secret key of the password pre-hash (HMAC-SHA256 before bcrypt). Without it, passwords are limited to 72 bytes. Never change or lose it once set
PASSWORD_VALIDATION_REGEXP	api-gateway	Deprecated. Additional regular expression a new password must match, on top of the length bounds
ACCOUNT_VALIDATION_METHOD	api-gateway	Account validation method on signup: “auto”, “email”, or “manual”	email
DISABLE_LOCAL_SIGNIN	api-gateway	Disable local username/password sign-in API. Only SSO providers remain available.	false
DISABLE_LOCAL_SIGNUP	api-gateway	Disable local sign-up API.	false
MFA_FORCE_LOCAL	api-gateway	Require a second factor (passkey or authenticator app) for all local (password) accounts. SSO and anonymous accounts are exempt. Set to `false` to disable. See Multi-Factor Authentication.	true
WEBAUTHN_ENABLED	api-gateway	Passkeys are on by default. Set to `false` to turn them off; existing passkeys work again once turned back on.	true
WEBAUTHN_RP_ID	api-gateway	Domain passkeys are bound to: the console domain or one of its parent domains. Set it explicitly to keep passkeys valid if `CONSOLE_URL` changes: changing it makes existing passkeys unusable. See Configure passkeys.	console domain
WEBAUTHN_ORIGINS	api-gateway	Comma-separated origins accepted when verifying a passkey, compared exactly. Each must be `WEBAUTHN_RP_ID` or one of its subdomains.	`CONSOLE_URL` origins
WEBAUTHN_RP_NAME	api-gateway	Name displayed by the user’s passkey manager.	Prisme.ai
WEBAUTHN_PASSWORDLESS	api-gateway	Allow signing in with a passkey alone, without a password.	true
MFA_STEPUP_MAX_AGE	api-gateway	How long (seconds) a re-authentication allows changing second factors or pairing the mobile app.	300
RATE_LIMIT_PASSKEY_OPTIONS	api-gateway	Passwordless sign-in challenges per IP address and per minute.	60

Service-Specific Configuration

API Gateway

Name	Service	Description	Default Value
PORT	api-gateway	Listening port number	3001
GATEWAY_CONFIG_PATH	api-gateway	Path to gateway.config.yml	../../gateway.config.yml
AUTH_PROVIDERS_CONFIG	api-gateway	Path to authProviders.config.yml	../../authProviders.config.yml
INTERNAL_API_KEY	api-gateway, workspaces	API key for internal services to access events /sys/cleanup API
WORKSPACES_API_URL	api-gateway	prismeai-workspaces internal URL	http://workspaces:3002
EVENTS_API_URL	api-gateway	prismeai-events internal URL	http://events:3004
RUNTIME_API_URL	api-gateway	prismeai-runtime internal URL	http://runtime:3003
X_FORWARDED_HEADERS	api-gateway	Add X-Forwarded-* headers on proxied requests	yes
SUPER_ADMIN_EMAILS	api-gateway	Comma-separated list of user emails with access to all workspaces (e.g., “admin@example.com,user@company.com”)	None
REQUEST_MAX_SIZE	api-gateway	Maximum request body size (format from bodyParser.json)	1mb
EMAIL_DRIVER	api-gateway	Email driver to use. (“smtp”, “mailgun”)	mailgun
EMAIL_FROM	api-gateway	Email address to use as “from” when sending emails	`"Prisme.ai" <no-reply@prisme.ai>`
SMTP_HOST	api-gateway	Hostname or IP address of your SMTP server. (example: smtp.gmail.com)
SMTP_PORT	api-gateway	Port to connect to	587
SMTP_USER	api-gateway	User authentication
SMTP_PASS	api-gateway	User’s password
SMTP_SECURE	api-gateway	If true, the connection will use TLS immediately (recommended for port 465).	false

Console

Name	Service	Description	Default Value
PORT	console	Listening port number	3000
WEBSOCKETS_DEFAULT_TRANSPORTS	console	Default Socket.io transport methods	websocket,polling

Events Service

Name	Service	Description	Default Value
PORT	events	Listening port number	3004
EVENTS_BUFFER_FLUSH_AT	events	Persist events in data lake after this many events	128
EVENTS_BUFFER_HIGH_WATERMARK	events	Stop listening for new events when this many are waiting to be persisted	256
EVENTS_BUFFER_FLUSH_EVERY	events	Persist events every N milliseconds, even if EVENTS_BUFFER_FLUSH_AT not reached	5000
EVENTS_RETENTION_DAYS	events	Days events are kept in data lake before removal	180
EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYS	events	Delete workspace events if inactive for more than N days & with fewer than EVENTS_CLEANUP_WORKSPACE_MAX_EVENTS	15
EVENTS_CLEANUP_WORKSPACE_MAX_EVENTS	events	Delete workspace events if inactive for more than EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYS & with fewer than N events	100
EVENTS_SCHEDULED_DELETION_DAYS	events	Days events are kept in data lake after workspace deletion (min_age parameter for the `policy-events-deletion-scheduled` ILM policy)	90
ELASTIC_SEARCH_TIMEOUT	events	Best effort timeout for search requests : https://www.elastic.co/docs/solutions/search/the-search-api#search-timeout	20000ms
EVENTS_CLEANUP_AUTOMATION_EXECUTED_EXPIRATION	events	Expiration period enforced by `/cleanup` API for payload & output fields of runtime.automations.executed events. Can also be tuned from Helm `prismeai-events.events.automationExecutedExpiration` value	14d

Runtime Service

Name	Service	Description	Default Value
PORT	runtime	Listening port number	3003
MAXIMUM_SUCCESSIVE_CALLS	runtime	Maximum automation executions for the same correlation ID	20
CONTEXT_RUN_EXPIRE_TIME	runtime	Run context expiration time in seconds	60
CONTEXT_UNAUTHENTICATED_SESSION_EXPIRE_TIME	runtime	Session context expiration time in seconds for unauthenticated sessions	3600 (1 hour)
ADDITIONALGLOBAL_VARS*	runtime	Additional variables available from global context (e.g., ADDITIONAL_GLOBAL_VARS_apiUrl becomes `{{global.apiUrl}}`)	None
WORKSPACECONFIG`{{workspaceSlug}}`_`{{variableName}}`	runtime	Variables available for specific workspaces	None
APPCONFIG`{{appSlug}}`_`{{variableName}}`	runtime	Variables available for specific apps	None
FETCH_FORBIDDEN_HOSTS	runtime	Comma-separated list of forbidden hostnames in fetch instruction
FETCH_MAX_RETRIES	runtime	Maximum fetch retries	3
FETCH_RETRY_CODES	runtime	Error codes that trigger fetch retries	ECONNRESET,UND_ERR_SOCKET,EPIPE,EHOSTUNREACH,ENETUNREACH
FETCH_RETRY_STATUS	runtime	Response status codes that trigger fetch retries	429,503,502
FETCH_ALLOW_H2	runtime	Use HTTP/2 for `fetch` instruction calls, negotiated via ALPN with fallback to HTTP/1.1	undici default (HTTP/1.1)
FETCH_HEADERS_TIMEOUT	runtime	Inactivity timeout in milliseconds while waiting for the response headers of a `fetch` instruction. Overridable per call with the `timeout` option	300000 (5 min, the undici default)
FETCH_BODY_TIMEOUT	runtime	Inactivity timeout in milliseconds between two body chunks of a `fetch` instruction. Not a total duration cap: a response that keeps sending is never interrupted	300000 (5 min, the undici default)
FETCH_EMIT_REQUEST_EVENT	runtime	When enabled, emit a `runtime.fetch.requested` security audit event before each outbound `fetch` call, recording the request metadata (method, URL, header names, content-type, body size) — never any body nor header value — so the URLs called by workspaces can be investigated	false
WEBHOOKS_ABORT_ON_CLOSE	runtime	`sse` cancels the execution a webhook triggered when its client, which asked for an event stream, closes the connection before the end of the response (chat Stop button, closed tab). `none` disables it. A JSON request whose client gives up keeps running in both cases	sse
EXECUTION_ABORT_GRACE_PERIOD	runtime	Time in milliseconds a cancelled execution keeps running to finalize (its `fetch` calls return `aborted: true`) before it is stopped with an `AbortError`	10000 (10s)
WORKER_STREAM_FIRST_CHUNK_TIMEOUT	runtime	How long, in milliseconds, a streamed run waits for the model’s first token before the stream is closed with an explicit time-to-first-token error	60000 (60s)
RUNNER_MAX_THREADS	runtime	Number of worker_threads per runtime instance	1
CONTEXT_SOCKET_MAX_SIZE	runtime	Maximum size in bytes of socket context (this limit only emits error but does not throw, for now	100000
CONTEXT_GLOBAL_MAX_SIZE	runtime	Maximum size in bytes of global context (this limit only emits error but does not throw, for now	500000
CONTEXT_RUN_MAX_SIZE	runtime	Maximum size in bytes of run context (this limit only emits error but does not throw, for now	500000
CONTEXT_USER_MAX_SIZE	runtime	Maximum size in bytes of user context (this limit only emits error but does not throw, for now	100000
CONTEXT_SESSION_MAX_SIZE	runtime	Maximum size in bytes of session context (this limit only emits error but does not throw, for now	1000000
CONTEXT_LOCAL_MAX_SIZE	runtime	Maximum size in bytes of local context (this limit only emits error but does not throw, for now	50000000
CONTEXT_CONFIG_MAX_SIZE	runtime	Maximum size in bytes of config context (this limit only emits error but does not throw, for now	100000

FETCH_ALLOW_H2 and LLM streaming. Some corporate egress proxies and TLS-inspecting gateways buffer entire HTTP/1.1 response bodies before forwarding them. This breaks Server-Sent Events from LLM providers: the agent’s answer reaches the browser in one block at the end of generation instead of token by token. HTTP/2 usually traverses those same proxies unbuffered.

Bounding silent peers. FETCH_HEADERS_TIMEOUT and FETCH_BODY_TIMEOUT are inactivity bounds, not total duration caps, so a long streaming completion is never cut off. Their purpose is the opposite case: a host that accepts the connection and then says nothing, which used to hold the calling automation for the full 300s without emitting anything. Authors can tighten a single call with the fetch instruction’s timeout option, see Automations → fetch.

WORKER_STREAM_FIRST_CHUNK_TIMEOUT and slow models. When a model takes longer than this to emit its first token, the run now ends on an explicit time-to-first-token error, rather than on the generic “LLM gateway stream returned no data”. Large generations on some providers legitimately exceed 60s to start; raise the variable rather than reading the error as a platform failure.

Cancelled executions. WEBHOOKS_ABORT_ON_CLOSE and EXECUTION_ABORT_GRACE_PERIOD govern how the runtime stops an execution nobody waits for anymore, such as an agent answer the user stopped: the provider request is closed, so its tokens stop being generated and billed. See Automations → Cancelling an execution for what automations see.

FETCH_EMIT_REQUEST_EVENT for outbound-traffic auditing. Off by default. When enabled, every fetch instruction emits a runtime.fetch.requested event just before the request is dispatched — so a call that hangs, times out or crashes still leaves a trace of the URL it targeted. The payload carries request metadata only (method, URL, header names, content-type, body size) and never any request body nor any header value, so it is safe to persist and search. Failures are still reported separately by runtime.fetch.failed. Intra-platform workspace→workspace calls (webhook direct calls) are not audited. Platform-wide switch only — it cannot be toggled per fetch.

Workspaces Service

Name	Service	Description	Default Value
PORT	workspaces	Listening port number	3002
UPLOADS_ALLOWED_MIMETYPES	workspaces	Comma-separated list of allowed upload MIME types	image/,text/,video/,audio/,application/*
UPLOADS_FORBIDDEN_MIMETYPES	workspaces	Comma-separated list of forbidden upload MIME types (no wildcards)
UPLOADS_DEFAULT_VISIBILITY	workspaces	Default upload visibility if not specified in API request	public
UPLOADS_MAX_SIZE	workspaces, api-gateway, runtime	Maximum upload size in bytes	10000000 (10MB)
IMPORT_BATCH_SIZE	workspaces	Maximum parallel save requests during imports	50

Platform Repositories

Platform repositories are shared repositories automatically available to all workspaces for versioning (push/pull). They are configured entirely through environment variables and require no per-workspace setup. Each workspace’s files are stored in a subdirectory named after the workspace slug within the repository. This allows a single repository to serve as a centralized versioning backend for every workspace on the platform. Multiple platform repositories can be configured by using the following naming convention:

WORKSPACES_STORAGE_GIT_PLATFORM_{repoId}_{FIELD}

Where {repoId} is a unique identifier for the repository (e.g., prismeai, backup) and {FIELD} is one of the supported fields listed below.

Field suffix	Description	Default Value
`TYPE`	Repository type: `git` (remote Git repository) or `filesystem` (local directory)	`git`
`URL`	Git repository URL (required for `git` type; the repository is only enabled if this is set)
`NAME`	Display name shown in the UI	`{repoId}`
`BRANCH`	Git branch to use (only for `git` type)	`main`
`MODE`	Access mode: `read-write` or `read-only`	`read-write`
`DIRPATH`	For `git` type: base directory path inside the repository. Each workspace’s files are stored under `{dirpath}/{workspaceSlug}`. If omitted, workspace files are stored directly under `{workspaceSlug}` at the repository root. For `filesystem` type: required absolute path to the local directory containing workspace subdirectories.
`AUTH_USER`	Username for HTTPS authentication (only for `git` type)
`AUTH_PASSWORD`	Password or personal access token (PAT) for HTTPS authentication (only for `git` type)
`AUTH_SSHKEY`	SSH private key content for SSH authentication (only for `git` type)

The filesystem type is reserved for platform repositories and cannot be used in workspace-level repository configurations.

Example (single platform Git repository):

WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_URL=https://github.com/myorg/workspaces.git
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_NAME=Platform Repository
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_BRANCH=main
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_USER=your-user
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_PASSWORD=github_pat_xxxxxxx

Example (filesystem platform repository, like the one embedded in prismeai-workspaces Docker image):

WORKSPACES_STORAGE_GIT_PLATFORM_builtin_TYPE=filesystem
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_NAME=Built-in Workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_DIRPATH=/www/platform-workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_MODE=read-only

With this configuration, the platform expects workspace directories directly inside /www/platform-workspaces/ (e.g., /www/platform-workspaces/ai-knowledge/, etc.). Example (with a custom directory path, Git):

WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_URL=https://github.com/myorg/monorepo.git
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_NAME=Platform Repository
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_DIRPATH=workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_USER=your-user
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_PASSWORD=github_pat_xxxxxxx

With this configuration, a workspace with slug myapp would be stored under workspaces/myapp/ in the repository. Example (multiple platform repositories):

# Primary read-write Git repository
WORKSPACES_STORAGE_GIT_PLATFORM_primary_URL=https://github.com/myorg/workspaces.git
WORKSPACES_STORAGE_GIT_PLATFORM_primary_NAME=Main Repository
WORKSPACES_STORAGE_GIT_PLATFORM_primary_AUTH_USER=x-access-token
WORKSPACES_STORAGE_GIT_PLATFORM_primary_AUTH_PASSWORD=ghp_xxxxxxxxxxxx

# Read-only backup Git repository
WORKSPACES_STORAGE_GIT_PLATFORM_backup_URL=git@github.com:myorg/workspaces-backup.git
WORKSPACES_STORAGE_GIT_PLATFORM_backup_NAME=Backup (read-only)
WORKSPACES_STORAGE_GIT_PLATFORM_backup_MODE=read-only
WORKSPACES_STORAGE_GIT_PLATFORM_backup_AUTH_SSHKEY="-----BEGIN OPENSSH PRIVATE KEY-----\n..."

# Built-in filesystem repository (Docker image)
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_TYPE=filesystem
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_NAME=Built-in Workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_DIRPATH=/www/platform-workspaces

Notes:

Platform repositories are returned in the platformRepositories field of the workspace API response; they do not include auth details, and are never persisted into the workspace configuration.
Authentication credentials are never exposed in API responses.
For GitHub HTTPS authentication, use your username as AUTH_USER and a personal access token (PAT) with read-write permissions on Contents as AUTH_PASSWORD.

Workspace Groups

Workspace groups define logical sets of workspaces that can be imported together via bulk import. Groups are configured through environment variables:

WORKSPACES_GROUP_{groupName}_LABELS="label1,label2,..."

A workspace belongs to a group if at least one of its labels matches one of the group’s labels. When a workspace is pushed to a platform repository, the groups it belongs to are recorded in its .import.yml file.

Name	Service	Description	Default Value
`WORKSPACES_GROUP_{groupName}_LABELS`	workspaces	Comma-separated list of labels for the group. A workspace with any matching label is included in this group.

Example:

# Core dependencies
WORKSPACES_GROUP_base1_LABELS=production:app:base1
WORKSPACES_GROUP_base2_LABELS=production:app:base2

# Core products
WORKSPACES_GROUP_extended_LABELS=production:app,production:product

These group names are then used in:

The bulk import API (groups body parameter): POST /v2/workspaces/platform/versions/latest/pull
The bulk push API (groups body parameter): POST /v2/workspaces/platform/versions
STARTUP_IMPORT_GROUPS to select which workspaces to import automatically on startup

Automatic Import at Startup

The workspaces service can automatically trigger a bulk import when it starts. This is useful for initial deployments and platform upgrades, ensuring that reference workspaces from a platform repository are always up to date.

Name	Service	Description	Default Value
`STARTUP_IMPORT_GROUPS`	workspaces	Comma-separated list of group names to import at startup. Each group is imported sequentially. If any group encounters errors, remaining groups are skipped. If empty, no auto-import is performed.
`STARTUP_IMPORT_REPOSITORY`	workspaces	Repository ID (matching a configured platform repository) to import from at startup.

Example:

# Import core workspaces from the built-in filesystem repository at startup
STARTUP_IMPORT_GROUPS=base1,base2,extended
STARTUP_IMPORT_REPOSITORY=builtin

At startup, the service:

Ensures the platform workspace exists (creates it if needed)
Waits for the platform to be ready (checks the /v2/readiness endpoint, with a 5-minute timeout)
Imports each group sequentially using the bulk import mechanism, with a 30s pause between each group
Skips workspaces already at the correct version (based on .import.yml version matching)

When multiple replicas start simultaneously (e.g., during a rollout), only one replica acquires the write lock on the Platform workspace and performs the import. Other replicas skip the import entirely.

Credentials replayed without a user

A run that carries no user cannot read a workspace secret under anyone’s permissions. That matters for connectors: the OAuth token a member deposited when connecting their account is exactly what a nightly synchronisation needs to replay. There is nothing to configure here, and no operator gesture at all. A workspace declares a role in its own security rules, grants it read over a family of its secrets, and its automations take that role on where they need it. See RBAC and secure secrets.

Such a role can read, and overwrite, every credential in the family it names. It is meant to be assumed by an automation and nothing else: granting it to a person, or attaching an API key to it, hands those credentials to whoever holds them. The platform does not prevent it, so treat it as a rule of your own.

Performance & Limits

Rate Limiting

The variables below are the api-gateway-side rate limits: requests above the threshold are rejected with HTTP 429. For automation rate limits (also RATE_LIMIT_* but on prismeai-runtime), see API Reference: Rate Limits. Unlike the gateway limits, those don’t break execution; they deliberately slow automations down instead of failing them.

Name	Service	Description	Default Value
DISABLE_RATE_LIMIT	api-gateway	Set it to true in order to disable all rate limits
RATE_LIMIT_SIGNUP	api-gateway	Maximum signups per IP per minute	1
RATE_LIMIT_ANONYMOUS_LOGIN	api-gateway	Maximum anonymous logins per IP per minute	10
RATE_LIMIT_TOKEN_EXCHANGE	api-gateway	Maximum OIDC token exchanges (`/v2/login/token-exchange`) per IP per minute. Uses its own counter, separate from anonymous logins. Token exchange is usually brokered server-side, so all users share one source IP; raise this for production.	60
RATE_LIMIT_SAML_METADATA	api-gateway	Maximum requests per IP per minute on the public SAML service provider metadata route (`/v2/login/saml/<slug>/metadata`)	30
RATE_LIMIT_PRISMEAI_LOGIN	api-gateway	Maximum email/password login attempts per email per minute	5
RATE_LIMIT_PASSWORD_RESET	api-gateway	Maximum password reset requests per IP per minute	1
RATE_LIMIT_WEB_SESSION	api-gateway	Maximum web session ticket exchanges (`GET /v2/user/webSession`) per IP per minute. The exchange is unauthenticated by nature, since it is what opens the session	30

Integration & APIs

Name	Service	Description	Default Value
OPENAPI_FILEPATH	All services	Path to Swagger file for requests & events validation	../specifications/swagger.yml

Examples

S3 Storage Configuration

# Configure workspace storage with S3
WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=prisme-workspaces
WORKSPACES_STORAGE_S3_LIKE_REGION=us-west-1
WORKSPACES_STORAGE_S3_LIKE_BASE_URL=https://prisme-workspaces.s3.us-west-1.amazonaws.com

# Configure uploads with the same credentials but different bucket
UPLOADS_STORAGE_TYPE=S3_LIKE
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
UPLOADS_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAME=prisme-uploads
UPLOADS_STORAGE_S3_LIKE_REGION=us-west-1
UPLOADS_STORAGE_S3_LIKE_BASE_URL=https://prisme-uploads.s3.us-west-1.amazonaws.com

Authentication and Rate Limiting for Production

# Password policy: 12 characters minimum, breached passwords checked online
PASSWORD_MIN_LENGTH=12
PASSWORD_BREACH_CHECK=hibp
# Keep in a secret, generated once (for example: openssl rand -base64 32)
PASSWORD_PEPPER=YOUR_PEPPER

# Enable manual account validation
ACCOUNT_VALIDATION_METHOD=manual

# Configure super admins
SUPER_ADMIN_EMAILS=admin@company.com,security@company.com

# Set stricter rate limits
RATE_LIMIT_SIGNUP=1
RATE_LIMIT_ANONYMOUS_LOGIN=5
RATE_LIMIT_PRISMEAI_LOGIN=3
RATE_LIMIT_PASSWORD_RESET=1

​Configuration Methods

​Docker Setup

​Developer Setup

​Variable Categories

​Domains & URLs

​Databases & Storage

​Redis Configuration

​MongoDB/PostgreSQL Configuration

​Elasticsearch Configuration

​Storage Configuration

​Workspaces Storage

​S3-Compatible Storage for Workspaces

​Azure Blob Storage for Workspaces

​GCS Storage for Workspaces

​File Uploads Storage

​S3-Compatible Storage for uploads

​Azure Blob Storage for uploads

​GCS Storage for uploads

​Authentication & Security

​OIDC Configuration

​Declaring external OIDC clients (native mobile apps)

​Session & Token Configuration

​Security Settings

​Service-Specific Configuration

​API Gateway

​Console

​Events Service

​Runtime Service

​Workspaces Service

​Platform Repositories

​Workspace Groups

​Automatic Import at Startup

​Credentials replayed without a user

​Performance & Limits

​Rate Limiting

​Integration & APIs

​Examples

​S3 Storage Configuration

​Authentication and Rate Limiting for Production

Configuration Methods

Docker Setup

Developer Setup

Variable Categories

Domains & URLs

Databases & Storage

Redis Configuration

MongoDB/PostgreSQL Configuration

Elasticsearch Configuration

Storage Configuration

Workspaces Storage

S3-Compatible Storage for Workspaces

Azure Blob Storage for Workspaces

GCS Storage for Workspaces

File Uploads Storage

S3-Compatible Storage for uploads

Azure Blob Storage for uploads

GCS Storage for uploads

Authentication & Security

OIDC Configuration

Declaring external OIDC clients (native mobile apps)

Session & Token Configuration

Security Settings

Service-Specific Configuration

API Gateway

Console

Events Service

Runtime Service

Workspaces Service

Platform Repositories

Workspace Groups

Automatic Import at Startup

Credentials replayed without a user

Performance & Limits

Rate Limiting

Integration & APIs

Examples

S3 Storage Configuration

Authentication and Rate Limiting for Production