# Config Reference

Environment variables and config precedence generated from the current source readers.

Source: https://agentclash.dev/docs/reference/config
Markdown export: https://agentclash.dev/docs-md/reference/config

This page is generated from the config readers in the API server, worker, CLI, and the checked-in backend example environment file.

## CLI precedence

- API URL: `--api-url > AGENTCLASH_API_URL > saved user config > http://localhost:8080`
- Workspace: `--workspace > AGENTCLASH_WORKSPACE > project config > user config`
- Output format: `--json > --output > user config > table`

## API Server Environment

| Variable | Default | Description |
| --- | --- | --- |
| `AGENTCLASH_SECRETS_MASTER_KEY` | — | Read by backend/internal/api/config.go. |
| `API_SERVER_BIND_ADDRESS` | `":8080"` | Bind address for the API server process. |
| `APP_ENV` | `"development"` | Select development, staging, or production behavior. |
| `ARTIFACT_MAX_UPLOAD_BYTES` | `100 << 20` | Upper bound for artifact upload size accepted by the API server. |
| `ARTIFACT_SIGNED_URL_TTL_SECONDS` | `5 * time.Minute` | Expiry window for signed artifact URLs returned by the API server. |
| `ARTIFACT_SIGNING_SECRET` | — | Signing secret for artifact URL generation; required outside local filesystem dev mode. |
| `ARTIFACT_STORAGE_BACKEND` | `"filesystem"` | Choose filesystem or S3-compatible artifact storage. |
| `ARTIFACT_STORAGE_BUCKET` | `"agentclash-dev-artifacts"` | Artifact bucket or logical container name. |
| `ARTIFACT_STORAGE_FILESYSTEM_ROOT` | `filepath.Join(os.TempDir(` | Local artifact root when the filesystem backend is in use. |
| `ARTIFACT_STORAGE_S3_ACCESS_KEY_ID` | — | Access key for S3-compatible artifact storage. |
| `ARTIFACT_STORAGE_S3_ENDPOINT` | — | Optional custom endpoint for S3-compatible artifact storage. |
| `ARTIFACT_STORAGE_S3_FORCE_PATH_STYLE` | `true` | Toggle path-style addressing for S3-compatible storage. |
| `ARTIFACT_STORAGE_S3_REGION` | — | Region for S3-compatible artifact storage. |
| `ARTIFACT_STORAGE_S3_SECRET_ACCESS_KEY` | — | Secret key for S3-compatible artifact storage. |
| `AUTH_MODE` | `"dev"` | Select dev headers or WorkOS-backed authentication for the API. |
| `CORS_ALLOWED_ORIGINS` | — | Allowed browser origins for the API in WorkOS mode. |
| `DATABASE_URL` | `"postgres://agentclash:agentclash@localhost:5432/agentclash?sslmode=disable"` | Postgres connection string. |
| `FRONTEND_URL` | — | Public web origin used in emails and CLI auth links. |
| `HOSTED_RUN_CALLBACK_SECRET` | `"agentclash-dev-hosted-callback-secret"` | Shared secret for hosted-run callback authentication. |
| `RESEND_API_KEY` | — | Enable invite email sending through Resend. |
| `RESEND_FROM_EMAIL` | — | Sender address for invite emails. |
| `TEMPORAL_HOST_PORT` | `"localhost:7233"` | Temporal frontend address. |
| `TEMPORAL_NAMESPACE` | `"default"` | Temporal namespace used by the API and worker. |
| `WORKOS_CLIENT_ID` | — | WorkOS client ID used when the API is in workos auth mode. |
| `WORKOS_ISSUER` | — | Optional WorkOS issuer override for JWT validation. |

## Worker Environment

| Variable | Default | Description |
| --- | --- | --- |
| `AGENTCLASH_SECRETS_MASTER_KEY` | — | Read by backend/internal/worker/config.go. |
| `APP_ENV` | `"development"` | Select development, staging, or production behavior. |
| `DATABASE_URL` | `"postgres://agentclash:agentclash@localhost:5432/agentclash?sslmode=disable"` | Postgres connection string. |
| `E2B_API_BASE_URL` | — | Optional E2B API base URL override. |
| `E2B_API_KEY` | — | API key for the E2B sandbox provider. |
| `E2B_REQUEST_TIMEOUT` | `30*time.Second` | Timeout for E2B sandbox API calls. |
| `E2B_TEMPLATE_ID` | — | Template ID for the E2B sandbox provider. |
| `HOSTED_RUN_CALLBACK_BASE_URL` | `"http://localhost:8080"` | Base URL the worker uses when calling hosted-run callback endpoints. |
| `HOSTED_RUN_CALLBACK_SECRET` | `"agentclash-dev-hosted-callback-secret"` | Shared secret for hosted-run callback authentication. |
| `SANDBOX_PROVIDER` | `"unconfigured"` | Choose unconfigured or e2b for native sandbox execution. |
| `TEMPORAL_HOST_PORT` | `"localhost:7233"` | Temporal frontend address. |
| `TEMPORAL_NAMESPACE` | `"default"` | Temporal namespace used by the API and worker. |
| `WORKER_IDENTITY` | `defaultWorkerIdentity(` | Logical worker identity label. |
| `WORKER_SHUTDOWN_TIMEOUT` | `10 * time.Second` | Graceful shutdown timeout for the worker process. |

## CLI Environment

| Variable | Default | Description |
| --- | --- | --- |
| `AGENTCLASH_API_URL` | — | Override the CLI API base URL. |
| `AGENTCLASH_DEV_ORG_MEMBERSHIPS` | — | Inject development org memberships into the CLI dev-auth path. |
| `AGENTCLASH_DEV_USER_ID` | — | Inject a development user ID for CLI dev mode. |
| `AGENTCLASH_DEV_WORKSPACE_MEMBERSHIPS` | — | Inject development workspace memberships into the CLI dev-auth path. |
| `AGENTCLASH_ORG` | — | Override the default organization ID for CLI commands. |
| `AGENTCLASH_TOKEN` | — | Provide a CLI token directly, mainly for CI or automation. |
| `AGENTCLASH_WORKSPACE` | — | Override the default workspace ID for CLI commands. |

## Backend Example Environment

| Variable | Default | Description |
| --- | --- | --- |
| `AGENTCLASH_SECRETS_MASTER_KEY` | — | Present in the backend example environment file. |
| `API_SERVER_BIND_ADDRESS` | `:8080` | Bind address for the API server process. |
| `APP_ENV` | `development` | Select development, staging, or production behavior. |
| `AUTH_MODE` | `dev` | Select dev headers or WorkOS-backed authentication for the API. |
| `DATABASE_URL` | `postgres://agentclash:agentclash@localhost:5432/agentclash?sslmode=disable` | Postgres connection string. |
| `E2B_API_BASE_URL` | — | Optional E2B API base URL override. |
| `E2B_API_KEY` | — | API key for the E2B sandbox provider. |
| `E2B_REQUEST_TIMEOUT` | `30s` | Timeout for E2B sandbox API calls. |
| `E2B_TEMPLATE_ID` | — | Template ID for the E2B sandbox provider. |
| `FRONTEND_URL` | `http://localhost:3000` | Public web origin used in emails and CLI auth links. |
| `HOSTED_RUN_CALLBACK_BASE_URL` | `http://localhost:8080` | Base URL the worker uses when calling hosted-run callback endpoints. |
| `HOSTED_RUN_CALLBACK_SECRET` | `agentclash-dev-hosted-callback-secret` | Shared secret for hosted-run callback authentication. |
| `REDIS_URL` | `redis://localhost:6379` | Enable Redis-backed event fanout and related features. |
| `RESEND_API_KEY` | — | Enable invite email sending through Resend. |
| `RESEND_FROM_EMAIL` | `noreply@agentclash.dev` | Sender address for invite emails. |
| `SANDBOX_PROVIDER` | `unconfigured` | Choose unconfigured or e2b for native sandbox execution. |
| `TEMPORAL_HOST_PORT` | `localhost:7233` | Temporal frontend address. |
| `TEMPORAL_NAMESPACE` | `default` | Temporal namespace used by the API and worker. |
| `WORKER_IDENTITY` | `agentclash-worker-local` | Logical worker identity label. |
| `WORKER_SHUTDOWN_TIMEOUT` | `10s` | Graceful shutdown timeout for the worker process. |
| `WORKOS_CLIENT_ID` | — | WorkOS client ID used when the API is in workos auth mode. |
| `WORKOS_ISSUER` | — | Optional WorkOS issuer override for JWT validation. |

## Source pointers

- `backend/internal/api/config.go`
- `backend/internal/worker/config.go`
- `cli/internal/config/manager.go`
- `backend/.env.example`