Configuration Reference
Every environment variable Org in a Box reads, with defaults and notes.
Core
| Variable | Default | Description |
|---|---|---|
POSTGRES_URL | — | Full connection string: postgres://user:pass@host:5432/db |
DATABASE_URL | — | Alias for POSTGRES_URL (either works) |
OPENCODE_URL | http://sandbox:4096 | URL of the opencode sandbox HTTP server |
OPENCODE_SERVER_PASSWORD | — | Shared basic-auth password for the sandbox HTTP server. Local bun orginabox up / bun compose:up auto-generates it; set it manually for raw compose or hosted environments |
ORGINABOX_API_KEY | — | Bearer token for the REST API. Unset = local-dev mode (no auth) |
OPERATOR_USER_ID | — | Fallback user ID for single-operator mode (no SSO) |
LLM Providers
| Variable | Description |
|---|---|
ANTHROPIC_API_KEY | Anthropic API key (Claude models) |
OPENAI_API_KEY | OpenAI API key (GPT models + embeddings) |
AZURE_OPENAI_API_KEY | Azure OpenAI key |
AZURE_OPENAI_ENDPOINT | Azure OpenAI endpoint URL (https://<name>.openai.azure.com) |
The setup wizard writes provider credentials encrypted into the providers table. You can also manage them via bun orginabox provider add or, for owners/admins in the signed-in web app, the Settings → Providers screen. After provider changes, run bun orginabox runtime apply to promote the staged runtime into the sandbox.
Azure AD SSO
Customer-side auth (tenant admins + end users):
| Variable | Description |
|---|---|
AZURE_CLIENT_ID | Entra ID app registration client ID |
AZURE_CLIENT_SECRET | App registration client secret |
AZURE_TENANT_ID | Azure AD tenant ID, or common for multi-tenant |
AZURE_REDIRECT_URI | OAuth callback URL (default: http://localhost:8787/v1/auth/callback) |
Optional platform-side auth (internal staff only — SaaS prod):
| Variable | Description |
|---|---|
AZURE_PLATFORM_CLIENT_ID | Separate platform app registration client ID |
AZURE_PLATFORM_CLIENT_SECRET | Platform app registration client secret |
AZURE_PLATFORM_TENANT_ID | Specific platform tenant ID (must not be common) |
AZURE_PLATFORM_REDIRECT_URI | Platform OAuth callback URL (default: http://localhost:8787/v1/platform/auth/callback) |
Each platform variable falls back to its AZURE_* counterpart when unset. Self-hosted single-tenant pilots can leave all AZURE_PLATFORM_* empty; the customer app reg handles both flows.
When both AZURE_CLIENT_ID and AZURE_PLATFORM_CLIENT_ID are unset, browser SSO is disabled. Local demo installs can still run with anonymous mode enabled, and the login screen falls back to opening the workspace directly instead of dead-ending on Microsoft auth.
Azure Key Vault (production)
| Variable | Description |
|---|---|
AZURE_KEYVAULT_URL | Key Vault URL (https://<name>.vault.azure.net) |
AZURE_KEYVAULT_SECRET_NAME | Secret name for the 32-byte keyring (default: orginabox-keyring) |
When unset, the keyring is stored at ~/.orginabox/.keyring (file mode 0600).
Observability
| Variable | Description |
|---|---|
OTEL_EXPORTER_OTLP_ENDPOINT | OTLP endpoint (e.g. Azure App Insights, Jaeger) |
OTEL_EXPORTER_OTLP_HEADERS | Auth headers, e.g. Authorization=Bearer <key> |
Gateway-specific
See the individual gateway setup guides for gateway-specific variables (SLACK_BOT_TOKEN, TEAMS_APP_ID, etc.).
Docker Compose Profiles
Enable optional services with --profile:
docker compose --profile slack up -d # Slack gateway
docker compose --profile teams up -d # Microsoft Teams gateway
docker compose --profile email up -d # Email gateway
docker compose --profile web up -d # Next.js dashboard
docker compose up -d orginabox-api # Standalone REST API container