Environment variables
The full list with comments is packages/core/.env.example; the schema is packages/core/src/libs/Env.ts. NEXT_PUBLIC_* values are baked in at build time.
Core
| Variable | Default | Purpose |
|---|---|---|
DATABASE_URL | — (required) | Postgres 16 with pgvector |
AUTH_SECRET | — (required) | Signs sessions. openssl rand -base64 32 |
NEXT_PUBLIC_APP_URL | http://localhost:3000 | The public URL (build time) |
WORKSPACE_PATH | — | The workspace directory; unset means none configured |
WORKSPACE_TEMPLATE_VARS | — | Names allowed in {{env.NAME}} tokens |
VOCION_ENFORCE_WORKSPACE_ACCESS | off | 1: membership and groups gate shared workspaces |
Durable executor
| Variable | Default | Purpose |
|---|---|---|
VOCION_SCHEDULE_OWNER | off | 1 on exactly one process: fires schedules, runs housekeeping |
DURABLE_EXECUTOR | on | off disables the executor in this process |
DURABLE_MODE | — | memory for an in-memory executor in development |
Models and retrieval
| Variable | Default | Purpose |
|---|---|---|
VOCION_LLM_PROVIDER | anthropic | anthropic, openai, bedrock |
VOCION_LLM_PROVIDER_<ROLE> / VOCION_LLM_MODEL_<ROLE> | — | Per role: MAIN, CLASSIFIER, EMBEDDER, SKILLTURN, EXTRACTOR |
ANTHROPIC_API_KEY, OPENAI_API_KEY | — | Server-level keys; a workspace's stored key is used first |
AWS_REGION, AWS_BEARER_TOKEN_BEDROCK | — | Bedrock (or any AWS SDK credential) |
VOCION_EMBEDDING_PROVIDER | follows the LLM provider; OpenAI when that is Anthropic | openai or bedrock |
VOCION_EMBEDDING_MODEL | text-embedding-3-small | Embedding model (1536 dimensions) |
VOCION_RERANK_MODEL | claude-haiku-4-5-20251001 | Rerank pass |
VOCION_PROMPT_CACHE | on | 0 disables prompt caching |
Agent execution (AgentCore)
| Variable | Default | Purpose |
|---|---|---|
VOCION_AGENT_RUNTIME_ARN | — | The AgentCore runtime |
VOCION_AGENTCORE_REGION | us-west-2 | Its region |
VOCION_AGENTCORE_MEMORY_ID | — | AgentCore Memory |
VOCION_TOOL_ENDPOINT_URL | — | Where the runtime calls tools back; must be reachable from AWS |
VOCION_DEFAULT_RUNS_ON | — | Default harness.runsOn |
VOCION_DISABLE_AGENTCORE, VOCION_DISABLE_RUNTIME | — | 1 forces turns in-process |
Workers and runners
| Variable | Purpose |
|---|---|
VOCION_EXTERNAL_WORKERS | 1 enables worker runs |
VOCION_RUNNERS / VOCION_RUNNERS_FILE | Runner targets (JSON) |
VOCION_RUNNER_TOKEN | Shared by the app and its runners |
VOCION_RUNNER_IMAGE | Pin to ghcr.io/vocion/vocion-runner:sha-<commit> or :5.x |
Security
| Variable | Default | Purpose |
|---|---|---|
VOCION_CREDENTIAL_VAULT | local | local or kms |
VOCION_CREDENTIAL_VAULT_KEY | — | Wrapping key for local; required in production |
VOCION_KMS_KEY_ARN | — | KMS key for kms |
VOCION_TOOL_SIGNING_SECRET | AUTH_SECRET | Signs tool claims and share links; set separately |
VOCION_ARTIFACTS_DIR | .artifacts | Private directory for artifact files |
Tools
| Variable | Default |
|---|---|
VOCION_WEBSEARCH_PROVIDER | tavily (or brave) |
VOCION_BROWSE_PROVIDER | builtin |
VOCION_IMAGE_PROVIDER | openai |
VOCION_CODE_PROVIDER | builtin (or e2b) |
Channels and connectors
| Variable | Purpose |
|---|---|
VOCION_SLACK_EVENTS, SLACK_SIGNING_SECRET, SLACK_BOT_TOKEN, SLACK_BOT_USER_ID | Slack in threads |
TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN | Texting your assistant |
RESEND_API_KEY, VOCION_MAIL_FROM, VOCION_MAIL_ENABLED, VOCION_EMAIL_SURFACE, VOCION_MAIL_DOMAIN | Outbound and inbound mail |
GOOGLE_OAUTH_CLIENT_ID/SECRET, SLACK_CLIENT_ID/SECRET, ATLASSIAN_…, HUBSPOT_…, NOTION_…, ZOOM_…, APOLLO_…, GITHUB_APP_CLIENT_ID/SECRET | Server-level vendor login apps (a workspace's own login app wins) |
VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY, VAPID_SUBJECT | Web push |
Observability
| Variable | Purpose |
|---|---|
LANGFUSE_ENABLED | true / false; see Observability |
LANGFUSE_BASE_URL, LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, LANGFUSE_PROJECT_ID | Langfuse |
LANGFUSE_RETENTION_DAYS | Default 365 |
NEXT_PUBLIC_SENTRY_DSN | Sentry |
NEXT_PUBLIC_BETTER_STACK_SOURCE_TOKEN, NEXT_PUBLIC_BETTER_STACK_INGESTING_HOST | Better Stack logs |
Branding (build time)
NEXT_PUBLIC_BRAND_NAME, NEXT_PUBLIC_BRAND_TAGLINE, NEXT_PUBLIC_BRAND_MARK, NEXT_PUBLIC_BRAND_LOCKUP.
Local MCP server
VOCION_ORG_ID, VOCION_MCP_AGENT_SLUG, WORKSPACE_AUTO_APPLY, WORKSPACE_AUTO_COMMIT, VOCION_PLUGINS.