---
title: 'Environment Variables'
description: ''
icon: 'gear'
---

To configure activepieces, you will need to set some environment variables, There is file called `.env` at the root directory for our main repo.

<Tip> When you execute the [tools/deploy.sh](https://github.com/activepieces/activepieces/blob/main/tools/deploy.sh) script in the Docker installation tutorial, 
it will produce these values. </Tip>

## Environment Variables

| Variable                           | Description                                                                                                                                                                                                          | Default Value                                                                  | Example                                                                |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| `AP_CONFIG_PATH`                   | Optional parameter for specifying the path to store PGLite database and local settings.                                                                                                                                      | `~/.activepieces`                                                              |                                                                        |
| `AP_CLOUD_AUTH_ENABLED`            | Turn off the utilization of Activepieces oauth2 applications                                                                                                                                                         | `false`                                                                        |                                                                        |
| `AP_DB_TYPE`                       | The type of database to use. `POSTGRES` for external PostgreSQL, `PGLITE` for embedded database. **Note:** `SQLITE3` is deprecated and will be automatically migrated to `PGLITE`.                                                                                                                                                                    | `POSTGRES`                                                                      |                                                                        |
| `AP_EXECUTION_MODE`                | You can choose between 'SANDBOX_PROCESS', 'UNSANDBOXED', 'SANDBOX_CODE_ONLY', 'SANDBOX_CODE_AND_PROCESS' as possible values. If you decide to change this, make sure to carefully read https://www.activepieces.com/docs/install/architecture/sandboxing                                                                | `UNSANDBOXED`                                                                  |                                                                        |
| `AP_ENCRYPTION_KEY`                | ❗️ Encryption key used for connections is a 32-character (16 bytes) hexadecimal key. You can generate one using the following command: `openssl rand -hex 16`.                                                                                                                                                                              | None                                                                         |
| `AP_EXECUTION_DATA_RETENTION_DAYS` | The number of days to retain execution data, logs and events.                                                                                                                                                        | `30`                                                                         |                                                                        |
| `AP_FRONTEND_URL`                  | ❗️ Url that will be used to specify redirect url and webhook url. 
| `AP_INTERNAL_URL`                  | (BETA) Used to specify the SSO authentication URL.                                                                                 | None                                                                         | [https://demo.activepieces.com/api](https://demo.activepieces.com/api) |
| `AP_JWT_SECRET`                    | ❗️ Encryption key used for generating JWT tokens is a 32-character hexadecimal key. You can generate one using the following command: `openssl rand -hex 32`.                                                                                                                                                                     | None                                                                         | [https://demo.activepieces.com](https://demo.activepieces.com)         |
| `AP_QUEUE_UI_ENABLED`              | Enable the queue UI (only works with redis)                                                                                                                                                                          | `true`                                                                         |                                                                        |
| `AP_QUEUE_UI_USERNAME`             | The username for the queue UI. This is required if `AP_QUEUE_UI_ENABLED` is set to `true`.                                                                                                                           | None                                                                           |                                                                        |
| `AP_QUEUE_UI_PASSWORD`             | The password for the queue UI. This is required if `AP_QUEUE_UI_ENABLED` is set to `true`.                                                                                                                           | None                                                                           |                                                                        |
| `AP_REDIS_FAILED_JOB_RETENTION_DAYS` | The number of days to retain failed jobs in Redis.                                                                                                                                                                  | `30`                                                                           |                                                                        |
| `AP_REDIS_FAILED_JOB_RETENTION_MAX_COUNT` | The maximum number of failed jobs to retain in Redis.                                                                                                                                                          | `2000`                                                                         |                                                                        |
| `AP_TRIGGER_DEFAULT_POLL_INTERVAL` | How many minutes before the system checks for new data updates for pieces with scheduled triggers, such as new Google Contacts.                                                       | `5`                                                                            |                                                                        |
| `AP_PIECES_CACHE_MAX_ENTRIES`     | Maximum number of entries in the in-memory LRU cache for piece metadata. The cache stores piece lists and individual piece metadata to reduce database load; when the limit is reached, least recently used entries are evicted. | `1000`                                                                         |                                                                        |
| `AP_PIECES_SOURCE`                 | `AP_PIECES_SOURCE`: `FILE` for local development, `DB` for database. You can find more information about it in [Setting Piece Source](#setting-piece-source) section.                                                | `CLOUD_AND_DB`                                                                 |                                                                        |
| `AP_PIECES_SYNC_MODE`              | `AP_PIECES_SYNC_MODE`: None for no metadata syncing / 'OFFICIAL_AUTO' for automatic syncing for pieces metadata from cloud                                                                                         | `OFFICIAL_AUTO`                                                                |
| `AP_POSTGRES_DATABASE`             | ❗️ The name of the PostgreSQL database                                                                                                                                                                              | None                                                                         |                                                                        |
| `AP_POSTGRES_HOST`                 | ❗️ The hostname or IP address of the PostgreSQL server                                                                                                                                                              | None                                                                         |                                                                        |
| `AP_POSTGRES_PASSWORD`             | ❗️ The password for the PostgreSQL,  you can generate a 32-character hexadecimal key using the following command: `openssl rand -hex 32`.                                                                                                                                                                              | None                                                                         |                                                                        |
| `AP_POSTGRES_PORT`                 | ❗️ The port number for the PostgreSQL server                                                                                                                                                                        | None                                                                         |                                                                        |
| `AP_POSTGRES_USERNAME`             | ❗️ The username for the PostgreSQL user                                                                                                                                                                             | None                                                                         |                                                                        |
| `AP_POSTGRES_USE_SSL`              | Use SSL to connect the postgres database                                                                                                                                                                             | `false`                                                                        |                                                                        |
| `AP_POSTGRES_SSL_CA`               | Use SSL Certificate to connect to the postgres database                                                                                                                                                              |
| `AP_POSTGRES_URL`                  | Alternatively, you can specify only the connection string (e.g postgres://user:password@host:5432/database) instead of providing the database, host, port, username, and password.                                   | None                                                                         |                                                                        |
| `AP_POSTGRES_POOL_SIZE` | Maximum number of clients the pool should contain for the PostgreSQL database  |  None
| `AP_POSTGRES_IDLE_TIMEOUT_MS` | Sets the idle timout  pool for your PostgreSQL  | `30000`
| `AP_REDIS_TYPE`                    | Where to spin redis instance, either in memory (MEMORY) or in a dedicated instance (STANDALONE), or in a sentinel instance (SENTINEL)                                                                                  | `STANDALONE`                                                                       |                                                                        |
| `AP_REDIS_URL`                     | If a Redis connection URL is specified, all other Redis properties will be ignored.                                                                                                                                  | None                                                                         |                                                                        |
| `AP_REDIS_USER`                    | ❗️ Username to use when connect to redis                                                                                                                                                                            | None                                                                         |                                                                        |
| `AP_REDIS_PASSWORD`                | ❗️ Password to use when connect to redis                                                                                                                                                                            | None                                                                         |                                                                        |
| `AP_REDIS_HOST`                    | ❗️ The hostname or IP address of the Redis server                                                                                                                                                                   | None                                                                         |                                                                        |
| `AP_REDIS_PORT`                    | ❗️ The port number for the Redis server                                                                                                                                                                             | None                                                                         |                                                                        |
| `AP_REDIS_DB`                      | The Redis database index to use                                                                                                                                                                                      | `0`                                                                            |                                                                        |
| `AP_REDIS_USE_SSL`                 | Connect to Redis with SSL                                                                                                                                                                                            | `false`                                                                        |                                                                        |
| `AP_REDIS_SSL_CA_FILE`           | The path to the CA file for the Redis server.                                                                                                                                                             | None |  |
| `AP_REDIS_SENTINEL_HOSTS`          | If specified, this should be a comma-separated list of `host:port` pairs for Redis Sentinels. Make sure to set `AP_REDIS_CONNECTION_MODE` to `SENTINEL`                                                                 | None | `sentinel-host-1:26379,sentinel-host-2:26379,sentinel-host-3:26379` |
| `AP_REDIS_SENTINEL_NAME`          | The name of the master node monitored by the sentinels.                                                                                                                                                             | None | `sentinel-host-1` |
| `AP_REDIS_SENTINEL_ROLE`          | The role to connect to, either `master` or `slave`.                                                                                                                                                             | None | `master` |
| `AP_TRIGGER_TIMEOUT_SECONDS`       | Maximum allowed runtime for a trigger to perform polling in seconds                                                                                                                                                                     | `60`                                                                         |                                                                        |
| `AP_FLOW_TIMEOUT_SECONDS`          | Maximum allowed runtime for a flow to run in seconds                                                                                                                                                                        | `600`                                                                         |                                                                        |
| `AP_SANDBOX_MEMORY_LIMIT`          | The maximum amount of memory (in kilobytes) that a single sandboxed engine process can use. Each engine process executes at most one execution at a time. This helps prevent runaway memory usage in custom code or pieces. If not set, the default is 1,048,576 KB (1,024 MB).                    | `1048576`                                                                         | `1048576`                                                                 |
| `AP_SANDBOX_PROPAGATED_ENV_VARS`   | Environment variables that will be propagated to the sandboxed code. If you are using it for pieces, we strongly suggests keeping everything in the authentication object to make sure it works across AP instances. | None                                                                         |                                                                        |
| `AP_SCIM_DEFAULT_PROJECT_ROLE`     | The default project role assigned to members when they are added to a project via SCIM group sync. Accepted values: `Admin`, `Editor`, `Viewer`.                                                                     | `Editor`                                                                       | `Viewer`                                                               |
| `AP_TELEMETRY_ENABLED`             | Collect telemetry information.                                                                                                                                                                                       | `true`                                                                         |                                                                        |
| `AP_TEMPLATES_SOURCE_URL`          | This is the endpoint we query for templates, remove it and templates will be removed from UI                                                                                                                         | `https://cloud.activepieces.com/api/v1/templates`                         |                                                                        |
| `AP_WEBHOOK_TIMEOUT_SECONDS`       | The default timeout for webhooks. The maximum allowed is 15 minutes. Please note that Cloudflare limits it to 30 seconds. If you are using a reverse proxy for SSL, make sure it's configured correctly.             | `30`                                                                           |                                                                        |
| `AP_TRIGGER_FAILURE_THRESHOLD`     | The maximum number of consecutive trigger failures is 576 by default, which is equivalent to approximately 2 days.                                                                                                   | `30`                                                                           |        
| `AP_PROJECT_RATE_LIMITER_ENABLED`   | Enforce rate limits and prevent excessive usage by a single project.                                                                                                                                                   | `true`                                                                           |                                                                        |
| `AP_DEFAULT_CONCURRENT_JOBS_LIMIT`| The default maximum number of concurrent runs a project can have. Used to enforce rate limits and prevent excessive usage by a single project. Can be overridden per-project in settings.                                                                                 | `5`                                                                           |                                                                        |
| `AP_S3_ACCESS_KEY_ID`              | The access key ID for your S3-compatible storage service. Not required if `AP_S3_USE_IRSA` is `true`.                                                                                                                | None                                                                         |                                                                        |
| `AP_S3_SECRET_ACCESS_KEY`          | The secret access key for your S3-compatible storage service. Not required if `AP_S3_USE_IRSA` is `true`.                                                                                                            | None                                                                         |                                                                        |
| `AP_S3_BUCKET`                     | The name of the S3 bucket to use for file storage.                                                                                                                                                                   | None                                                                         |                                                                        |
| `AP_S3_ENDPOINT`                   | The endpoint URL for your S3-compatible storage service. Not required if `AWS_ENDPOINT_URL` is set.                                                                                                                  | None                                                                         | `https://s3.amazonaws.com`                                             |
| `AP_S3_REGION`                     | The region where your S3 bucket is located. Not required if `AWS_REGION` is set.                                                                                                                                     | None                                                                         | `us-east-1`                                                            |
| `AP_S3_USE_SIGNED_URLS`            | Routes file traffic directly to S3 using pre-signed URLs, bypassing the API server. The bucket should remain private; signed URLs provide temporary authenticated access.                                             | None                                                                         |                                                                        |
| `AP_S3_USE_IRSA`                   | Use IAM Role for Service Accounts (IRSA) to connect to S3. When `true`, `AP_S3_ACCESS_KEY_ID` and `AP_S3_ACCESS_KEY_ID` are not required.                                                                            | None                                                                         |  `true`                                                                |
| `AP_SMTP_HOST`                     | The host name for the SMTP server that activepieces uses to send emails                                                                                                                                              | `None`                                                                         |  `mail.example.com`                                                    |
| `AP_SMTP_PORT`                     | The port number for the SMTP server that activepieces uses to send emails                                                                                                                                            | `None`                                                                         |  587                                                                   |
| `AP_SMTP_USERNAME`                 | The user name for the SMTP server that activepieces uses to send emails                                                                                                                                              | `None`                                                                         |  test@mail.example.com                                                 |
| `AP_SMTP_PASSWORD`                 | The password for the SMTP server that activepieces uses to send emails                                                                                                                                               | `None`                                                                         |  secret1234                                                            |
| `AP_SMTP_SENDER_EMAIL`                | The email address from which activepieces sends emails.                                                                                                                                                              | `None`                                                                         |  test@mail.example.com                                                 |
| `AP_SMTP_SENDER_NAME`                 | The sender name activepieces uses to send emails.   
| `AP_MAX_FILE_SIZE_MB`              | The maximum allowed file size (in megabytes) for **uploaded files** in steps or triggers. Files larger than this value will be rejected. This does **not** control flow run log size—see `AP_MAX_FLOW_RUN_LOG_SIZE_MB`.  | `25`                                                                         | `10`                                                                   |
| `AP_MAX_FLOW_RUN_LOG_SIZE_MB`      | The maximum allowed size (in megabytes) of the **flow run logs**—this is the total combined size of all inputs and outputs for each step in a single flow run. If logs exceed this size, they will be truncated, which may cause flow execution issues. | `25`                                                                         | `25`                                                                   |
| `AP_MAX_WEBHOOK_PAYLOAD_SIZE_MB`   | Maximum webhook payload size in MB. Payloads exceeding this are rejected with HTTP 413. | `5` | `10` |
| `AP_WEBHOOK_PAYLOAD_INLINE_THRESHOLD_KB` | Webhook payloads below this size (in KB) are stored inline in Redis for fastest processing. Payloads above this are offloaded to file storage to protect Redis memory. | `512` | `1024` |
| `AP_WORKER_CONCURRENCY` | The number of concurrent jobs the worker can process simultaneously. Each concurrent job uses one sandbox instance. | `5` | `10` |
| `AP_FILE_STORAGE_LOCATION`         | The location to store files. Possible values are `DB` for storing files in the database or `S3` for storing files in an S3-compatible storage service.                                                               | `DB`                                                                           |                                                                        |
| `AP_PAUSED_FLOW_TIMEOUT_DAYS`      | The maximum allowed pause duration in days for a paused flow, please note it can not exceed `AP_EXECUTION_DATA_RETENTION_DAYS`                                                                                                                                                            | `30`                                                                           |                                                                        
| `AP_MAX_RECORDS_PER_TABLE`         | The maximum allowed number of records per table                                                                | `10000` | `10000`
| `AP_MAX_FIELDS_PER_TABLE` |  The maximum allowed number of fields per table  | `100` | `100`
| `AP_MAX_TABLES_PER_PROJECT` | The maximum allowed number of tables per project | `20` | `20`
| `AP_MAX_MCPS_PER_PROJECT` | The maximum allowed number of mcp per project | `20` | `20`
| `AP_MCP_OAUTH_ISSUER_URL` | The issuer URL used for MCP OAuth token generation and metadata discovery. Falls back to `AP_FRONTEND_URL` if not set. | None | `https://mcp.example.com`
| `AP_ENABLE_FLOW_ON_PUBLISH` | Whether publishing a new flow version should automatically enable the flow | `true` | `false`  
| `AP_ISSUE_ARCHIVE_DAYS`            | Controls the automatic archival of issues in the system. Issues that have not been updated for this many days will be automatically moved to an archived state.| `14`  | `1`
| `AP_LOAD_TRANSLATIONS_FOR_DEV_PIECES`  | Load translations for dev pieces (configured via `AP_DEV_PIECES`). When disabled, dev pieces are loaded without translations. This only affects development mode.| `false`  | `true`
| `AP_CONTAINER_TYPE` | Controls which services to run in the Docker container. `APP` starts only the API server, `WORKER` starts only the worker, `WORKER_AND_APP` starts both. | `WORKER_AND_APP` | `APP`
| `AP_NETWORK_MODE` | Network posture for user code egress. `STRICT` blocks outbound connections from user code (Code steps, pieces, HTTP requests) to private, loopback, link-local, and cloud metadata IPs across every Node egress path (`axios`, `fetch`, `undici`, raw `http`/`net`); in sandboxed execution modes it also applies a kernel-level iptables lockdown. `UNRESTRICTED` disables all guards. Defaults to `UNRESTRICTED` while the hardening stack is being validated. | `UNRESTRICTED` | `STRICT`
| `AP_SSRF_ALLOW_LIST` | Comma-separated IPs or CIDR ranges that bypass `AP_NETWORK_MODE=STRICT`. Use this to reach specific internal services (databases, sidecars) from flows. Accepts exact IPs (`10.0.0.5`) and CIDR blocks (`10.0.0.0/24`, `fd00::/8`). Only applies when `AP_NETWORK_MODE=STRICT`. | `` | `10.0.0.5,10.10.0.0/24`
| `HTTP_PROXY` / `HTTPS_PROXY` | Standard proxy env vars. When set, the engine routes all outbound HTTP(S) through the proxy (via `undici`'s `EnvHttpProxyAgent`). If the proxy listens on loopback, its port is automatically exempted from the SSRF guard so user code can still reach it. | `` | `http://127.0.0.1:3128`



<Warning>
  The frontend URL is essential for webhooks and app triggers to work. It must
  be accessible to third parties to send data.
</Warning>


### Setting Webhook (Frontend URL):

The default URL is set to the machine's IP address. To ensure proper operation, ensure that this address is accessible or specify an `AP_FRONTEND_URL` environment variable.

One possible solution for this is using a service like ngrok ([https://ngrok.com/](https://ngrok.com/)), which can be used to expose the frontend port (4200) to the internet.

### Redis Configuration

Set the `AP_REDIS_URL` environment variable to the connection URL of your Redis server. 

Please note that if a Redis connection URL is specified, all other **Redis properties** will be ignored.

<Info>
If you don't have the Redis URL, you can use the following command to get it. You can use the following variables:

- `REDIS_USER`: The username to use when connecting to Redis.
- `REDIS_PASSWORD`: The password to use when connecting to Redis.
- `REDIS_HOST`: The hostname or IP address of the Redis server.
- `REDIS_PORT`: The port number for the Redis server.
- `REDIS_DB`: The Redis database index to use.
- `REDIS_USE_SSL`: Connect to Redis with SSL.
</Info>
<Info>
  If you are using **Redis Sentinel**, you can set the following environment variables:
  - `AP_REDIS_TYPE`: Set this to `SENTINEL`.
  - `AP_REDIS_SENTINEL_HOSTS`: A comma-separated list of `host:port` pairs for Redis Sentinels. When set, all other Redis properties will be ignored.
  - `AP_REDIS_SENTINEL_NAME`: The name of the master node monitored by the sentinels.
  - `AP_REDIS_SENTINEL_ROLE`: The role to connect to, either `master` or `slave`.
  - `AP_REDIS_PASSWORD`: The password to use when connecting to Redis.
  - `AP_REDIS_USE_SSL`: Connect to Redis with SSL.
  - `AP_REDIS_SSL_CA_FILE`: The path to the CA file for the Redis server.
</Info>

### SMTP Configuration

SMTP can be configured both from the platform admin screen and through environment variables. The enviroment variables are only used if the platform admin screen has no email configuration entered.

Activepieces will only use the configuration from the environment variables if `AP_SMTP_HOST`, `AP_SMTP_PORT`, `AP_SMTP_USERNAME` and `AP_SMTP_PASSWORD` all have a value set. TLS is supported.
