---
title: api
description: The dashboard API and auth. Port 4000.
---

Reads [PostgreSQL](/self-hosting/configuration#postgresql), [ClickHouse](/self-hosting/configuration#clickhouse), [Redis](/self-hosting/configuration#redis), [object storage](/self-hosting/configuration#object-storage), [proxies](/self-hosting/configuration#proxies), [integrations](/self-hosting/integrations) and [logging](/self-hosting/configuration#logging).

| Variable                              | Required | Default                 | Description                                                                                    |
| ------------------------------------- | :------: | ----------------------- | ---------------------------------------------------------------------------------------------- |
| `API_ORIGIN`                          |   yes    |                         | Public origin of `api`, such as `https://api.example.com`. Builds callback URLs.               |
| `APP_DASHBOARD_ORIGIN`                |   yes    |                         | Dashboard origin. The only origin CORS and auth trust.                                         |
| `BETTER_AUTH_SECRET`                  |   yes    |                         | At least 32 characters: `openssl rand -hex 32`. Changing it signs everyone out.                |
| `MCP_ORIGIN`                          |    no    | `http://localhost:4500` | Public origin of `mcp`. OAuth access tokens are issued for `MCP_ORIGIN/mcp` only.              |
| `PORT`                                |    no    | `4000`                  | HTTP port.                                                                                     |
| `NODE_ENV`                            |    no    | `development`           | `production` turns on secure cookies and hides the OpenAPI documents.                          |
| `BETTER_AUTH_COOKIE_DOMAIN`           |    no    |                         | Cookie domain, such as `.example.com`, when `api` and the dashboard are sibling subdomains.    |
| `RATE_LIMIT_ENABLED`                  |    no    | `true`                  | Rate limits `/api/v1/*` and invalid API tokens.                                                |
| `RATE_LIMIT_MAX`                      |    no    | `1000`                  | Requests per client address per window.                                                        |
| `RATE_LIMIT_WINDOW_MS`                |    no    | `1000`                  | Window length, at least 1000.                                                                  |
| `RATE_LIMIT_AUTH_FAILURES_PER_MINUTE` |    no    | `60`                    | Invalid API tokens per address per minute before its token requests see 429. `0` turns it off. |

## Sign-in

People sign in with a passkey or an [email](/self-hosting/configuration#email) code. A GitHub or Google button appears when both of its variables are set. Accounts with the same verified email are linked.

| Variable                    | Description                                                                      |
| --------------------------- | -------------------------------------------------------------------------------- |
| `AUTH_GITHUB_CLIENT_ID`     | GitHub OAuth app client ID. Callback URL: `API_ORIGIN/api/auth/callback/github`. |
| `AUTH_GITHUB_CLIENT_SECRET` | GitHub OAuth app client secret.                                                  |
| `AUTH_GOOGLE_CLIENT_ID`     | Google OAuth client ID. Redirect URI: `API_ORIGIN/api/auth/callback/google`.     |
| `AUTH_GOOGLE_CLIENT_SECRET` | Google OAuth client secret.                                                      |

Passkeys are bound to the host of `APP_DASHBOARD_ORIGIN`. Changing that host breaks existing passkeys.

## OAuth for mcp

`api` is the OAuth server that [mcp](/self-hosting/services/mcp) trusts. It sends users to the dashboard's `/oauth` pages to sign in and consent, and serves its signing keys at `/api/auth/jwks`. Set the same `MCP_ORIGIN` in `api` and `mcp`.

## Background jobs

`api` queues work for [worker-jobs](/self-hosting/services/worker-jobs). Without it, project cleanup, the first repository sync, emails and alert test notifications never run.