.env.example

###############################################################################
#
# Configuration
#
# - To enable database credentials encryption, uncomment with a base64-encoded 256-bit key (warning: you cannot change this key once set).
# - To generate a key: `openssl rand -base64 32`
# - This key is also required for Connect UI functionality, as it is needed to generate Connect UI sessions.
#
# NANGO_ENCRYPTION_KEY=<ADD-BASE64-256BIT-KEY>
#
#
# - Customize database to store provider configurations and credentials.
#   (running 'npx nango start' creates a local Postgres database with the following credentials)
#
# NANGO_DB_USER=<PICK-A-USERNAME>
# NANGO_DB_PASSWORD=<PICK-A-PASSWORD>
# NANGO_DB_HOST=<PICK-A-HOST>
# NANGO_DB_PORT=<PICK-A-PORT>
# NANGO_DB_NAME=<PICK-A-DB-NAME>
# NANGO_DB_SCHEMA=<PICK-A-SCHEMA-NAME>
# NANGO_DB_ADDITIONAL_SCHEMAS=<PICK-A-SEARCH-PATH>,<PICK-ANOTHER-SEARCH-PATH>
# NANGO_DB_SSL=<PICK-TRUE-OR-FALSE>
# Override these 2 variables to configure the database connection pool / tune it for your needs i.e. serverless databases.
# NANGO_DB_POOL_MIN=<PICK-INT-OR-SKIP>
# NANGO_DB_POOL_MAX=<PICK-INT-OR-SKIP>
#
# - If empty, default to the main database URL
# RECORDS_DATABASE_URL=
# RECORDS_DATABASE_READ_URL= # Optional
# - If empty, default to nango_records
# RECORDS_DATABASE_SCHEMA=
#
#
# - Configure server and worker port (current value is the default for running Nango locally).
#
SERVER_PORT=3003
WORKER_PORT=3004
#
#
# - Configure server full URL (current value is the default for running Nango locally).
#
NANGO_SERVER_URL=http://localhost:3003
# Base-Url-Override SSRF hardening (enabled by default). Restart server and runners after changing these values.
NANGO_PROXY_BASE_URL_OVERRIDE_ENABLED=true
NANGO_PROXY_BASE_URL_OVERRIDE_DENYLIST='["169.254.169.254","metadata.google.internal","localhost","127.0.0.1","[::1]","[::ffff:127.0.0.1]","[::ffff:169.254.169.254]"]'
# To restore pre-remediation fail-open behavior: NANGO_PROXY_BASE_URL_OVERRIDE_DENYLIST='[]'
# To fully disable the override feature: NANGO_PROXY_BASE_URL_OVERRIDE_ENABLED=false
# Outbound URL SSRF policy (JSON) applied to proxy, customer webhooks, and uncontrolledFetch. Optional; secure
# defaults block DNS rebinding, private/link-local IPs, and cap redirects. Restart server and runners after changing.
# Example (allowlist mode): NANGO_OUTBOUND_URL_POLICY='{"mode":"allowlist","allowlist":[".hubspot.com","api.github.com"]}'
# Example (block private IPs + cap redirects): NANGO_OUTBOUND_URL_POLICY='{"blockPrivateIps":true,"maxRedirects":3}'
# Outbound URL SSRF policy overlay (JSON) for OAuth/token flows (token, refresh, STS, JWT-bearer endpoints).
# Applied on top of NANGO_OUTBOUND_URL_POLICY, but RFC1918/private IPs are allowed by default so self-hosted
# token endpoints keep working; loopback/metadata/link-local stay blocked. Set blockPrivateIps to lock down.
# Example (block private IPs for OAuth too): NANGO_OUTBOUND_URL_POLICY_OAUTH='{"blockPrivateIps":true}'
NANGO_PUBLIC_SERVER_URL=http://localhost:3000
# - Where the dashboard sends its API requests. If unset, NANGO_SERVER_URL is used.
#   Set this when self-hosting and you want the dashboard to reach Nango over an internal host, while
#   NANGO_SERVER_URL stays the public one that OAuth callbacks and webhooks must reach. It only changes
#   where the dashboard sends requests; callback and webhook URLs keep using NANGO_SERVER_URL.
#   `/` keeps requests on whichever host served the dashboard (same-origin). Use this when you front
#   one Nango process with two ingresses. An absolute URL is for a dashboard hosted separately from
#   the API; that origin must be an allowed CORS origin on the API host (see NANGO_PUBLIC_SERVER_URL).
#
# NANGO_DASHBOARD_API_URL=/
# NANGO_DASHBOARD_API_URL=https://nango.example.internal
# OAuth authorization-server issuer. This must use the dashboard API origin so its host-only session can be reused directly.
# NANGO_OAUTH_SERVER_BASE_URL=<dashboard-api-origin>
# NANGO_MANAGEMENT_MCP_SERVER_URL=https://mcp.example.com
# Copy this token from the OpenAI plugin submission domain-verification screen.
# It is served from the Management MCP hostname at /.well-known/openai-apps-challenge.
# NANGO_OPENAI_APPS_CHALLENGE_TOKEN=<token>
# NANGO_OAUTH_SERVER_COOKIE_KEYS=["<at-least-32-characters>","<another-distinct-key>"]
# NANGO_OAUTH_SERVER_JWKS=<generate-rsa-private-jwks>
CSP_REPORT_ONLY=false
#
#
# - Configure server websockets path (current value is the default for running Nango locally).
#   If this is changed from the default, the client must be configured to use the same path using the `websocketsPath`
#   config option in the Nango constructor.
#
# NANGO_SERVER_WEBSOCKETS_PATH=/
#
#
# - Secure Nango's dashboard.
# Self-hosted Nango is intended for a single organization: accounts on the same instance are not an isolation boundary between untrusted users, and instance-level settings (e.g. NANGO_SECRET_KEY_<ENV>) apply across all accounts.
# Signup is ON by default. If the dashboard is reachable by anyone you don't fully trust, uncomment the three variables below to disable login/signup and enable basic auth.
#
# FLAG_AUTH_ENABLED=false
# NANGO_DASHBOARD_USERNAME=<PICK-A-USERNAME>
# NANGO_DASHBOARD_PASSWORD=<PICK-A-PASSWORD>
#
# - Admin key, used as the dashboard session secret and for admin API access.
#   Set this to a strong, high-entropy value. To generate one: `openssl rand -base64 32`
# NANGO_ADMIN_KEY=<STRONG-HIGH-ENTROPY-VALUE>
#
#
# - Set the log level (debug: most verbose, info: recommended for production, error: least verbose)
#
LOG_LEVEL=info

###############################################################################

TZ=UTC

# Configure where integrations will be loaded from
NANGO_INTEGRATIONS_FULL_PATH=

# Internal Datadog Telemetry
# This telemetry logs metrics/traces in your own Datadog instance
NANGO_TELEMETRY_SDK=false
# Tag selected operational metrics with providerConfigKey (high cardinality; off by default)
NANGO_METRICS_INCLUDE_PROVIDER_CONFIG_KEY=false

# ----- Logs
NANGO_LOGS_ENABLED="false"
# elasticsearch (default), opensearch, or ec-serverless (Elastic Cloud Serverless)
NANGO_LOGS_PROVIDER="elasticsearch"
NANGO_LOGS_ES_URL="http://localhost:9500"
NANGO_LOGS_ES_USER=""
NANGO_LOGS_ES_PWD=""
# Encoded Elastic Cloud API key (the ApiKey credential). Required when NANGO_LOGS_PROVIDER=ec-serverless.
# NANGO_LOGS_ES_API_KEY=
# How many days activity/operation logs are kept before deletion (default 15).
# On ec-serverless this is data stream data_retention. Warm tier and shard counts are not used.
# A shorter project-level max retention in Elastic Cloud still caps the stream.
NANGO_LOGS_ES_RETENTION_DAYS=15

# Hosted Auth Configuration
WORKOS_API_KEY=
WORKOS_CLIENT_ID=

# Google Cloud Configuration
GOOGLE_APPLICATION_CREDENTIALS=

# Key to send email
# MAILGUN_API_KEY=
# MAILGUN_URL=
# Or send email through any JSON-over-HTTP mail API (SendGrid, Resend, ...)
# EMAIL_HTTP_BODY is required whenever EMAIL_HTTP_URL is set, and must be a JSON object.
# EMAIL_HTTP_URL=
# EMAIL_HTTP_HEADERS=
# EMAIL_HTTP_BODY=
# EMAIL_HTTP_TIMEOUT_MS=10000

# Sender address for all providers. SendGrid wants a bare address, not "Name <addr>".
# SMTP_FROM=

# Redis (optional)
#NANGO_REDIS_URL=

# Orchestrator
ORCHESTRATOR_SERVICE_URL="http://localhost:3008"
# Max immediate tasks admitted per minute per rate limit key. 0 (the default) disables throttling.
# ORCHESTRATOR_THROTTLED_IMMEDIATE_PER_MIN=3200

# Key to display domain logo in the UI
# https://www.logo.dev/
PUBLIC_LOGODEV_KEY=

# ---- Connect UI
NANGO_PUBLIC_CONNECT_URL=http://localhost:3009
# Only relevant for self-hosted
NANGO_CONNECT_UI_PORT=3009
FLAG_SERVE_CONNECT_UI=true

# ---- Role-based authorization (optional)
# FLAG_AUTH_ROLES_ENABLED=false

# ---- Audit trail (optional)
# FLAG_AUDIT_TRAIL_ENABLED=false

# ---- AgentCore sandboxes for remote functions
# SANDBOX_PROVIDER=agentcore
# AGENTCORE_RUNTIME_ARN=<AGENTCORE-RUNTIME-ARN>
# AGENTCORE_RUNTIME_QUALIFIER=DEFAULT

# ---- AWS
# AWS_ACCESS_KEY_ID=<ACCESS-KEY-ID>
# AWS_SECRET_ACCESS_KEY=<SECRET-ACCESS-KEY>

# ---- Orb (optional)
# ORB_API_KEY=<ORB-API-KEY>
# ORB_WEBHOOKS_SECRET=<ORB-WEBHOOKS-SECRET>

# API key for OpenCode agent used to sync OAuth2 provider scopes
# OPENCODE_API_KEY=
# ---- Clickhouse (optional)
# CLICKHOUSE_URL=http://default:@localhost:8123

# ---- Plain (in-app support chat, optional)
# PLAIN_APP_ID=<PLAIN-APP-ID>
# PLAIN_HMAC_SECRET=<PLAIN-HMAC-SECRET>

# ---- Internal mTLS (self-hosted, optional)
# Client certificate presented on service-to-service calls. mTLS is enforced outside the app
# (load balancer / service mesh); these only control what Nango sends as a client.
# Set on every service. Inline values accept raw PEM or base64-encoded PEM.
# NANGO_INTERNAL_TLS_CERT=<CLIENT-CERTIFICATE-CHAIN-PEM>
# NANGO_INTERNAL_TLS_KEY=<CLIENT-PRIVATE-KEY-PEM>
# NANGO_INTERNAL_TLS_CA=<INTERNAL-CA-PEM>
# Or point at mounted files instead (mutually exclusive with the inline form above)
# NANGO_INTERNAL_TLS_CERT_FILE=/etc/nango/tls/tls.crt
# NANGO_INTERNAL_TLS_KEY_FILE=/etc/nango/tls/tls.key
# NANGO_INTERNAL_TLS_CA_FILE=/etc/nango/tls/ca.crt
# NANGO_INTERNAL_TLS_KEY_PASSPHRASE=<PASSPHRASE-IF-KEY-IS-ENCRYPTED>
# Scheme for runner URLs built by the Kubernetes and Render providers
# NANGO_RUNNER_URL_SCHEME=https

# ---- Internal service auth (self-hosted, optional)
# Off by default. Shipping the image with these unset is a no-op until you inject secrets
# and set NANGO_INTERNAL_AUTH_REQUIRED=true. See docs/guides/platform/self-hosting/self-managed.mdx.
# Legacy static bearer and HMAC signing key. Still accepted after the Ed25519 private keys are set.
# Keep both until legacy callers and in-flight tokens have expired.
# Control plane only (server, jobs, orchestrator). Never set on runners.
# NANGO_INTERNAL_AUTH_TOKEN=<SHARED-BEARER>
# Jobs only. Never set on runners; jobs injects only verify-only material at node start.
# NANGO_INTERNAL_AUTH_SIGNING_KEY=<HMAC-SECRET>
# Ed25519 service and workload tokens. Set public keys and recycle runners before setting private keys.
# Jobs private key never goes on a runner.
# Public keys are a JSON array of {"kid","publicKey"}. publicKey is the base64url raw 32-byte Ed25519 key.
# NANGO_INTERNAL_AUTH_JOBS_KEY_ID=jobs-2026-09
# NANGO_INTERNAL_AUTH_JOBS_PRIVATE_KEY=<PKCS8-PEM>
# NANGO_INTERNAL_AUTH_JOBS_PUBLIC_KEYS=[{"kid":"jobs-2026-09","publicKey":"<BASE64URL-PUBLIC-KEY>"}]
# NANGO_INTERNAL_AUTH_SERVER_KEY_ID=server-2026-09
# NANGO_INTERNAL_AUTH_SERVER_PRIVATE_KEY=<PKCS8-PEM>
# NANGO_INTERNAL_AUTH_SERVER_PUBLIC_KEYS=[{"kid":"server-2026-09","publicKey":"<BASE64URL-PUBLIC-KEY>"}]
# Fail closed. Default false. Flip independently on orchestrator, then jobs (runners inherit REQUIRED at node start).
# NANGO_INTERNAL_AUTH_REQUIRED=false