Technical referenceOfficial documentation21 min readInteractive module page

Environment Variable Checklist Generator: 136 Variables in 15 Groups, Filtered by Deployment Shape

Filter the 136 environment variables down to the ones a given deployment actually needs, with the ones that have no default and the ones that are off by default marked.

The configuration template holds 136 variables in 15 groups. A single deployment touches far fewer: 104 carry a default and run untouched, 32 genuinely have to be filled in, and another 24 are off by default and only take effect once enabled explicitly. The module below narrows that down by deployment shape and the features in use.

Why filling the template line by line is a poor plan

The template lists every variable that could ever be needed. It is not a form to be completed. Filling it line by line goes wrong in three ways.

First, it replaces working defaults with something else. Of the 136 variables, 104 ship with a default, most of them tuned for a single-host deployment, and hand-editing them to a more reasonable looking number tends to run into resource ceilings instead.

Second, it switches on features that are not wanted. Variables in the object storage, sandbox and enhanced parsing groups matter only when those features are used, and a half-filled configuration is worse than an empty one: the service starts and fails later, with an error that points at a downstream component.

Third, it misses the ones that genuinely matter. The required variables are spread across groups rather than gathered at the top, so working top to bottom tends to stop somewhere in the middle - and what gets missed is usually a secret or an external service address, exactly the class with no default.

Interactive module: checklist by deployment shape

Choose a deployment shape and the features to enable, and the module lists the variables this deployment actually needs, the default for each, and which ones have to be filled in. It can show required variables only, or include the ones that are off by default.

Values from v4.16.2Verified 2026-09-09Variables 136Groups 15
Features to enable
Filters
In checklist112
Must fill in19
Off by default0

Basic configuration4 / 4 variables

VariableDefaultStatusNotes
LOG_DEPTH3On by defaultNo note in the template
DEFAULT_ROOT_PSW123456On by defaultDefault user password (username: root), auto-updated on each restart
DB_MAX_LINK5On by defaultMax database connections
SYNC_INDEXtrueOn by defaultAuto-sync index

Secrets4 / 4 variables

VariableDefaultStatusNotes
FILE_TOKEN_KEYNo defaultMust fill inSecret for file reading
AES256_SECRET_KEYfastgptsecretOn by defaultSecret encryption key
INVOKE_TOKEN_SECRETfastgpt_invoke_token_secret_32_chars_minOn by defaultInvoke reverse call JWT secret, minimum 32 bits
ROOT_KEYfdafasdOn by defaultroot key (highest privilege)

Service addresses and integrations30 / 34 variables

VariableDefaultStatusNotes
PLUGIN_BASE_URLhttp://localhost:3004On by defaultPlugin service
PLUGIN_TOKENXHgR8zvKx1FhjHUxCKdJMNpzFUMlavM1On by defaultNo note in the template
CODE_SANDBOX_URLhttp://localhost:3002On by defaultCode sandbox service
CODE_SANDBOX_TOKENcodesandboxOn by defaultNo note in the template
AIPROXY_API_ENDPOINThttp://localhost:3010On by defaultAI Proxy API
AIPROXY_API_TOKENtokenOn by defaultNo note in the template
SSE_MCP_SERVER_PROXY_ENDPOINThttp://localhost:3003On by defaultMCP Server proxy address, used for splicing SSE address on MCP usage page (do not add trailing /)
MARKETPLACE_URLhttps://v2.marketplace.fastgpt.cnOn by defaultPlugin marketplace address
AGENT_SANDBOX_PROVIDERNo defaultMust fill inAgent sandbox
AGENT_SANDBOX_SEALOS_BASEURLNo defaultMust fill inSealos devbox
AGENT_SANDBOX_SEALOS_TOKENNo defaultMust fill inNo note in the template
AGENT_SANDBOX_SEALOS_IMAGENo defaultMust fill inNo note in the template
AGENT_SANDBOX_SEALOS_WORK_DIRECTORY/home/devbox/workspaceOn by defaultNo note in the template
AGENT_SANDBOX_CPU_COUNT1On by defaultAgent Sandbox per-instance CPU core count and memory limit (MiB)
AGENT_SANDBOX_MEMORY_MIB2048On by defaultNo note in the template
AGENT_SANDBOX_STORAGE_SIZE_GI1On by defaultAgent Sandbox storage capacity, unit Gi
AGENT_SANDBOX_OPENSANDBOX_BASEURLhttp://localhost:8090On by defaultOpenSandbox configuration (effective when PROVIDER=opensandbox)
AGENT_SANDBOX_OPENSANDBOX_API_KEYmy_secure_sandbox_key_123On by defaultNo note in the template
AGENT_SANDBOX_OPENSANDBOX_RUNTIMEdockerOn by defaultNo note in the template
AGENT_SANDBOX_OPENSANDBOX_IMAGEregistry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-agent-sandbox:v0.1On by defaultNo note in the template
AGENT_SANDBOX_OPENSANDBOX_USE_SERVER_PROXYtrueOn by defaultNo note in the template
AGENT_SANDBOX_OPENSANDBOX_VOLUME_MANAGER_URLhttp://localhost:3005On by defaultNo note in the template
AGENT_SANDBOX_OPENSANDBOX_VOLUME_MANAGER_TOKENvmtokenOn by defaultNo note in the template
AGENT_SANDBOX_OPENSANDBOX_VOLUME_NAME_PREFIXfastgpt-sessionOn by defaultNo note in the template
AGENT_SANDBOX_MAX_EDIT_DEBUG100On by defaultMax number of active editing/debugging sandboxes
AGENT_SANDBOX_SUSPEND_MINUTES60On by defaultAuto-pause timeout (minutes) for running Agent Sandbox after continuous inactivity
AGENT_SANDBOX_ARCHIVE_INACTIVE_DAYS7On by defaultAuto-archive suspended Agent sandboxes after days of continuous inactivity
AGENT_SANDBOX_NPM_REGISTRYNo defaultMust fill innpm registry used by npm/yarn/pnpm/bun in Agent sandbox (optional)
AGENT_SANDBOX_PYPI_INDEX_URLNo defaultMust fill inPyPI index URL used by pip/python -m pip/uv in Agent sandbox (optional)
AGENT_SANDBOX_APT_MIRRORNo defaultMust fill inapt mirror address used in Ubuntu or Debian Agent sandbox (optional), only valid for root; /debian-security for Debian will be automatically derived

Sandbox proxy and network3 / 3 variables

VariableDefaultStatusNotes
AGENT_SANDBOX_PROXY_SECRETdefault_fastgpt_agent_sandbox_proxy_secretOn by defaultJWT verification and intranet security physical blocking secret (must be exactly same as AGENT_SANDBOX_PROXY_SECRET env var of Rust Proxy). Production environment must configure as high-strength random value of at least 32 bytes, do not use example placeholder
AGENT_SANDBOX_PROXY_URLws://localhost:3006On by defaultPublic WebSocket address for browser client to connect sandbox proxy. Required when Agent Sandbox (show_agent_sandbox) is enabled; leave empty otherwise. Dev env: recommend ws://localhost:3006 (points to Rust proxy in Docker Compose). Prod env: configure browser-accessible ws:// or wss:// proxy address.
AGENT_SANDBOX_PREVIEW_PROXY_URLhttp://localhost:3006On by defaultHTTP(S) address for browser to access sandbox file preview. Required when Agent Sandbox is enabled; uses same port as WebSocket by default in single-port deployment.

Object storage14 / 14 variables

VariableDefaultStatusNotes
STORAGE_VENDORminioOn by defaultStorage provider; Fill in aws-s3 if using Sealos object storage
STORAGE_REGIONus-east-1On by defaultNo note in the template
STORAGE_ACCESS_KEY_IDminioadminOn by defaultNo note in the template
STORAGE_SECRET_ACCESS_KEYminioadminOn by defaultNo note in the template
STORAGE_PUBLIC_BUCKETfastgpt-publicOn by defaultNo note in the template
STORAGE_PRIVATE_BUCKETfastgpt-privateOn by defaultNo note in the template
STORAGE_EXTERNAL_ENDPOINTNo defaultMust fill inNo note in the template
STORAGE_S3_CDN_ENDPOINTNo defaultMust fill inNo note in the template
STORAGE_DOWNLOAD_URL_MODEshort-proxyOn by defaultDownload link mode: short-proxy | short-redirect | presigned
STORAGE_DOWNLOAD_REDIRECT_TTL_SECONDS300On by defaultTemporary S3 pre-signed download link TTL (seconds) in short-redirect mode, rarely needs modification
STORAGE_S3_ENDPOINThttp://localhost:9000On by defaultNo note in the template
STORAGE_S3_FORCE_PATH_STYLEtrueOn by defaultNo note in the template
STORAGE_S3_MAX_RETRIES3On by defaultNo note in the template
STORAGE_PUBLIC_ACCESS_EXTRA_SUB_PATHNo defaultMust fill inNo note in the template

Database and cache5 / 15 variables

VariableDefaultStatusNotes
REDIS_URLredis://default:mypassword@localhost:6379On by defaultRedis URL
MONGODB_URImongodb://myusername:mypassword@localhost:27017/fastgpt?authSource=admin&directConnection=trueOn by defaultMongoDB connection parameters; add directConnection=true may be required when connecting remote database in local development
MONGODB_LOG_URINo defaultMust fill inLog library
VECTOR_VQ_LEVEL32On by defaultVector database priority: pg > oceanbase > milvus > opengauss. Vector quantization level: PG supports 32/16, OceanBase supports 32/8/1
PG_URLpostgresql://username:password@localhost:5432/postgresOn by defaultPG vector database connection parameters

Logging12 / 12 variables

VariableDefaultStatusNotes
LOG_ENABLE_CONSOLEtrueOn by defaultLog level: trace | debug | info | warning | error | fatal
LOG_CONSOLE_LEVELdebugOn by defaultNo note in the template
LOG_ENABLE_OTELtrueOn by defaultNo note in the template
LOG_OTEL_LEVELinfoOn by defaultNo note in the template
LOG_OTEL_SERVICE_NAMEfastgpt-clientOn by defaultNo note in the template
LOG_OTEL_URLhttp://localhost:4318/v1/logsOn by defaultNo note in the template
METRICS_ENABLE_OTELtrueOn by defaultMetrics
METRICS_OTEL_URLhttp://localhost:4318/v1/metricsOn by defaultNo note in the template
METRICS_OTEL_SERVICE_NAMEfastgpt-clientOn by defaultNo note in the template
TRACING_ENABLE_OTELtrueOn by defaultTracing
TRACING_OTEL_URLhttp://localhost:4318/v1/tracesOn by defaultNo note in the template
TRACING_OTEL_SERVICE_NAMEfastgpt-clientOn by defaultNo note in the template

Domain and frontend2 / 3 variables

VariableDefaultStatusNotes
FE_DOMAINhttp://localhost:3000On by defaultRequired. FastGPT client access address, consisting of protocol, host and optional port, used to complete relative path resources (no trailing /)
FILE_DOMAINhttp://localhost:3000On by defaultFile domain (also points to FastGPT service); Assign independent domain for higher security to prevent high-risk file reading from affecting main domain content

Security10 / 10 variables

VariableDefaultStatusNotes
USE_IP_LIMITfalseOn by defaultEnable IP rate limiting (true); IP rate limiting for partial APIs to prevent abnormal requests
CHECK_INTERNAL_IPfalseOn by defaultEnable intranet IP check
AUTH_COOKIE_SECUREfalseOn by defaultAdd Secure attribute to login Cookie; enable only for full-site HTTPS
TRUSTED_PROXY_ENABLEfalseOn by defaultEnable trusted reverse proxy client IP verification
TRUSTED_PROXY_IPSNo defaultMust fill inTrusted reverse proxy IP/CIDR list, separated by comma or whitespace. Effective only when TRUSTED_PROXY_ENABLE=true; only X-Forwarded-For/X-Real-IP passed by explicitly trusted proxies will be used for client IP resolution
PASSWORD_LOGIN_MINUTE_LIMIT_COUNTNo defaultMust fill inPassword login request limit per minute (default 10)
PASSWORD_EXPIRED_MONTHNo defaultMust fill inPassword expiration months (no expiration if not set)
MAX_LOGIN_SESSIONNo defaultMust fill inMax logged-in client count (default 10)
ALLOWED_ORIGINSNo defaultMust fill inCustom CORS; allow all CORS by default if not configured (comma-separated)
MULTIPLE_DATA_TO_BASE64trueOn by defaultForce convert images to base64 when passing to model

Feature switches8 / 8 variables

VariableDefaultStatusNotes
SHOW_COUPONfalseOn by defaultDisplay redemption code function
SHOW_DISCOUNT_COUPONfalseOn by defaultDisplay coupon function
APP_REGISTRATION_URLNo defaultMust fill inAddress for application record filing
HIDE_CHAT_COPYRIGHT_SETTINGNo defaultMust fill inConfigure copyright info hiding; hidden only if value is true
WECOM_LOGIN_AUTO_REDIRECTfalseOn by defaultAllow WeChat Work client auto-login redirect, default false
OPENAPI_KEY_MAX_COUNT100On by defaultMaximum number of system API Keys that a single team member can create, minimum value is 1
AGENT_ENGINEfastAgentOn by defaultAgent engine selection: fastAgent (FastGPT agent loop) | piAgent (pi-agent-core engine)
SKIP_FILE_TYPE_CHECKfalseOn by defaultNo note in the template

Concurrency and limits6 / 6 variables

VariableDefaultStatusNotes
WECHAT_CHANNEL_CONCURRENCY1000On by defaultWeChat channel poll worker concurrency (default 1000), must ≥ online channel count; message delay worsens linearly when channel count exceeds this value
PARSE_FILE_TIMEOUT_SECONDS600On by defaultFile parsing timeout (seconds)
WORKFLOW_MAX_RUN_TIMES500On by defaultMax workflow run times to avoid extreme infinite loops
WORKFLOW_MAX_LOOP_TIMES100On by defaultMax input array length for loop/parallel nodes (default 100)
WORKFLOW_PARALLEL_MAX_CONCURRENCY10On by defaultMax concurrency for parallel nodes (will clamp to [5, 100], default 10)
CHAT_MAX_QPM5000On by defaultWorkflow QPM (does not take effect if user plan has restrictions)

Resource limits8 / 8 variables

VariableDefaultStatusNotes
SERVICE_REQUEST_MAX_CONTENT_LENGTH10On by defaultMax request size received by server (MB)
MAX_FOLDER_DEPTH4On by defaultMaximum allowed folder depth, default 4, range 2~20 (max 4 folder levels under root directory)
APP_FOLDER_MAX_AMOUNT1000On by defaultMax number of application folders
DATASET_FOLDER_MAX_AMOUNT1000On by defaultMax number of dataset folders
UPLOAD_FILE_MAX_SIZE1000On by defaultMax upload file size (MB)
UPLOAD_FILE_MAX_AMOUNT1000On by defaultMax number of upload files
LLM_REQUEST_TRACKING_RETENTION_HOURS6On by defaultLLM request trace retention duration (hours)
MAX_HTML_TRANSFORM_CHARS1000000On by defaultMax character count for HTML to Markdown conversion (no conversion if exceeded)

Enhanced PDF parsing (optional)2 / 8 variables

VariableDefaultStatusNotes
HNSW_EF_SEARCH100On by defaultVector retrieval hnsw ef_search parameter, only effective for PG / OB / OpenGauss
HNSW_MAX_SCAN_TUPLES100000On by defaultMaximum scanned data volume for vector retrieval, only effective for PG

Knowledge base processing concurrency4 / 4 variables

VariableDefaultStatusNotes
DATASET_PARSE_MAX_PROCESS10On by defaultMax concurrent knowledge base file parsing queue size
VECTOR_MAX_PROCESS10On by defaultMaximum concurrency of vector training queue
QA_MAX_PROCESS10On by defaultMax concurrent Q&A splitting queue size
VLM_MAX_PROCESS10On by defaultMax concurrency for image understanding model processing queue

Distribution across 15 groups

This table is the full distribution and can be read on its own. Where the with-default count is lower than the variable count, the difference is what has to be filled in for that group.

GroupVariablesWith defaultOn by defaultTemplate has notes
Basic configuration4443
Secrets4344
Service addresses and integrations34243018
Sandbox proxy and network3333
Object storage1411143
Database and cache1510512
Logging1212123
Domain and frontend3323
Security1051010
Feature switches8687
Chat log push (optional)3303
Concurrency and limits6666
Resource limits8888
Enhanced PDF parsing (optional)8228
Knowledge base processing concurrency4444

Where the 32 variables with no default sit

They are not spread evenly. The service address and integration group holds the most, because it carries addresses and credentials for external services, which cannot have defaults. Object storage and the database and cache group hold several each, depending on whether built-in components or external instances are used.

One class deserves separate attention: variables that carry a default and still have to be changed. These defaults sit in the public configuration template, so anyone holding the same template knows them. They are:

VariableGroupDefault in templateWhat it controls
DEFAULTROOTPSWBasic configuration123456Initial password for the root account
ROOT_KEYSecretsfdafasdRoot-level API credential
AES256SECRETKEYSecretsfastgptsecretKey used to encrypt sensitive fields at rest
INVOKETOKENSECRETSecretsfastgpt_invoke_token_secret_32_chars_minSigning key for internal invocation tokens
AGENTSANDBOXPROXY_SECRETSandbox proxy and networkdefault_fastgpt_agent_sandbox_proxy_secretSigning key for the sandbox proxy
AGENTSANDBOXOPENSANDBOXAPIKEYService addresses and integrationsmy_secure_sandbox_key_123API credential for the sandbox service
STORAGEACCESSKEY_IDObject storageminioadminBuilt-in object storage account
STORAGESECRETACCESS_KEYObject storageminioadminBuilt-in object storage password

Checking a configuration file against this table beats trying to recall which ones were changed. The two object storage entries matter only when the built-in storage is in use; an external object store replaces them with its own credentials.

Another class is the addresses and tokens for commercial edition or external platform integration. Running open source only means leaving them empty, and the service will start regardless. Filling in an address without its token fails at call time instead, and that half-filled state is harder to diagnose than an empty one.

Counted by group, the three holding the most variables without a default are Service addresses and integrations (10), Enhanced PDF parsing (optional) (6), Database and cache (5). That distribution doubles as a checking order before deployment: work through those three groups first, then pick off the scattered ones in the remaining groups, which beats reading the template from line one. The table above also settles quickly whether a group needs attention at all - where the variable count equals the with-default count, that group can be left alone.

Confirming a change actually took effect

Editing the configuration file is not the same as the service reading the new value. This step gets skipped often, and what it produces - configuration that looks right with behaviour that has not changed - is harder to chase than an error.

First, confirm the container was recreated rather than restarted. Environment variables are read when a container is created, and a restart does not re-read the file; the container has to come back up against the new configuration, or the file is new while the process still holds the old value.

Second, confirm from the service's own output rather than from the file. The file only states an intention; startup logs and runtime behaviour state what is actually in use. This matters most for variables that have defaults: a misspelled name makes the service fall back to the default silently, and the line in the file looks perfectly fine.

Third, confirm item by item rather than in bulk. After changing seven or eight variables, a service that starts proves nothing about each one. Listing the changed variables and checking them individually costs less than working backwards from symptoms later, and the checklist the module above produces can be used directly for that pass.

What the 24 off-by-default variables are

Part of the template is commented out, 24 variables in total. They are not deprecated; they are the enable-when-needed set.

They cluster around a few optional features: chat log push is off as a whole group, enhanced parsing is mostly off, and part of the database and cache group exists for external instances and is unnecessary with the built-in components.

Deciding what to enable works from the feature backwards, not from the variable name forwards. Establish whether this deployment uses a given feature, then look at which variables that group needs, rather than reading names one by one and guessing what each controls. The module above is organised in that order.

41 variables carry no note in the template

Of the 136 variables, 95 come with an explanatory note and the remaining 41 carry only a name and a default. That gap is stated here rather than papered over, and the last column of the table above is the number of documented variables per group.

For an undocumented variable there are two ways to work it out. One is the group it sits in, which already says which subsystem it belongs to. The other is searching the open-source repository for the name: it is usually read in only one or two places, and reading that usage beats guessing from the name.

Guessing from the literal name is not advisable. The same word can mean different things across groups - a variable with limit in its name may cap concurrency in one group and request size in another, and tuning the wrong one has entirely different consequences.

Version differences and expiry

The 136 variables here come from the v4.16.2 configuration template. Templates gain and lose variables between versions and change defaults, so comparing the two templates before an upgrade is worth the few minutes - especially looking for new variables with no default, since those stop the service from starting. Variables already edited are not overwritten on upgrade, but new ones do not appear in an existing configuration file by themselves.

Keep reading

Parameters and rules on this page are taken from the FastGPT open-source repository at v4.16.2, verified 2026-09-09.

References