api
The dashboard API and auth. Port 4000.
Reads PostgreSQL, ClickHouse, Redis, object storage, proxies, integrations and logging.
| Variable | Required | Default | Description |
|---|---|---|---|
API_ORIGIN |
yes | Public origin of api, such as https://api.example.com. Builds callback URLs. |
|
APP_DASHBOARD_ORIGIN |
yes | Dashboard origin. The only origin CORS and auth trust. | |
BETTER_AUTH_SECRET |
yes | At least 32 characters: openssl rand -hex 32. Changing it signs everyone out. |
|
MCP_ORIGIN |
no | http://localhost:4500 |
Public origin of mcp. OAuth access tokens are issued for MCP_ORIGIN/mcp only. |
PORT |
no | 4000 |
HTTP port. |
NODE_ENV |
no | development |
production turns on secure cookies and hides the OpenAPI documents. |
BETTER_AUTH_COOKIE_DOMAIN |
no | Cookie domain, such as .example.com, when api and the dashboard are sibling subdomains. |
|
RATE_LIMIT_ENABLED |
no | true |
Rate limits /api/v1/* and invalid API tokens. |
RATE_LIMIT_MAX |
no | 1000 |
Requests per client address per window. |
RATE_LIMIT_WINDOW_MS |
no | 1000 |
Window length, at least 1000. |
RATE_LIMIT_AUTH_FAILURES_PER_MINUTE |
no | 60 |
Invalid API tokens per address per minute before its token requests see 429. 0 turns it off. |
Sign-in
People sign in with a passkey or an email code. A GitHub or Google button appears when both of its variables are set. Accounts with the same verified email are linked.
| Variable | Description |
|---|---|
AUTH_GITHUB_CLIENT_ID |
GitHub OAuth app client ID. Callback URL: API_ORIGIN/api/auth/callback/github. |
AUTH_GITHUB_CLIENT_SECRET |
GitHub OAuth app client secret. |
AUTH_GOOGLE_CLIENT_ID |
Google OAuth client ID. Redirect URI: API_ORIGIN/api/auth/callback/google. |
AUTH_GOOGLE_CLIENT_SECRET |
Google OAuth client secret. |
Passkeys are bound to the host of APP_DASHBOARD_ORIGIN. Changing that host breaks existing passkeys.
OAuth for mcp
api is the OAuth server that mcp trusts. It sends users to the dashboard’s /oauth pages to sign in and consent, and serves its signing keys at /api/auth/jwks. Set the same MCP_ORIGIN in api and mcp.
Background jobs
api queues work for worker-jobs. Without it, project cleanup, the first repository sync, emails and alert test notifications never run.