PORT=8790
CORS_ORIGINS=http://localhost:3005,http://127.0.0.1:3005
DATABASE_URL=mysql://root:password@127.0.0.1:3306/openwork_den
DB_MODE=mysql
DATABASE_HOST=
DATABASE_USERNAME=
DATABASE_PASSWORD=
BETTER_AUTH_SECRET=replace-with-32-plus-character-secret
# Required dedicated DB encryption key for encrypted columns. Minimum 32 chars.
# Generate one with: openssl rand -base64 128
DEN_DB_ENCRYPTION_KEY=
BETTER_AUTH_URL=http://localhost:3005
DEN_BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3005,http://127.0.0.1:3005
# Public API base; an HTTPS reverse-proxy prefix such as /api/den is supported.
# OAuth callbacks and /v1/webhooks/telegram must bypass upstream SSO/Access challenges.
DEN_API_PUBLIC_URL=http://localhost:8790
# Optional protocol-compatible endpoint overrides for connector tests. OAuth
# overrides must contain a literal {tenantId} path placeholder. Leave blank in
# production to use tenant-scoped Microsoft Entra and Graph directly.
DEN_MICROSOFT_OAUTH_AUTHORIZE_URL=
DEN_MICROSOFT_OAUTH_TOKEN_URL=
DEN_MICROSOFT_GRAPH_BASE_URL=
# Optional protocol-compatible Telegram Bot API root for local/Daytona tests.
# Leave blank in production to use https://api.telegram.org.
DEN_TELEGRAM_API_ROOT=
DEN_DESKTOP_DEN_BASE_URL=http://localhost:3005/api/den
DEN_MARKETING_URL=http://localhost:3005
DEN_MCP_RESOURCE_URL=http://localhost:8790/mcp
# Extra public MCP resource URLs beyond the DEN_API_PUBLIC_URL API origin and web-app defaults.
DEN_MCP_ADDITIONAL_RESOURCES=
# Leave unset on hosted/multi-tenant deployments. Set to 1 only when Den runs
# inside a private network and your MCP servers are on private addresses.
# OPENWORK_DEV_MODE=1 already exempts local dev.
DEN_ALLOW_PRIVATE_MCP_URLS=
# Optional operator-owned override for the Org settings egress diagnostic.
# The browser can never change it; the default is https://diagnostic.openworklabs.com.
DEN_DIAGNOSTICS_ORIGIN=https://diagnostic.openworklabs.com
# Optional bootstrap fallback for the synthetic test secret. Organization admins
# normally enter and rotate this encrypted value in Den's Org settings. Never
# use a customer credential or provider secret here.
DEN_DIAGNOSTICS_BEARER_TOKEN=OpenWorkDiagnosticsToken!
# Node.js 24.5+: when corporate egress requires a proxy, set
# NODE_USE_ENV_PROXY=1 together with HTTPS_PROXY and NO_PROXY on the Den
# container. Set NODE_EXTRA_CA_CERTS when TLS inspection uses a private CA.
# Defaults to BETTER_AUTH_URL when blank. Set this to a stable hosted namespace
# before issuing MCP tokens if you need claim URI compatibility across host moves.
# Use https://openworklabs.com to preserve the original hosted MCP claim names.
DEN_MCP_CLAIM_NAMESPACE=
# Optional comma-separated platform admin emails to seed on startup.
# Leave blank to disable bootstrap admin seeding for self-hosted installs.
DEN_BOOTSTRAP_ADMIN_EMAILS=
EMAIL_FROM=OpenWork <team@openworklabs.com>
# Transactional email uses Resend when RESEND_API_KEY is set.
RESEND_API_KEY=
# Otherwise, transactional email uses SMTP/Nodemailer when SMTP_HOST is set.
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_SECURE=false
# Optional Loops API key for contact/event syncs after signup and subscription.
LOOPS_API_KEY=
LOOPS_MARKETING_ENABLED=0
# Optional Linear GraphQL integration for best-effort compliance request tickets.
# Leave LINEAR_API_KEY and LINEAR_COMPLIANCE_TEAM_ID blank to disable.
# LINEAR_API_BASE defaults to https://api.linear.app/graphql when unset.
# LINEAR_COMPLIANCE_COMPLETED_STATE_ID marks compliance tickets complete after
# the workflow finishes.
LINEAR_API_KEY=
LINEAR_COMPLIANCE_TEAM_ID=
LINEAR_API_BASE=
LINEAR_COMPLIANCE_COMPLETED_STATE_ID=
PROVISIONER_MODE=stub
WORKER_PROVISIONING_RECONCILE_INTERVAL_MS=60000
WORKER_PROVISIONING_RECONCILE_STALE_MS=1200000
WORKER_PROVISIONING_RECONCILE_BATCH_SIZE=10
WORKER_URL_TEMPLATE=https://workers.local/{workerId}
WORKER_ACTIVITY_BASE_URL=http://localhost:8790
RENDER_API_KEY=
RENDER_OWNER_ID=
RENDER_WORKER_PUBLIC_DOMAIN_SUFFIX=
VERCEL_TOKEN=
VERCEL_DNS_DOMAIN=
POLAR_FEATURE_GATE_ENABLED=false
POLAR_API_BASE=
POLAR_ACCESS_TOKEN=
POLAR_PRODUCT_ID=
POLAR_BENEFIT_ID=
POLAR_SUCCESS_URL=
POLAR_RETURN_URL=
DAYTONA_API_KEY=
DAYTONA_API_URL=https://app.daytona.io/api
DAYTONA_WORKER_PROXY_BASE_URL=http://localhost:8789
OPENWORK_DEV_MODE=1
# Org mode: blank/unset resolves to single_org in the implemented target state.
# Use multi_org for hosted/cloud-style deployments that allow multiple organizations.
DEN_ORG_MODE=
DEN_SINGLE_ORG_NAME=OpenWork
DEN_SINGLE_ORG_SLUG=default
# Comma-separated emails allowed to claim singleton organization ownership.
DEN_SINGLE_ORG_OWNER_EMAILS=
DEN_SINGLE_ORG_ALLOW_PUBLIC_SIGNUP=false
# Single-org deployments disable signup verification codes by default.
DEN_REQUIRE_EMAIL_VERIFICATION=false

# Observability backend: none (structured JSON stdout), otel (OTLP HTTP/protobuf), or sentry.
# Backends are mutually exclusive. Leave unset/none for local development.
DEN_OBSERVABILITY_BACKEND=none
OTEL_SERVICE_NAME=den-api
# OTEL uses the standard OTEL_* variables. The base endpoint appends /v1/traces,
# /v1/metrics, and /v1/logs unless a per-signal endpoint is set.
OTEL_EXPORTER_OTLP_ENDPOINT=
OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
OTEL_TRACES_EXPORTER=otlp
OTEL_METRICS_EXPORTER=otlp
OTEL_LOGS_EXPORTER=otlp
OTEL_TRACES_SAMPLER=parentbased_always_on
OTEL_TRACES_SAMPLER_ARG=
# Sentry runtime. Source maps upload during build only when SENTRY_AUTH_TOKEN,
# SENTRY_ORG, SENTRY_PROJECT, and SENTRY_RELEASE are present.
SENTRY_DSN=
SENTRY_TRACES_SAMPLE_RATE=1
SENTRY_ORG=
SENTRY_PROJECT=
SENTRY_RELEASE=
SENTRY_ENVIRONMENT=
SENTRY_DIST=
# SENTRY_AUTH_TOKEN is intentionally omitted; provide it only in CI/secret storage.
# Daytona's own OTEL bootstrap remains disabled; den-api does not set Daytona OTEL enable env vars.


OPENROUTER_MANAGEMENT_API_KEY=
OPENROUTER_WORKSPACE_ID=
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_INFERENCE_PRICE_ID=price_1TWsTW2Ytt5tm5rQTgrMhiP8
STRIPE_SEAT_PRICE_ID=
STRIPE_BILLING_SUCCESS_URL=http://localhost:3005/dashboard/billing/stripe/checking?session_id={CHECKOUT_SESSION_ID}
STRIPE_BILLING_CANCEL_URL=http://localhost:3005/dashboard/billing
