> ## Documentation Index
> Fetch the complete documentation index at: https://opensre.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> Every OpenSRE setting you can put in the environment or a .env file.

All configuration options for OpenSRE can be set via environment variables. This page provides a complete reference.

## Secret storage

Environment variables are checked first. Credentials you enter through
`opensre onboard` for LLM setup, or through `opensre integrations setup` for
tools, are written to `.env` and to an owner-only file at
`~/.opensre/credentials.json` (mode `0600`). OpenSRE
does not write secrets to the OS keychain.

A value in the process environment or a local `.env` file wins over the
credentials file. Keep `.env` out of source control.

Want credentials only from the environment, never on disk? Set
`OPENSRE_DISABLE_KEYRING=1` and export everything yourself.

## LLM providers

| Variable | Default | Description |
| - | - | - |
| `LLM_PROVIDER` | `anthropic` | Which LLM backend to use — see [LLM providers](https://opensre.com/docs/platform/llm-providers.md) |
| `LLM_MAX_TOKENS` | `4096` | Max tokens for LLM responses |
| `OPENSRE_LLM_TRANSPORT` | `sdk` | `sdk` (native SDKs) or `litellm` |
| `OPENSRE_LLM_NATIVE_STRUCTURED_OUTPUT` | | Opt-in provider-native structured outputs (`1`/`true`) |

> **Anthropic**
>
> | Variable | Default | Description |
> | - | - | - |
> | `ANTHROPIC_API_KEY` | | API key for Anthropic |
> | `ANTHROPIC_REASONING_MODEL` | | Model for reasoning tasks |
> | `ANTHROPIC_TOOLCALL_MODEL` | | Model for tool calling |

> **OpenAI**
>
> | Variable | Default | Description |
> | - | - | - |
> | `OPENAI_API_KEY` | | API key for OpenAI |
> | `OPENAI_REASONING_MODEL` | | Model for reasoning tasks |
> | `OPENAI_TOOLCALL_MODEL` | | Model for tool calling |

> **OpenRouter**
>
> | Variable | Default | Description |
> | - | - | - |
> | `OPENROUTER_API_KEY` | | API key for OpenRouter |
> | `OPENROUTER_MODEL` | | Shared model for all tasks |
> | `OPENROUTER_REASONING_MODEL` | | Override model for reasoning |
> | `OPENROUTER_TOOLCALL_MODEL` | | Override model for tool calling |

> **TrustedRouter**
>
> | Variable | Default | Description |
> | - | - | - |
> | `TRUSTEDROUTER_API_KEY` | | API key for TrustedRouter |
> | `TRUSTEDROUTER_MODEL` | | Shared model for all tasks |
> | `TRUSTEDROUTER_REASONING_MODEL` | | Override model for reasoning |
> | `TRUSTEDROUTER_TOOLCALL_MODEL` | | Override model for tool calling |

> **DeepSeek**
>
> | Variable | Default | Description |
> | - | - | - |
> | `DEEPSEEK_API_KEY` | | API key for DeepSeek |
> | `DEEPSEEK_MODEL` | | Shared model for all tasks |
> | `DEEPSEEK_REASONING_MODEL` | | Override model for reasoning |
> | `DEEPSEEK_TOOLCALL_MODEL` | | Override model for tool calling |

> **Google Gemini**
>
> | Variable | Default | Description |
> | - | - | - |
> | `GEMINI_API_KEY` | | API key for Google Gemini |
> | `GEMINI_MODEL` | | Shared model for all tasks |
> | `GEMINI_REASONING_MODEL` | | Override model for reasoning |
> | `GEMINI_TOOLCALL_MODEL` | | Override model for tool calling |

> **NVIDIA**
>
> | Variable | Default | Description |
> | - | - | - |
> | `NVIDIA_API_KEY` | | API key for NVIDIA NIM |
> | `NVIDIA_MODEL` | | Shared model for all tasks |
> | `NVIDIA_REASONING_MODEL` | | Override model for reasoning |
> | `NVIDIA_TOOLCALL_MODEL` | | Override model for tool calling |

> **MiniMax**
>
> | Variable | Default | Description |
> | - | - | - |
> | `MINIMAX_API_KEY` | | API key for MiniMax |
> | `MINIMAX_MODEL` | | Shared model for all tasks |
> | `MINIMAX_REASONING_MODEL` | | Override model for reasoning |
> | `MINIMAX_TOOLCALL_MODEL` | | Override model for tool calling |

> **Groq**
>
> | Variable | Default | Description |
> | - | - | - |
> | `GROQ_API_KEY` | | API key for Groq |
> | `GROQ_MODEL` | | Shared model for all tasks |
> | `GROQ_REASONING_MODEL` | | Override model for reasoning |
> | `GROQ_TOOLCALL_MODEL` | | Override model for tool calling |

> **Azure OpenAI**
>
> | Variable | Default | Description |
> | - | - | - |
> | `AZURE_OPENAI_BASE_URL` | | Azure OpenAI resource URL (`https://<resource>.openai.azure.com`) |
> | `AZURE_OPENAI_API_KEY` | | API key for Azure OpenAI |
> | `AZURE_OPENAI_API_VERSION` | `2024-10-21` | Azure OpenAI API version |
> | `AZURE_OPENAI_MODEL` | | Shared deployment name for all slots |
> | `AZURE_OPENAI_REASONING_MODEL` | `gpt-5.4-mini` | Deployment for reasoning tasks |
> | `AZURE_OPENAI_CLASSIFICATION_MODEL` | `gpt-5.4-mini` | Deployment for classification |
> | `AZURE_OPENAI_TOOLCALL_MODEL` | `gpt-5.4-mini` | Deployment for tool calling |

> **Amazon Bedrock**
>
> | Variable | Default | Description |
> | - | - | - |
> | `BEDROCK_REASONING_MODEL` | | Model for reasoning tasks |
> | `BEDROCK_TOOLCALL_MODEL` | | Model for tool calling |
> | `BEDROCK_CLASSIFICATION_MODEL` | `us.anthropic.claude-sonnet-4-6` | Model for classification |

> **Google Vertex AI**
>
> | Variable | Default | Description |
> | - | - | - |
> | `VERTEX_AI_PROJECT` | | GCP project ID (required for Vertex) |
> | `VERTEX_AI_LOCATION` | `us-central1` | Vertex AI region |
> | `VERTEX_AI_REASONING_MODEL` | `gemini-2.5-pro` | Model for reasoning |
> | `VERTEX_AI_TOOLCALL_MODEL` | `gemini-2.5-flash-lite` | Model for tool calling |
> | `VERTEX_AI_CLASSIFICATION_MODEL` | `gemini-2.5-flash` | Model for classification |
> | `VERTEX_AI_MODEL` | | Shared model override for all slots |

> **Ollama (Local)**
>
> | Variable | Default | Description |
> | - | - | - |
> | `OLLAMA_MODEL` | `llama3.2` | Model name in Ollama |
> | `OLLAMA_HOST` | `http://localhost:11434` | Ollama server URL |

## LLM Reasoning Effort

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_REASONING_EFFORT` | | Effort for extended-thinking models: `low`, `medium`, `high`, or `xhigh`. Unset keeps the provider default, except GPT-6.1 Sol on the native OpenAI SDK and Codex, which sends `xhigh` (extra high) |

## CLI providers

> **Codex**
>
> | Variable | Default | Description |
> | - | - | - |
> | `CODEX_BIN` | | Path to Codex CLI binary |
> | `CODEX_MODEL` | | Model override for Codex |

> **Claude Code**
>
> | Variable | Default | Description |
> | - | - | - |
> | `CLAUDE_CODE_BIN` | | Path to Claude Code CLI binary |
> | `CLAUDE_CODE_MODEL` | | Model override for Claude Code |

> **Gemini CLI**
>
> | Variable | Default | Description |
> | - | - | - |
> | `GEMINI_CLI_BIN` | | Path to Gemini CLI binary |
> | `GEMINI_CLI_MODEL` | | Model override for Gemini CLI |

> **Antigravity**
>
> | Variable | Default | Description |
> | - | - | - |
> | `ANTIGRAVITY_CLI_BIN` | | Path to Antigravity CLI binary |
> | `ANTIGRAVITY_CLI_MODEL` | | Model override for Antigravity |
> | `ANTIGRAVITY_CLI_TIMEOUT_SECONDS` | | Timeout for Antigravity CLI invocations |

> **OpenCode**
>
> | Variable | Default | Description |
> | - | - | - |
> | `OPENCODE_BIN` | | Path to OpenCode CLI binary |
> | `OPENCODE_MODEL` | | Model override for OpenCode |

> **Cursor**
>
> | Variable | Default | Description |
> | - | - | - |
> | `CURSOR_BIN` | | Path to Cursor CLI binary |
> | `CURSOR_MODEL` | | Model override for Cursor |

> **Kimi**
>
> | Variable | Default | Description |
> | - | - | - |
> | `KIMI_BIN` | | Path to Kimi CLI binary |
> | `KIMI_MODEL` | | Model override for Kimi |
> | `KIMI_API_KEY` | | API key for Kimi |

> **GitHub Copilot**
>
> | Variable | Default | Description |
> | - | - | - |
> | `COPILOT_BIN` | | Path to GitHub Copilot CLI binary |
> | `COPILOT_MODEL` | | Model override for Copilot |
> | `COPILOT_HOME` | | Copilot config directory override |
> | `COPILOT_GITHUB_TOKEN` | | GitHub token for Copilot auth |

> **Grok / xAI**
>
> | Variable | Default | Description |
> | - | - | - |
> | `GROK_CLI_BIN` | | Path to Grok Build CLI binary |
> | `GROK_CLI_MODEL` | | Model override for Grok Build CLI |
> | `XAI_API_KEY` | | API-key auth for Grok Build CLI |
> | `XAI_BASE_URL` | | Override xAI API base URL |
> | `GROK_CLI_TIMEOUT_SECONDS` | `300` | Timeout for Grok CLI invocations |

> **Pi**
>
> | Variable | Default | Description |
> | - | - | - |
> | `PI_BIN` | | Path to Pi CLI binary |
> | `PI_MODEL` | | Model override for Pi CLI (`provider/model`) |
> | `PI_AGENT_DIR` | | Pi agent config directory override |
> | `PI_CONFIG_DIR` | | Pi config directory override |

> **Custom endpoints**
>
> | Variable | Default | Description |
> | - | - | - |
> | `CUSTOM_OPENAI_BASE_URL` | | Base URL for an OpenAI-compatible gateway |
> | `CUSTOM_OPENAI_API_KEY` | | API key for `custom-openai` |
> | `CUSTOM_OPENAI_MODEL` | | Shared model for all `custom-openai` roles |
> | `CUSTOM_OPENAI_TOOLCALL_MODEL` | | Optional toolcall-model override |
> | `CUSTOM_ANTHROPIC_BASE_URL` | | Base URL for an Anthropic-compatible gateway |
> | `CUSTOM_ANTHROPIC_API_KEY` | | API key for `custom-anthropic` |
> | `CUSTOM_ANTHROPIC_MODEL` | | Shared model for all `custom-anthropic` roles |

## Output & Debugging

| Variable | Default | Description |
| - | - | - |
| `TRACER_VERBOSE` | `0` | Verbose OpenSRE CLI/UI output (`1`, `true`, `yes`) |
| `TRACER_OUTPUT_FORMAT` | | OpenSRE result output format |
| `TRACER_API_URL` | | Base URL for the tracer observability integration / report delivery |
| `NO_COLOR` | | Disable colored output (standard convention) |
| `COLUMNS` | `80` | Terminal column width for output formatting |
| `ENV` | `development` | Environment (`development`, `production`) |

## Credentials and authentication

For secrets (`*_TOKEN`, `*_KEY`, `*_PASSWORD`, `*_SECRET`, and similar), OpenSRE looks in this order:

1. Your process environment
2. The owner-only file `~/.opensre/credentials.json`

`opensre onboard` saves LLM credentials there so they still work after you clear `.env`.

**Not stored as secrets:** webhook-style URLs such as `SLACK_WEBHOOK_URL` and `ROCKETCHAT_WEBHOOK_URL`. Those stay in env / store only — treat them as secrets and don't log them.

Want credentials only from the environment, never on disk? Set `OPENSRE_DISABLE_KEYRING=1` and export everything yourself.

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_DISABLE_KEYRING` | `0` | Disable local credential storage; credentials must come from the environment |
| `OPENSRE_ACCOUNT_TOKEN` | | Personal OpenSRE account token; with `OPENSRE_DISABLE_KEYRING=1`, also set `OPENSRE_APP_URL` |
| `OPENSRE_APP_URL` | `https://app.opensre.com` | OpenSRE app origin; set it explicitly with an environment-only account token |
| `OPENSRE_ACCOUNT_LLM_MODEL` | `gpt-6.1-sol` | Model-family hint for a non-interactive hosted gateway using the account LLM route; override only when the web app's hosted model changes family |
| `OPENSRE_LLM_AUTH_METADATA_PATH` | `~/.opensre/llm-auth.json` | Non-secret LLM auth metadata path used by prompt-safe status checks |

## Telemetry & Monitoring

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_NO_TELEMETRY` | `0` | Disable all telemetry, including Sentry and product analytics (covers `$ai_generation` prompt/response events) |
| `OPENSRE_ANALYTICS_DISABLED` | `0` | Disable product analytics only |
| `OPENSRE_SENTRY_DISABLED` | `0` | Disable Sentry error reporting |
| `OPENSRE_SENTRY_DSN` | | Override Sentry DSN |
| `OPENSRE_SENTRY_LOGGING_DISABLED` | `0` | Disable Sentry log integration |
| `OPENSRE_DEPLOYMENT_METHOD` | `local` | Sentry deployment tag: railway, ec2, vercel, or local |
| `OPENSRE_PROMPT_LOG_DISABLED` | `0` | Disable prompt logging entirely |
| `OPENSRE_PROMPT_LOG_LOCAL_DISABLED` | `0` | Disable local prompt log file |
| `OPENSRE_PROMPT_LOG_REDACT` | `1` | Redact known token shapes from prompts/responses before local or PostHog logging |
| `OPENSRE_PROMPT_LOG_PATH` | `~/.opensre/prompt_log.jsonl` | Path to local prompt log file |
| `OPENSRE_OPERATIONS_LOG_DISABLED` | `0` | Disable the local operations log |
| `OPENSRE_OPERATIONS_LOG_PATH` | `~/.opensre/operations_log.jsonl` | Path to the local operations log |
| `OPENSRE_OPERATIONS_LOG_MAX_BYTES` | `5242880` | Rotate the local operations log after this many bytes |
| `DO_NOT_TRACK` | `0` | Honor global do-not-track preference |
| `SENTRY_TRACES_SAMPLE_RATE` | `1.0` | Trace sampling rate for Sentry |
| `SENTRY_ERROR_SAMPLE_RATE` | `1.0` | Error sampling rate for Sentry |

## Paths & Directories

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_HOME` | `~/.opensre` | Host root for scheduler files, gateway state, local configuration, and sessions when no organization context root is set |
| `OPENSRE_PROJECT_ENV_PATH` | `PROJECT_ROOT/.env` | Path to project-level `.env` file |
| `OPENSRE_WIZARD_STORE_PATH` | `~/.opensre/opensre.json` | Path to the local wizard/provider selection store |
| `OPENSRE_CONTEXT_ROOT` | | Mounted organization-scoped root for context and sessions; requires `ORGANIZATION_ID` |
| `OPENSRE_INTEGRATIONS_STORE_PATH` | | Override integrations store path |

## Conversation history

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_HISTORY_TOKEN_BUDGET` | `48000` | Estimated tokens of conversation history before it is compacted |
| `OPENSRE_TOOL_OUTPUT_TOKEN_LIMIT` | `10000` | Approximate tokens per tool observation; output keeps its beginning and end, using four UTF-8 bytes per token |
| `OPENSRE_HISTORY_TOOL_RESULT_CHARS` | | Optional additional character cap for recorded tool results; unset keeps the tool observation budget with 20% extra space |
| `OPENSRE_LLM_COMPACTION` | `1` | Set to `0` to compact history without a model-written summary |
| `OPENSRE_STRUCTURED_HISTORY` | `1` | Set to `0` to send earlier turns as one text block instead of replaying them |

## Memory

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_MEMORY_DISABLED` | `0` | Disable long-term memory |
| `OPENSRE_MEMORY_DIR` | | Override memory storage directory |
| `OPENSRE_MEMORY_AUTOEXTRACT_DISABLED` | `0` | Disable automatic memory extraction and background upkeep |
| `OPENSRE_MEMORY_GATEWAY_ENABLED` | `0` | Opt-in memory on shared gateway hosts |

## Remote sync

Mirror conversation history and memory to a user-owned object store. Details: [Remote sync](https://opensre.com/docs/install/remote-sync.md).

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_REMOTE_SYNC` | | Enable remote sync (`1`/`true`) |
| `OPENSRE_REMOTE_SYNC_PROVIDER` | `aws` | Store backend (`aws`, `gcs`, `vercel`, `azure`, or `s3compat`) |
| `OPENSRE_REMOTE_SYNC_BUCKET` | | Bucket / Blob store name (required when sync is on) |
| `OPENSRE_REMOTE_SYNC_PREFIX` | `opensre` | Key prefix inside the store |
| `OPENSRE_REMOTE_SYNC_REGION` | | Region override |
| `OPENSRE_REMOTE_SYNC_PROFILE` | | Named credentials profile |
| `OPENSRE_REMOTE_SYNC_ENDPOINT_URL` | | Custom S3 endpoint when provider is `s3compat` |
| `OPENSRE_REMOTE_SYNC_EXCLUDE` | | Comma-separated globs to exclude from sync |
| `OPENSRE_REMOTE_SYNC_EXCLUDE_OFF` | | Ignore configured exclusions for one run |
| `BLOB_READ_WRITE_TOKEN` | | Vercel Blob token (when provider is `vercel`) |

## Masking

| Variable | Default | Description |
| - | - | - |
| `OPENSRE_MASK_ENABLED` | `false` | Enable reversible identifier masking before external LLM calls |
| `OPENSRE_MASK_KINDS` | | Comma-separated mask kinds to enable |
| `OPENSRE_MASK_EXTRA_REGEX` | | JSON map of extra mask kinds to regex patterns |

## Feature Flags

| Variable | Default | Description |
| - | - | - |
| `OSRE_HELM_INTEGRATION` | | Enable Helm integration (1/true/yes) |
| `HELM_PATH` | `helm` | Path to the Helm binary |
| `HELM_KUBE_CONTEXT` | | kubectl context for Helm |
| `HELM_KUBECONFIG` | | kubeconfig path for Helm |
| `HELM_NAMESPACE` | | Default Helm namespace |
| `OPENSRE_RELEASES_API_URL` | GitHub releases API | Override releases API endpoint |

## Gateway and scheduler runtime

| Variable | Default | Description |
| - | - | - |
| `MODE` | `web` | Container entrypoint: `web`, `gateway`, or `scheduler` |
| `PORT` | `8000` | HTTP port for the web surface |
| `OPENSRE_HOME` | `~/.opensre` | Host root for scheduler files, gateway state, local configuration, and sessions when `OPENSRE_CONTEXT_ROOT` is unset |
| `DATABASE_URL` | | Postgres connection for gateway records shared across replicas; required for Slack Events API unless the single-replica local-dedup escape hatch is enabled |
| `OPENSRE_SIZE_PROFILE` | `SMALL` | Deployment size profile; default turn caps are `SMALL=1`, `MEDIUM=2`, `LARGE=4` |
| `OPENSRE_MAX_CONCURRENT_TURNS` | size-profile limit | Override the process-wide concurrent-turn cap with a positive integer |
| `OPENSRE_SCHEDULER_MAX_CONCURRENT_RUNS` | `2` | Maximum scheduled callbacks executing at once; agent turns also need a process-wide turn permit |
| `OPENSRE_GATEWAY_HOST_SCHEDULER` | `1` | Run the scheduler inside the gateway; set `0` when a dedicated `MODE=scheduler` service owns it |
| `OPENSRE_SESSION_FILE_LOCK` | `0` | Serialize session-file writes with an OS lock; a shared mount is still required across processes |

## Integration credentials

> **Observability & Monitoring**
>
> | Variable | Default | Description |
> | - | - | - |
> | `GRAFANA_INSTANCE_URL` | | Grafana instance URL |
> | `GRAFANA_READ_TOKEN` | | Grafana API token |
> | `GRAFANA_LOKI_DATASOURCE_UID` | | UID of Loki datasource in Grafana |
> | `GRAFANA_TEMPO_DATASOURCE_UID` | | UID of Tempo datasource in Grafana |
> | `GRAFANA_MIMIR_DATASOURCE_UID` | | UID of Mimir datasource in Grafana |
> | `TEMPO_URL` | | Grafana Tempo / Tempo API base URL |
> | `TEMPO_API_KEY` | | Tempo API key (or use username/password) |
> | `TEMPO_USERNAME` | | Tempo basic-auth username |
> | `TEMPO_PASSWORD` | | Tempo basic-auth password |
> | `TEMPO_ORG_ID` | | Tempo org ID (multi-tenant) |
> | `GRAFANA_VERIFY_SSL` | `true` | Verify Grafana SSL certificate |
> | `GRAFANA_CA_BUNDLE` | | Path to a CA bundle for Grafana TLS verification (self-signed/internal CA) |
> | `DD_API_KEY` | | Datadog API key |
> | `DD_APP_KEY` | | Datadog application key |
> | `DD_SITE` | `datadoghq.com` | Datadog site (us/eu) |
> | `GROUNDCOVER_API_KEY` | | groundcover read-only service-account token (alias: `GROUNDCOVER_MCP_TOKEN`) |
> | `GROUNDCOVER_MCP_URL` | `https://mcp.groundcover.com/api/mcp` | groundcover MCP endpoint |
> | `GROUNDCOVER_TENANT_UUID` | | Tenant UUID (multi-workspace accounts) |
> | `GROUNDCOVER_BACKEND_ID` | | Backend ID (multi-backend tenants) |
> | `GROUNDCOVER_TIMEZONE` | `UTC` | Timezone for returned timestamps (`X-Timezone`) |
> | `HONEYCOMB_API_KEY` | | Honeycomb API key |
> | `HONEYCOMB_DATASET` | `__all__` | Honeycomb dataset slug |
> | `HONEYCOMB_API_URL` | `https://api.honeycomb.io` | Honeycomb API endpoint |
> | `CORALOGIX_API_KEY` | | Coralogix API key |
> | `CORALOGIX_API_URL` | `https://api.coralogix.com` | Coralogix API endpoint |
> | `CORALOGIX_APPLICATION_NAME` | | Application name in Coralogix |
> | `CORALOGIX_SUBSYSTEM_NAME` | | Subsystem name in Coralogix |
> | `SIGNOZ_URL` | | SigNoz instance URL |
> | `SIGNOZ_API_KEY` | | SigNoz API key |
> | `ALERTMANAGER_URL` | | Alertmanager URL |
> | `ALERTMANAGER_BEARER_TOKEN` | | Bearer token for Alertmanager |
> | `ALERTMANAGER_USERNAME` | | Username for Alertmanager basic auth |
> | `ALERTMANAGER_PASSWORD` | | Password for Alertmanager basic auth |
> | `SPLUNK_URL` | | Splunk instance URL |
> | `SPLUNK_TOKEN` | | Splunk API token |
> | `SPLUNK_INDEX` | `main` | Splunk index |
> | `SPLUNK_VERIFY_SSL` | `true` | Verify Splunk SSL certificate |
> | `SPLUNK_CA_BUNDLE` | | Path to a CA bundle for Splunk TLS verification |
> | `SENTRY_URL` | `https://sentry.io` | Sentry instance URL |
> | `SENTRY_ORG_SLUG` | | Sentry organization slug |
> | `SENTRY_PROJECT_SLUG` | | Sentry project slug |
> | `SENTRY_AUTH_TOKEN` | | Sentry auth token |
> | `POSTHOG_PROJECT_ID` | | PostHog project ID |
> | `POSTHOG_PERSONAL_API_KEY` | | PostHog personal API key |
> | `POSTHOG_BASE_URL` | `https://us.posthog.com` | PostHog app URL (`https://eu.posthog.com` for EU) |
> | `POSTHOG_TIMEOUT_SECONDS` | `15.0` | Timeout in seconds for PostHog API requests |
> | `NEW_RELIC_API_KEY` | | New Relic User key (`NRAK-...`) |
> | `NEW_RELIC_ACCOUNT_ID` | | New Relic account ID |
> | `NEW_RELIC_API_URL` | `https://api.newrelic.com` | New Relic API URL (EU/JP endpoints supported) |

> **Cloud Platforms**
>
> | Variable | Default | Description |
> | - | - | - |
> | `AWS_REGION` | `us-east-1` | AWS region |
> | `AWS_ROLE_ARN` | | AWS role ARN for cross-account access |
> | `AWS_EXTERNAL_ID` | | External ID for AWS cross-account role |
> | `AWS_ACCESS_KEY_ID` | | AWS access key |
> | `AWS_SECRET_ACCESS_KEY` | | AWS secret access key |
> | `AWS_SESSION_TOKEN` | | AWS session token |
> | `CLOUD_PROVIDER` | | Cloud provider hint for ambient region discovery |
> | `CLOUD_REGION` | | Cloud region (falls back to `AWS_REGION`) |
> | `KUBECONFIG` | | Path to kubeconfig file |
> | `KUBECONFIG_CONTENT` | | Inline kubeconfig contents |
> | `KUBECONFIG_CONTEXT` | | kubectl context |
> | `KUBECONFIG_NAMESPACE` | `default` | Default Kubernetes namespace |
> | `RDS_DB_INSTANCE_IDENTIFIER` | | AWS RDS DB instance identifier |
> | `RDS_REGION` | | AWS region for RDS (falls back to `AWS_REGION`) |
> | `RAILWAY_TOKEN` | | Railway API token |
> | `RAILWAY_PROJECT` | | Railway project |
> | `RAILWAY_SERVICE` | | Railway service |
> | `RAILWAY_ENVIRONMENT` | `production` | Railway environment |
> | `RAILWAY_PATH` | `railway` | Path to Railway CLI |
> | `ARGOCD_BASE_URL` | | Argo CD API base URL |
> | `ARGOCD_AUTH_TOKEN` | | Argo CD auth token |
> | `ARGOCD_TOKEN` | | Alias for `ARGOCD_AUTH_TOKEN` |
> | `ARGOCD_USERNAME` | | Argo CD username (basic auth) |
> | `ARGOCD_PASSWORD` | | Argo CD password (basic auth) |
> | `ARGOCD_PROJECT` | | Argo CD project |
> | `ARGOCD_APP_NAMESPACE` | | Argo CD app namespace |
> | `ARGOCD_VERIFY_SSL` | `true` | Verify Argo CD TLS |

> **Messaging**
>
> | Variable | Default | Description |
> | - | - | - |
> | `SLACK_WEBHOOK_URL` | | Slack incoming webhook URL |
> | `SLACK_BOT_TOKEN` | | Slack bot token |
> | `SLACK_DEFAULT_CHAT_ID` | | Default Slack channel for scheduled delivery (bot-token path) |
> | `SLACK_APP_TOKEN` | | Slack app-level token (Socket Mode) |
> | `SLACK_GATEWAY_INBOUND_TRANSPORT` | `socket_mode` | How Slack delivers events: `socket_mode` or `events_api_http` |
> | `SLACK_SIGNING_SECRET` | | Request-signature secret. Required for `events_api_http` |
> | `SLACK_GATEWAY_HTTP_PORT` | `3000` | Port the `events_api_http` listener binds |
> | `SLACK_GATEWAY_ALLOW_LOCAL_DEDUP` | | Accept process-local event dedup when `DATABASE_URL` is unset. Single replica only |
> | `SLACK_GATEWAY_MAX_CONCURRENT` | size-profile limit | Parallel Slack turns before the process-wide cap is applied |
> | `SLACK_ALLOWED_USERS` | | Comma-separated Slack user IDs allowed to talk to the bot |
> | `SLACK_ALLOW_OPEN_WORKSPACE` | | Allow any workspace user (`1` for dogfood) |
> | `SLACK_ACCESS_TOKEN` | | Slack user token |
> | `SLACK_GITHUB_ISSUES_WEBHOOK_URL` | | Slack webhook for GitHub issues |
> | `DISCORD_BOT_TOKEN` | | Discord bot token |
> | `DISCORD_APPLICATION_ID` | | Discord application ID |
> | `DISCORD_PUBLIC_KEY` | | Discord public key |
> | `DISCORD_DEFAULT_CHANNEL_ID` | | Default Discord channel |
> | `DISCORD_ALLOWED_USERS` | | Comma-separated Discord user IDs allowed to talk to the bot |
> | `DISCORD_ALLOW_OPEN_GUILD` | | Allow any guild member (`1` for dogfood) |
> | `DISCORD_GATEWAY_MAX_CONCURRENT` | size-profile limit | Parallel Discord turns before the process-wide cap is applied |
> | `TELEGRAM_BOT_TOKEN` | | Telegram bot token |
> | `TELEGRAM_DEFAULT_CHAT_ID` | | Default Telegram chat ID |
> | `TELEGRAM_ALLOWED_USERS` | | Comma-separated Telegram user IDs allowed to talk to the bot |
> | `TELEGRAM_GATEWAY_MAX_CONCURRENT` | size-profile limit | Parallel Telegram turns before the process-wide cap is applied |
> | `BUZZ_PRIVATE_KEY` | | Nostr private key used by the Buzz integration and gateway |
> | `BUZZ_RELAY_URL` | `http://localhost:3000` | Buzz relay URL |
> | `BUZZ_DEFAULT_CHANNEL` | | Default Buzz channel UUID for delivery |
> | `BUZZ_AUTH_TAG` | | Optional NIP-OA owner-attestation JSON |
> | `BUZZ_PATH` | `buzz` | Path to the Buzz CLI |
> | `BUZZ_ALLOWED_PUBKEYS` | | Comma-separated 64-character hex pubkeys allowed to talk to the gateway |
> | `BUZZ_GATEWAY_MAX_CONCURRENT` | `4` | Parallel Buzz turns before the process-wide cap is applied |
> | `ROCKETCHAT_SERVER_URL` | | Rocket.Chat server base URL |
> | `ROCKETCHAT_AUTH_TOKEN` | | Rocket.Chat personal access token |
> | `ROCKETCHAT_USER_ID` | | Rocket.Chat user ID for the token |
> | `ROCKETCHAT_DEFAULT_CHANNEL` | | Default Rocket.Chat channel |
> | `ROCKETCHAT_WEBHOOK_URL` | | Rocket.Chat incoming webhook URL |
> | `TWILIO_ACCOUNT_SID` | | Twilio account SID |
> | `TWILIO_AUTH_TOKEN` | | Twilio auth token |
> | `TWILIO_WHATSAPP_FROM` | | WhatsApp sender number (Twilio) |
> | `WHATSAPP_DEFAULT_TO` | | Default WhatsApp recipient |
> | `TWILIO_SMS_FROM` | | SMS sender number (Twilio) |
> | `TWILIO_SMS_MESSAGING_SERVICE_SID` | | SMS messaging service SID |
> | `TWILIO_SMS_DEFAULT_TO` | | Default SMS recipient |
> | `SMTP_HOST` | | SMTP server hostname |
> | `SMTP_PORT` | `587` | SMTP port |
> | `SMTP_SECURITY` | `starttls` | SMTP security (`starttls`, `ssl`, or `none`) |
> | `SMTP_USERNAME` | | SMTP username |
> | `SMTP_PASSWORD` | | SMTP password |
> | `SMTP_FROM_ADDRESS` | | From address for outbound mail |
> | `SMTP_DEFAULT_TO` | | Default recipient for notifications |

> **Code & Collaboration**
>
> | Variable | Default | Description |
> | - | - | - |
> | `GITHUB_MCP_MODE` | `streamable-http` | GitHub MCP transport mode |
> | `GITHUB_MCP_URL` | | GitHub MCP server URL |
> | `GITHUB_MCP_COMMAND` | | GitHub MCP command to execute |
> | `GITHUB_MCP_ARGS` | | GitHub MCP command arguments |
> | `GITHUB_MCP_AUTH_TOKEN` | | Does not authorize agent GitHub tools |
> | `GITHUB_MCP_TOOLSETS` | `repos,issues,pull_requests,actions,search` | Enabled GitHub MCP toolsets |
> | `OPENSRE_GITHUB_MCP_REPO_PROBE_LIMIT` | `50` | Max repos to probe (5-500) |
> | `GITLAB_BASE_URL` | | GitLab instance URL |
> | `GITLAB_ACCESS_TOKEN` | | GitLab personal access token |
> | `GITLAB_PROJECT_ID` | | GitLab project ID |
> | `JIRA_BASE_URL` | | Jira instance URL |
> | `JIRA_EMAIL` | | Jira user email |
> | `JIRA_API_TOKEN` | | Jira API token |
> | `JIRA_PROJECT_KEY` | | Default Jira project key |
> | `BITBUCKET_WORKSPACE` | | Bitbucket workspace name |
> | `BITBUCKET_USERNAME` | | Bitbucket username |
> | `BITBUCKET_APP_PASSWORD` | | Bitbucket app password |
> | `BITBUCKET_MAX_RESULTS` | `25` | Max results per API call |
> | `INCIDENT_IO_BASE_URL` | | incident.io API URL |
> | `INCIDENT_IO_API_KEY` | | incident.io API key |
> | `PAGERDUTY_API_KEY` | | PagerDuty API key |
> | `PAGERDUTY_BASE_URL` | | PagerDuty API base URL |
> | `SERVICENOW_INSTANCE_URL` | | ServiceNow instance URL |
> | `SERVICENOW_USERNAME` | | ServiceNow username |
> | `SERVICENOW_PASSWORD` | | ServiceNow password |
> | `VERCEL_API_TOKEN` | | Vercel API token |
> | `VERCEL_TEAM_ID` | | Vercel team ID |
> | `VERCEL_RUNTIME_LOGS_READ_TIMEOUT` | `600` | Seconds to wait per Vercel runtime-log read (minimum `30`) |
> | `GOOGLE_CREDENTIALS_FILE` | | Path to Google service-account JSON for Docs export |
> | `GOOGLE_DRIVE_FOLDER_ID` | | Google Drive folder for Docs export |

> **Databases**
>
> | Variable | Default | Description |
> | - | - | - |
> | `MONGODB_CONNECTION_STRING` | | MongoDB connection string |
> | `MONGODB_DATABASE` | | MongoDB database name |
> | `MONGODB_AUTH_SOURCE` | `admin` | MongoDB auth source |
> | `MONGODB_TLS` | `true` | Enable MongoDB TLS |
> | `MONGODB_ATLAS_PUBLIC_KEY` | | MongoDB Atlas public API key |
> | `MONGODB_ATLAS_PRIVATE_KEY` | | MongoDB Atlas private API key |
> | `MONGODB_ATLAS_PROJECT_ID` | | MongoDB Atlas project ID |
> | `MONGODB_ATLAS_BASE_URL` | `https://cloud.mongodb.com/api/atlas/v2` | MongoDB Atlas API base URL |
> | `REDIS_HOST` | | Redis host |
> | `REDIS_PORT` | `6379` | Redis port |
> | `REDIS_USERNAME` | | Redis ACL username (Redis 6+) |
> | `REDIS_PASSWORD` | | Redis password |
> | `REDIS_DATABASE` | `0` | Redis database number |
> | `REDIS_SSL` | `false` | Connect using TLS |
> | `POSTGRESQL_HOST` | | PostgreSQL host |
> | `POSTGRESQL_PORT` | `5432` | PostgreSQL port |
> | `POSTGRESQL_DATABASE` | | PostgreSQL database name |
> | `POSTGRESQL_USERNAME` | `postgres` | PostgreSQL username |
> | `POSTGRESQL_PASSWORD` | | PostgreSQL password |
> | `POSTGRESQL_SSL_MODE` | `prefer` | PostgreSQL SSL mode |
> | `MYSQL_HOST` | | MySQL host |
> | `MYSQL_PORT` | `3306` | MySQL port |
> | `MYSQL_DATABASE` | | MySQL database name |
> | `MYSQL_USERNAME` | `root` | MySQL username |
> | `MYSQL_PASSWORD` | | MySQL password |
> | `MYSQL_SSL_MODE` | `preferred` | MySQL SSL mode |
> | `MARIADB_HOST` | | MariaDB host |
> | `MARIADB_PORT` | `3306` | MariaDB port |
> | `MARIADB_DATABASE` | | MariaDB database name |
> | `MARIADB_USERNAME` | | MariaDB username |
> | `MARIADB_PASSWORD` | | MariaDB password |
> | `MARIADB_SSL` | `true` | Enable MariaDB SSL |

> **Message Queues & Other Services**
>
> | Variable | Default | Description |
> | - | - | - |
> | `RABBITMQ_HOST` | | RabbitMQ host |
> | `RABBITMQ_MANAGEMENT_PORT` | `15672` | RabbitMQ management port |
> | `RABBITMQ_USERNAME` | | RabbitMQ username |
> | `RABBITMQ_PASSWORD` | | RabbitMQ password |
> | `RABBITMQ_VHOST` | `/` | RabbitMQ vhost |
> | `RABBITMQ_SSL` | `false` | Enable RabbitMQ SSL |
> | `RABBITMQ_VERIFY_SSL` | `true` | Verify RabbitMQ SSL certificate |
> | `BETTERSTACK_QUERY_ENDPOINT` | | Better Stack query endpoint |
> | `BETTERSTACK_USERNAME` | | Better Stack username |
> | `BETTERSTACK_PASSWORD` | | Better Stack password |
> | `BETTERSTACK_SOURCES` | | Better Stack sources |
> | `KAFKA_BOOTSTRAP_SERVERS` | | Kafka broker addresses |
> | `KAFKA_SECURITY_PROTOCOL` | `PLAINTEXT` | Kafka security protocol |
> | `KAFKA_SASL_MECHANISM` | | Kafka SASL mechanism |
> | `KAFKA_SASL_USERNAME` | | Kafka SASL username |
> | `KAFKA_SASL_PASSWORD` | | Kafka SASL password |
> | `DAGSTER_ENDPOINT` | | Dagster GraphQL endpoint |
> | `DAGSTER_API_TOKEN` | | Dagster Cloud User Token (leave empty for unauthenticated local OSS) |
> | `TEMPORAL_API_URL` | | Temporal Cloud / server API URL |
> | `TEMPORAL_NAMESPACE` | `default` | Temporal namespace |
> | `TEMPORAL_API_KEY` | | Temporal API key (optional for local) |
> | `JENKINS_URL` | | Jenkins base URL |
> | `JENKINS_USER` | | Jenkins username |
> | `JENKINS_API_TOKEN` | | Jenkins API token |

> **Data & Search**
>
> | Variable | Default | Description |
> | - | - | - |
> | `OPENSEARCH_URL` | | OpenSearch instance URL |
> | `OPENSEARCH_USERNAME` | | OpenSearch username |
> | `OPENSEARCH_PASSWORD` | | OpenSearch password |
> | `OPENSEARCH_API_KEY` | | OpenSearch API key (alternative to username/password) |
> | `OPENSEARCH_INDEX_PATTERN` | `*` | OpenSearch index pattern |
> | `OPENSEARCH_MAX_RESULTS` | `100` | Max OpenSearch results |
> | `OPENOBSERVE_URL` | | OpenObserve instance URL |
> | `OPENOBSERVE_TOKEN` | | OpenObserve API token |
> | `OPENOBSERVE_USERNAME` | | OpenObserve username |
> | `OPENOBSERVE_PASSWORD` | | OpenObserve password |
> | `OPENOBSERVE_ORG` | `default` | OpenObserve organization |
> | `OPENOBSERVE_STREAM` | | OpenObserve stream |
> | `OPENOBSERVE_MAX_RESULTS` | `100` | Max OpenObserve results |
> | `VICTORIA_LOGS_URL` | | VictoriaLogs instance URL |
> | `VICTORIA_LOGS_TENANT_ID` | | VictoriaLogs tenant ID |
> | `CLICKHOUSE_HOST` | | ClickHouse host |
> | `CLICKHOUSE_PORT` | `8123` | ClickHouse port |
> | `CLICKHOUSE_DATABASE` | `default` | ClickHouse database |
> | `CLICKHOUSE_USER` | `default` | ClickHouse username |
> | `CLICKHOUSE_PASSWORD` | | ClickHouse password |
> | `CLICKHOUSE_SECURE` | `false` | Enable ClickHouse TLS |
> | `SNOWFLAKE_ACCOUNT_IDENTIFIER` | | Snowflake account identifier |
> | `SNOWFLAKE_ACCOUNT` | | Snowflake account (alternative) |
> | `SNOWFLAKE_TOKEN` | | Snowflake token |
> | `SNOWFLAKE_USER` | | Snowflake username |
> | `SNOWFLAKE_PASSWORD` | | Snowflake password |
> | `SNOWFLAKE_WAREHOUSE` | | Snowflake warehouse |
> | `SNOWFLAKE_ROLE` | | Snowflake role |
> | `SNOWFLAKE_DATABASE` | | Snowflake database |
> | `SNOWFLAKE_SCHEMA` | | Snowflake schema |
> | `SNOWFLAKE_MAX_RESULTS` | `50` | Max Snowflake results |
> | `AZURE_SQL_SERVER` | | Azure SQL server name |
> | `AZURE_SQL_DATABASE` | | Azure SQL database name |
> | `AZURE_SQL_PORT` | `1433` | Azure SQL port |
> | `AZURE_SQL_USERNAME` | | Azure SQL username |
> | `AZURE_SQL_PASSWORD` | | Azure SQL password |
> | `AZURE_SQL_DRIVER` | `ODBC Driver 18 for SQL Server` | Azure SQL ODBC driver |
> | `AZURE_SQL_ENCRYPT` | `true` | Enable Azure SQL encryption |
> | `AZURE_LOG_ANALYTICS_WORKSPACE_ID` | | Azure Log Analytics workspace ID |
> | `AZURE_LOG_ANALYTICS_TOKEN` | | Azure Log Analytics token |
> | `AZURE_LOG_ANALYTICS_ENDPOINT` | `https://api.loganalytics.io` | Log Analytics Query API endpoint (sovereign clouds) |
> | `AZURE_TENANT_ID` | | Azure tenant ID |
> | `AZURE_SUBSCRIPTION_ID` | | Azure subscription ID |
> | `AZURE_MAX_RESULTS` | `100` | Max Azure results |

> **MCP Servers**
>
> | Variable | Default | Description |
> | - | - | - |
> | `POSTHOG_MCP_MODE` | `streamable-http` | PostHog MCP transport mode |
> | `POSTHOG_MCP_URL` | `https://mcp.posthog.com/mcp` | PostHog MCP URL |
> | `POSTHOG_MCP_AUTH_TOKEN` | | PostHog MCP auth token |
> | `POSTHOG_MCP_PROJECT_ID` | | PostHog project scoped to MCP |
> | `POSTHOG_MCP_ORGANIZATION_ID` | | PostHog organization scoped to MCP |
> | `POSTHOG_MCP_FEATURES` | | Comma-separated PostHog MCP features |
> | `POSTHOG_MCP_READ_ONLY` | `true` | Restrict PostHog MCP to read-only |
> | `POSTHOG_MCP_COMMAND` | | PostHog MCP stdio command |
> | `POSTHOG_MCP_ARGS` | | PostHog MCP stdio args |
> | `SENTRY_MCP_MODE` | `streamable-http` | Sentry MCP transport mode |
> | `SENTRY_MCP_URL` | `https://mcp.sentry.dev/mcp` | Sentry MCP URL |
> | `SENTRY_MCP_AUTH_TOKEN` | | Sentry MCP auth token |
> | `SENTRY_MCP_HOST` | | Self-hosted Sentry MCP host |
> | `SENTRY_MCP_ORGANIZATION_SLUG` | | Sentry org slug for MCP |
> | `SENTRY_MCP_PROJECT_SLUG` | | Sentry project slug for MCP |
> | `SENTRY_MCP_SKILLS` | | Enabled Sentry MCP skills |
> | `SENTRY_MCP_COMMAND` | | Sentry MCP stdio command |
> | `SENTRY_MCP_ARGS` | | Sentry MCP stdio args |

> **Git Integrations**
>
> | Variable | Default | Description |
> | - | - | - |
> | `GITHUB_EVENT_PATH` | | GitHub Actions event payload path |
> | `GITHUB_REPOSITORY` | | GitHub repository (owner/repo) |
> | `GITHUB_TOKEN` | | Does not authorize agent GitHub tools; connect GitHub in the OpenSRE app |
> | `GH_TOKEN` | | Does not authorize agent GitHub tools |

## Multi-instance integrations

Need more than one Datadog, Grafana, or AWS account (for example prod and staging)? Use a JSON `*_INSTANCES` variable:

| Variable | What it configures |
| - | - |
| `GRAFANA_INSTANCES` | Multiple Grafana instances |
| `DD_INSTANCES` | Multiple Datadog sites/accounts |
| `GROUNDCOVER_INSTANCES` | Multiple groundcover instances |
| `HONEYCOMB_INSTANCES` | Multiple Honeycomb instances |
| `CORALOGIX_INSTANCES` | Multiple Coralogix instances |
| `SPLUNK_INSTANCES` | Multiple Splunk instances |
| `AWS_INSTANCES` | Multiple AWS accounts |
| `ARGOCD_INSTANCES` | Multiple Argo CD instances |

Format and examples: [Multi-instance integrations](https://opensre.com/docs/platform/multi-instance-integrations.md).

## LLM classification models

If you don't set these, OpenSRE falls back to the reasoning model (or the provider default):

| Variable | Default | Description |
| - | - | - |
| `ANTHROPIC_CLASSIFICATION_MODEL` | | Anthropic classification model |
| `OPENAI_CLASSIFICATION_MODEL` | | OpenAI classification model |
| `OPENROUTER_CLASSIFICATION_MODEL` | | OpenRouter classification model |
| `TRUSTEDROUTER_CLASSIFICATION_MODEL` | | TrustedRouter classification model |
| `DEEPSEEK_CLASSIFICATION_MODEL` | | DeepSeek classification model |
| `GEMINI_CLASSIFICATION_MODEL` | | Gemini classification model |
| `NVIDIA_CLASSIFICATION_MODEL` | | NVIDIA classification model |
| `MINIMAX_CLASSIFICATION_MODEL` | | MiniMax classification model |
| `GROQ_CLASSIFICATION_MODEL` | | Groq classification model |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.