Environment variables

Environment configuration the platform sets on the agent: manifest env-refs (secrets) and fixed-name operator knobs, with defaults.

Context — The platform sets two kinds of environment configuration on the agent at deploy time: manifest env-refs (the ${VAR} placeholders your manifest declares — names are yours to choose) and operator variables (fixed names that tune runtime behaviour). Generated from the runtime source of truth for version 0.8.14 (manifest schema 6.1.5).

Manifest env-refs (secrets)

Every credential-bearing manifest field takes a ${VAR_NAME} reference; the platform supplies the value from the secret bundle your manifest declares (see Deploying). Required fields abort boot when the variable is unset (the error names it); optional fields resolve to unset. Webhook secrets are re-read per request (rotation without restart) — all others resolve once at boot.

Manifest field	Required	Purpose
agent_config.database.password	when block present	${VAR} env-ref for the Postgres password.
agent_config.interactive_platform.public_key	yes	${VAR} env-ref for the InteractiveAI public key.
agent_config.interactive_platform.secret_key	yes	${VAR} env-ref for the InteractiveAI secret key.
agent_config.llms.api_key	yes	${VAR} env-ref for the InteractiveAI LLM router API key.
agent_config.mcps[].api_key	no	${VAR} env-ref for the MCP server's API key. Sent as Authorization: Bearer. Omit when the server doesn't require auth.
agent_config.runtime.api_key	yes	Shared bearer token. The agent verifies inbound Authorization: Bearer headers against it and sends the same header on autonomous-routine webhook callbacks. ${VAR} env-ref; literal values are rejected.
agent_config.search (type: external).api_key	no	${VAR} env-ref for the endpoint API key. Sent as Authorization: Bearer. Omit when the endpoint requires no auth.
agent_config.search (type: pgvector).password	when block present	${VAR} env-ref for the Postgres password.
agent_config.traces.backend.api_key	no	${VAR} env-ref for the traces backend API key. Sent per api_key_scheme. Omit for endpoints that don't require auth.
agent_config.webhooks[].secret_env	when block present	${VAR} env-ref for the HMAC shared secret. Re-read per request, so rotation picks up without restart.

Conventional variable names (AGENT_API_KEY, ROUTER_API_KEY, INTERACTIVEAI_PUBLIC_KEY, INTERACTIVEAI_SECRET_KEY, DB_PASSWORD, KB_PG_PASSWORD, …) are just convention — the manifest is the source of truth for which names it references.

Operator variables

Fixed-name knobs that tune runtime behaviour, set by the platform or operator at deploy time. All optional.

Variable	Default	Purpose
ROUTER_MAX_TOKENS	100000	Token ceiling per LLM-router call (context window cap).
STREAMING	False	Operator-only switch. When true, the agent streams chat replies token-by-token (agent output_mode=STREAM); default false preserves whole-message delivery.
AUTONOMOUS_DEFAULT_TIMEOUT_SECONDS	120	Per-run timeout for autonomous routines that don't declare their own timeout_seconds.
AUTONOMOUS_MAX_TIMEOUT_SECONDS	600	Hard cap on any autonomous routine's timeout_seconds — routine-declared values above this are clamped.
AUTONOMOUS_CALLBACK_MAX_RETRIES	5	Delivery attempts (with backoff) for autonomous callbacks and event webhooks before giving up.
SHUTDOWN_DRAIN_TIMEOUT_SECONDS	120	On SIGTERM, seconds to wait for in-flight engine turns, autonomous callbacks, and event webhooks to finish before the process exits. MUST be below the K8s terminationGracePeriodSeconds (minus the ~10s HTTP connection-drain) or SIGKILL hits mid-drain.
STORE_GC_DELAY_SECONDS	120	Seconds after readiness before the stale-store GC sweep runs (once per pod boot). Only fires when storage is PostgreSQL.
EVAL_NODE_PARALLELISM	50	Concurrent per-step model calls during boot-time routine evaluation. 1 = fully sequential (debugging); higher = faster cold boots, bounded by the router rate budget.
LLM_PROVIDER_ORDER	unset	Comma-separated provider slugs pinning which upstream providers serve all inference models (chat and evaluation), in preference order. Fallbacks are allowed: a request degrades to other providers when the pinned ones can't serve the model. Unset = no pin.

Fixed runtime facts (not configurable via env)

• HTTP listen port: 8080.

• Startup failures exit the process non-zero within 10 seconds.

• Model ids are manifest-only (agent_config.llms.*) — there is no env-var override. See Models.