Generated by labby docs generate. Do not edit by hand.
Required applies when the owning service or workflow is used, not to every Labby process. OAuth provider credentials are required only for the selected provider; configure exactly one inbound provider. Descriptions identify conditional requirements. See Environment and OAuth for configuration and admission rules.
| Service | Env Var | Required | Secret | Example | Description |
|---|---|---|---|---|---|
agents |
LABBY_AGENT_PROVIDER_PROTOCOL |
false | false | openai |
Built-in Agent provider protocol: openai uses standard models and chat/completions endpoints; phoenix also uses provider session extensions. Omitted retains legacy phoenix behavior; select openai for a standard provider |
agents |
LABBY_PHOENIX_OPENAI_API_KEY |
false | true | <labby_phoenix_openai_api_key> |
Bearer credential sent to the OpenAI-compatible Agent execution provider when it requires one |
agents |
LABBY_PHOENIX_OPENAI_BASE_URL |
false | false | http://127.0.0.1:43871/v1 |
OpenAI-compatible provider base URL used by Agent and Agent Task execution; must be reachable from the Labby process and carry no credentials, query, or fragment |
auth |
LABBY_AUTHELIA_CA_CERT_PATH |
false | false | /etc/labby/authelia-ca.pem |
PEM CA certificate trusted only for the exact Authelia issuer origin |
auth |
LABBY_AUTHELIA_CLIENT_ID |
true | false | labby |
Authelia confidential OIDC client identifier; required when OAuth mode selects Authelia |
auth |
LABBY_AUTHELIA_CLIENT_SECRET |
true | true | <labby_authelia_client_secret> |
Authelia confidential OIDC client secret; required when OAuth mode selects Authelia |
auth |
LABBY_AUTHELIA_ISSUER_URL |
true | false | https://auth.example.com |
Exact Authelia OIDC issuer URL; required when OAuth mode selects Authelia |
auth |
LABBY_AUTHELIA_TRUSTED_PRIVATE_ORIGIN |
false | false | https://auth.example.com |
Exact HTTPS private issuer origin explicitly trusted by the operator |
auth |
LABBY_AUTH_ACCESS_TOKEN_TTL_SECS |
false | false | 3600 |
Labby access-token lifetime in seconds |
auth |
LABBY_AUTH_ADMIN_EMAIL |
true | false | admin@example.com |
Administrator email, or comma-separated emails, required in oauth mode |
auth |
LABBY_AUTH_ALLOWED_EMAIL_DOMAINS |
false | false | example.com |
Comma-separated admission-domain allowlist: Google Workspace hosted domains or verified Authelia email domains |
auth |
LABBY_AUTH_ALLOWED_REDIRECT_URIS |
false | false | https://chatgpt.com/connector/oauth/* |
Comma-separated exact or wildcard OAuth redirect allowlist |
auth |
LABBY_AUTH_AUTHORIZE_REQUESTS_PER_MINUTE |
false | false | 60 |
Per-IP authorization and browser-login rate limit |
auth |
LABBY_AUTH_CODEX_ISSUER_COMPATIBILITY |
false | false | false |
Temporary compatibility switch for clients without RFC 9207 response issuer support |
auth |
LABBY_AUTH_CODE_TTL_SECS |
false | false | 300 |
Authorization-code lifetime in seconds |
auth |
LABBY_AUTH_DESKTOP_ORIGIN |
false | false | https://lab.example.com |
Trusted Control Plane origin for desktop browser-session handoff; defaults to public URL origin |
auth |
LABBY_AUTH_ENABLE_DYNAMIC_REGISTRATION |
false | false | true |
Enable RFC 7591 client registration; set false to require CIMD or preregistered clients |
auth |
LABBY_AUTH_ENTERPRISE_ISSUERS_JSON |
false | true | [] |
Trusted enterprise issuer definitions |
auth |
LABBY_AUTH_KEY_PATH |
false | true | $LABBY_HOME/auth-jwt.pem |
OAuth JWT signing-key path |
auth |
LABBY_AUTH_MACHINE_CLIENTS_JSON |
false | true | [] |
Preregistered machine-client definitions |
auth |
LABBY_AUTH_MAX_PENDING_OAUTH_STATES |
false | false | 1024 |
Maximum non-expired pending OAuth states |
auth |
LABBY_AUTH_MODE |
false | false | bearer |
Inbound authentication mode: bearer or oauth |
auth |
LABBY_AUTH_PROVIDER |
false | false | authelia |
Inbound identity provider: google or authelia; inferred from credentials when omitted, with exactly one provider configured |
auth |
LABBY_AUTH_REFRESH_TOKEN_TTL_SECS |
false | false | 2592000 |
Labby refresh-token lifetime in seconds |
auth |
LABBY_AUTH_REGISTER_REQUESTS_PER_MINUTE |
false | false | 20 |
Per-IP dynamic-client-registration rate limit |
auth |
LABBY_AUTH_SCOPES_SUPPORTED |
false | false | lab:read,lab,lab:admin |
Comma-separated scopes advertised and accepted for the canonical protected resource |
auth |
LABBY_AUTH_SQLITE_PATH |
false | false | $LABBY_HOME/auth.db |
OAuth authorization-state SQLite database path |
auth |
LABBY_AUTH_TOKEN_REQUESTS_PER_MINUTE |
false | false | 120 |
Per-IP token and revocation endpoint rate limit |
auth |
LABBY_AUTH_VIEWER_EMAIL_DOMAINS |
false | false | example.com |
Exact verified-email domains admitted as browser Viewers without administrative OAuth scopes |
auth |
LABBY_GOOGLE_CALLBACK_PATH |
false | false | /auth/google/callback |
Google OAuth callback path |
auth |
LABBY_GOOGLE_CALLBACK_URL |
false | false | https://lab.example.com/auth/google/callback |
Absolute Google OAuth callback URL override |
auth |
LABBY_GOOGLE_CLIENT_ID |
true | false | google-client-id |
Google OAuth client identifier; required when OAuth mode selects Google |
auth |
LABBY_GOOGLE_CLIENT_SECRET |
true | true | <labby_google_client_secret> |
Google OAuth client secret; required when OAuth mode selects Google |
auth |
LABBY_GOOGLE_SCOPES |
false | false | openid,email,profile |
Comma-separated Google OAuth scopes |
auth |
LABBY_MCP_HTTP_TOKEN |
false | true | <labby_mcp_http_token> |
Static bearer token for protected HTTP routes in bearer mode |
auth |
LABBY_PUBLIC_URL |
true | false | https://lab.example.com |
Canonical public application URL and OAuth issuer |
auth |
LABBY_TOKEN_ENCRYPTION_KEY |
true | true | <64-hex-or-base64url-key> |
Encryption key for persisted provider access and refresh tokens |
lab |
LABBY_LOG |
false | false | labby=info,labby_apis=warn |
Tracing filter directive |
lab |
LABBY_LOG_FORMAT |
false | false | json |
Tracing output format |
lab |
LABBY_MCP_GATEWAY_URL |
false | false | https://mcp.example.com |
Canonical public MCP gateway URL |
lab |
LABBY_MCP_HTTP_HOST |
false | false | 127.0.0.1 |
HTTP MCP bind host |
lab |
LABBY_MCP_HTTP_PORT |
false | false | 8765 |
HTTP MCP bind port |
lab |
LABBY_RECOVERY_KEY_PATH |
true | true | /secure/labby-recovery.key |
External HMAC key for durable-state export, verification, and restore |
proxy |
LABBY_GW_UPSTREAM_STDERR |
false | false | debug |
Set forwarding level for the proxied stdio child's redacted stderr; default debug |
proxy |
LABBY_PROXY_BEARER_TOKEN |
false | true | <labby_proxy_bearer_token> |
Default static bearer secret; the key name may be changed with proxy.bearer_token_env |
proxy |
LABBY_PROXY_TEST_RENEW_MS |
false | false | 100 |
Test-only OAuth lease renewal override, compiled only with proxy-testkit |
proxy |
LABBY_TAILSCALE_BIN |
false | false | tailscale |
Override the Tailscale CLI executable used by proxy publication and preflight |
setup |
LABBY_ACCESS_MIGRATION_EVIDENCE |
false | false | /run/labby/access-migration-v7.json |
Path to the source/checkpoint-bound approval evidence for an access-store schema migration |
setup |
LABBY_DEPOT_AUTHORITY_SIGNING_KEY |
false | true | <labby_depot_authority_signing_key> |
Active Ed25519 signing seed (base64url, no padding, 32 bytes) for Depot projection envelopes and delegated assertions (default variable for depot.authority_signing_key_env) |
setup |
LABBY_DEPOT_AUTHORITY_TOKEN |
false | true | <labby_depot_authority_token> |
Bearer token presented to Depot's managed authority inbox (default variable for depot.authority_bearer_token_env) |