Config Reference

This page is generated from the config readers in the API server, worker, CLI, and the checked-in backend example environment file.

CLI precedence

• API URL: --api-url > AGENTCLASH_API_URL > saved user config > http://localhost:8080
• Workspace: --workspace > AGENTCLASH_WORKSPACE > project config > user config
• Output format: --json > --output > user config > table

API Server Environment

| Variable | Default | Description | | --- | --- | --- | | AGENTCLASH_SECRETS_MASTER_KEY | — | Read by backend/internal/api/config.go. | | API_SERVER_BIND_ADDRESS | ":8080" | Bind address for the API server process. | | APP_ENV | "development" | Select development, staging, or production behavior. | | ARTIFACT_MAX_UPLOAD_BYTES | 100 << 20 | Upper bound for artifact upload size accepted by the API server. | | ARTIFACT_SIGNED_URL_TTL_SECONDS | 5 * time.Minute | Expiry window for signed artifact URLs returned by the API server. | | ARTIFACT_SIGNING_SECRET | — | Signing secret for artifact URL generation; required outside local filesystem dev mode. | | ARTIFACT_STORAGE_BACKEND | "filesystem" | Choose filesystem or S3-compatible artifact storage. | | ARTIFACT_STORAGE_BUCKET | "agentclash-dev-artifacts" | Artifact bucket or logical container name. | | ARTIFACT_STORAGE_FILESYSTEM_ROOT | filepath.Join(os.TempDir( | Local artifact root when the filesystem backend is in use. | | ARTIFACT_STORAGE_S3_ACCESS_KEY_ID | — | Access key for S3-compatible artifact storage. | | ARTIFACT_STORAGE_S3_ENDPOINT | — | Optional custom endpoint for S3-compatible artifact storage. | | ARTIFACT_STORAGE_S3_FORCE_PATH_STYLE | true | Toggle path-style addressing for S3-compatible storage. | | ARTIFACT_STORAGE_S3_REGION | — | Region for S3-compatible artifact storage. | | ARTIFACT_STORAGE_S3_SECRET_ACCESS_KEY | — | Secret key for S3-compatible artifact storage. | | AUTH_MODE | "dev" | Select dev headers or WorkOS-backed authentication for the API. | | CORS_ALLOWED_ORIGINS | — | Allowed browser origins for the API in WorkOS mode. | | DATABASE_URL | "postgres://agentclash:agentclash@localhost:5432/agentclash?sslmode=disable" | Postgres connection string. | | FRONTEND_URL | — | Public web origin used in emails and CLI auth links. | | HOSTED_RUN_CALLBACK_SECRET | "agentclash-dev-hosted-callback-secret" | Shared secret for hosted-run callback authentication. | | RESEND_API_KEY | — | Enable invite email sending through Resend. | | RESEND_FROM_EMAIL | — | Sender address for invite emails. | | TEMPORAL_HOST_PORT | "localhost:7233" | Temporal frontend address. | | TEMPORAL_NAMESPACE | "default" | Temporal namespace used by the API and worker. | | WORKOS_CLIENT_ID | — | WorkOS client ID used when the API is in workos auth mode. | | WORKOS_ISSUER | — | Optional WorkOS issuer override for JWT validation. |

Worker Environment

| Variable | Default | Description | | --- | --- | --- | | AGENTCLASH_SECRETS_MASTER_KEY | — | Read by backend/internal/worker/config.go. | | APP_ENV | "development" | Select development, staging, or production behavior. | | DATABASE_URL | "postgres://agentclash:agentclash@localhost:5432/agentclash?sslmode=disable" | Postgres connection string. | | E2B_API_BASE_URL | — | Optional E2B API base URL override. | | E2B_API_KEY | — | API key for the E2B sandbox provider. | | E2B_REQUEST_TIMEOUT | 30*time.Second | Timeout for E2B sandbox API calls. | | E2B_TEMPLATE_ID | — | Template ID for the E2B sandbox provider. | | HOSTED_RUN_CALLBACK_BASE_URL | "http://localhost:8080" | Base URL the worker uses when calling hosted-run callback endpoints. | | HOSTED_RUN_CALLBACK_SECRET | "agentclash-dev-hosted-callback-secret" | Shared secret for hosted-run callback authentication. | | SANDBOX_PROVIDER | "unconfigured" | Choose unconfigured or e2b for native sandbox execution. | | TEMPORAL_HOST_PORT | "localhost:7233" | Temporal frontend address. | | TEMPORAL_NAMESPACE | "default" | Temporal namespace used by the API and worker. | | WORKER_IDENTITY | defaultWorkerIdentity( | Logical worker identity label. | | WORKER_SHUTDOWN_TIMEOUT | 10 * time.Second | Graceful shutdown timeout for the worker process. |

CLI Environment

| Variable | Default | Description | | --- | --- | --- | | AGENTCLASH_API_URL | — | Override the CLI API base URL. | | AGENTCLASH_DEV_ORG_MEMBERSHIPS | — | Inject development org memberships into the CLI dev-auth path. | | AGENTCLASH_DEV_USER_ID | — | Inject a development user ID for CLI dev mode. | | AGENTCLASH_DEV_WORKSPACE_MEMBERSHIPS | — | Inject development workspace memberships into the CLI dev-auth path. | | AGENTCLASH_ORG | — | Override the default organization ID for CLI commands. | | AGENTCLASH_TOKEN | — | Provide a CLI token directly, mainly for CI or automation. | | AGENTCLASH_WORKSPACE | — | Override the default workspace ID for CLI commands. |

Backend Example Environment

| Variable | Default | Description | | --- | --- | --- | | AGENTCLASH_SECRETS_MASTER_KEY | — | Present in the backend example environment file. | | API_SERVER_BIND_ADDRESS | :8080 | Bind address for the API server process. | | APP_ENV | development | Select development, staging, or production behavior. | | AUTH_MODE | dev | Select dev headers or WorkOS-backed authentication for the API. | | DATABASE_URL | postgres://agentclash:agentclash@localhost:5432/agentclash?sslmode=disable | Postgres connection string. | | E2B_API_BASE_URL | — | Optional E2B API base URL override. | | E2B_API_KEY | — | API key for the E2B sandbox provider. | | E2B_REQUEST_TIMEOUT | 30s | Timeout for E2B sandbox API calls. | | E2B_TEMPLATE_ID | — | Template ID for the E2B sandbox provider. | | FRONTEND_URL | http://localhost:3000 | Public web origin used in emails and CLI auth links. | | HOSTED_RUN_CALLBACK_BASE_URL | http://localhost:8080 | Base URL the worker uses when calling hosted-run callback endpoints. | | HOSTED_RUN_CALLBACK_SECRET | agentclash-dev-hosted-callback-secret | Shared secret for hosted-run callback authentication. | | REDIS_URL | redis://localhost:6379 | Enable Redis-backed event fanout and related features. | | RESEND_API_KEY | — | Enable invite email sending through Resend. | | RESEND_FROM_EMAIL | noreply@agentclash.dev | Sender address for invite emails. | | SANDBOX_PROVIDER | unconfigured | Choose unconfigured or e2b for native sandbox execution. | | TEMPORAL_HOST_PORT | localhost:7233 | Temporal frontend address. | | TEMPORAL_NAMESPACE | default | Temporal namespace used by the API and worker. | | WORKER_IDENTITY | agentclash-worker-local | Logical worker identity label. | | WORKER_SHUTDOWN_TIMEOUT | 10s | Graceful shutdown timeout for the worker process. | | WORKOS_CLIENT_ID | — | WorkOS client ID used when the API is in workos auth mode. | | WORKOS_ISSUER | — | Optional WorkOS issuer override for JWT validation. |

Source pointers

• backend/internal/api/config.go
• backend/internal/worker/config.go
• cli/internal/config/manager.go
• backend/.env.example