######################################## # Core runtime ######################################## # Admin dashboard credentials — set during `neoagent setup`. # Access the dashboard at http://localhost:/admin # Run `neoagent admin` to display these credentials at any time. ADMIN_USERNAME=admin ADMIN_PASSWORD= # Admin API key for programmatic access to /admin/api/* endpoints. # Use: Authorization: Bearer # Generate or rotate via the admin dashboard → Access → Generate key. # Leave blank to disable API key auth (dashboard session auth still works). ADMIN_API_KEY= PORT=3333 NODE_ENV=production # Auto-generated on first start or setup if left blank. SESSION_SECRET= # Optional: dedicated key for encrypting local at-rest secrets (for example API_KEYS.json). # If unset, encryption falls back to SESSION_SECRET. # NEOAGENT_DATA_ENCRYPTION_KEY= # Public base URL used for OAuth callbacks and external links. # Example: https://agent.example.com PUBLIC_URL= # Set true when running behind HTTPS or a TLS-terminating proxy. SECURE_COOKIES=false # Use `managed` for SaaS-style deployments to hide self-update controls in the UI. NEOAGENT_DEPLOYMENT_MODE=self_hosted # Deployment profile: # private -> single-user / trusted host runtime # prod -> multi-user / isolated per-user VM runtime NEOAGENT_PROFILE=prod # Allow new user sign-ups. Set to false to disable registration (the first user # can always register regardless of this setting). # NEOAGENT_ALLOW_SIGNUP=false # Rolling per-user AI token limits. Users can have custom overrides in the # admin dashboard. NEOAGENT_RATE_LIMIT_4H=2500000 NEOAGENT_RATE_LIMIT_WEEKLY=10000000 # VM runtime settings used by `prod`. # Set these before switching NEOAGENT_PROFILE=prod. # The app can cache a shared base image automatically from a URL, then create # lightweight per-user qcow2 overlays on top of it. # For Apple Silicon / arm64 hosts, switch this to: # https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-arm64.img NEOAGENT_VM_BASE_IMAGE_URL=https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.img # Optional local override. If set, this takes precedence over the download URL. NEOAGENT_VM_BASE_IMAGE= # The guest image must boot a Linux guest that runs `npm run start:guest-agent` # and exposes the guest agent on port 8421. # Auto-generated on first start or setup if left blank. NEOAGENT_VM_GUEST_TOKEN= NEOAGENT_VM_MEMORY_MB=4096 NEOAGENT_VM_CPUS=2 # Self-hosted release track used by `neoagent update`. NEOAGENT_RELEASE_CHANNEL=stable # Comma-separated list of allowed CORS origins. # Example: http://localhost:3333,https://yourdomain.com ALLOWED_ORIGINS= ######################################## # Service email ######################################## # Service-only email for account security messages. # The agent cannot read, search, or send from this mailbox. It is not a Gmail, # Outlook, or messaging integration account; it is only used by the NeoAgent # server for signup confirmation, password reset, and security notifications. NEOAGENT_EMAIL_FROM= NEOAGENT_EMAIL_SMTP_HOST= NEOAGENT_EMAIL_SMTP_PORT=587 NEOAGENT_EMAIL_SMTP_USER= NEOAGENT_EMAIL_SMTP_PASS= NEOAGENT_EMAIL_SMTP_SECURE=false NEOAGENT_EMAIL_SMTP_REQUIRE_TLS=true NEOAGENT_EMAIL_SMTP_REJECT_UNAUTHORIZED=true NEOAGENT_EMAIL_REPLY_TO= NEOAGENT_EMAIL_REQUIRE_SIGNUP_CONFIRMATION=true NEOAGENT_EMAIL_REQUIRE_EMAIL_CHANGE_CONFIRMATION=true NEOAGENT_EMAIL_NOTIFY_UNUSUAL_LOGIN=true NEOAGENT_EMAIL_NOTIFY_ACCOUNT_CHANGES=true NEOAGENT_EMAIL_BRAND_NAME=NeoAgent NEOAGENT_EMAIL_SUPPORT_URL= NEOAGENT_EMAIL_PUBLIC_URL= NEOAGENT_EMAIL_TOKEN_TTL_HOURS=24 ######################################## # Hosted AI providers ######################################## # OpenAI API key — used for: # • Semantic memory embeddings (text-embedding-3-small, 1536 dims) # • WhatsApp voice note transcription (whisper-1 — incoming audio messages are auto-transcribed) # Without this key: memory falls back to keyword search and WhatsApp audio transcription is unavailable. # Get your key at: https://platform.openai.com/api-keys OPENAI_API_KEY=your-openai-api-key-here # Custom OpenAI-compatible Chat Completions provider. # Both the API key/token and base URL are required. OPENAI_COMPATIBLE_API_KEY= # Anthropic API key — used for: # • Claude models for long-context drafting and analysis ANTHROPIC_API_KEY=your-anthropic-api-key-here # xAI API key — used for: # • Main AI reasoning (grok-4-1-fast-reasoning — all agent tasks and conversations) # • Image generation (grok-imagine-image — generate_image tool) # • Image vision / analysis (grok-4-1-fast-reasoning has native image input — analyze_image tool, incoming WhatsApp photos) # Get your key at: https://console.x.ai XAI_API_KEY=your-xai-api-key-here # Google AI Studio API key — used for: # • Gemini models (e.g. gemini-3.1-flash-lite-preview) # Get your key at: https://aistudio.google.com/app/apikey GOOGLE_AI_KEY=your-google-ai-key-here # MiniMax Coding Plan API key — used for: # • MiniMax-M2.7 via the Anthropic-compatible MiniMax endpoint MINIMAX_API_KEY=your-minimax-api-key-here # NVIDIA NIM API key — used for: # • Free-tier and paid models on NVIDIA's hosted inference (Nemotron, Kimi, Llama 4, DeepSeek, etc.) # Get your key at: https://build.nvidia.com NVIDIA_API_KEY=your-nvidia-nim-api-key-here # OpenRouter API key — used for: # • 300+ models from all major providers through a single API # • Includes free-tier models (no credit needed for :free variants) # Get your key at: https://openrouter.ai/keys OPENROUTER_API_KEY=your-openrouter-api-key-here # GitHub Copilot OAuth token — used for: # • Copilot-backed chat/coding models (gpt-5.3, gpt-4.1) # Set via: neoagent login github-copilot GITHUB_COPILOT_ACCESS_TOKEN= # OpenAI Codex access token — used for: # • Codex-backed chat/coding models (gpt-5.5, gpt-5.4, gpt-5.4-mini) # Regular OpenAI API-key usage should use OPENAI_API_KEY and the normal OpenAI provider. OPENAI_CODEX_ACCESS_TOKEN= # Optional refresh token if your login flow returns it. OPENAI_CODEX_REFRESH_TOKEN= # Optional: ChatGPT account ID for the chatgpt-account-id header. # If not set, it is auto-decoded from the JWT in OPENAI_CODEX_ACCESS_TOKEN. # OPENAI_CODEX_ACCOUNT_ID= ######################################## # Provider endpoint overrides ######################################## # OPENAI_BASE_URL=https://your-openai-compatible-endpoint/v1 OPENAI_COMPATIBLE_BASE_URL= # ANTHROPIC_BASE_URL=https://your-anthropic-compatible-endpoint # XAI_BASE_URL=https://api.x.ai/v1 # OPENAI_CODEX_BASE_URL=https://chatgpt.com/backend-api/codex # OPENAI_CODEX_EDITOR_VERSION=vscode/1.99.0 # OPENAI_CODEX_EDITOR_PLUGIN_VERSION=neoagent/1.0.0 # OPENAI_CODEX_USER_AGENT=NeoAgent/1.0.0 ######################################## # Official integrations ######################################## # Google Workspace official integration OAuth client. # Redirect URI should match /api/integrations/oauth/callback. # Set PUBLIC_URL to your app's public base URL. Local default is http://localhost:3333. GOOGLE_OAUTH_CLIENT_ID=your-google-oauth-client-id GOOGLE_OAUTH_CLIENT_SECRET=your-google-oauth-client-secret GOOGLE_OAUTH_REDIRECT_URI= # Notion official integration OAuth client. # Redirect URI should match /api/integrations/oauth/callback. NOTION_OAUTH_CLIENT_ID=your-notion-oauth-client-id NOTION_OAUTH_CLIENT_SECRET=your-notion-oauth-client-secret NOTION_OAUTH_REDIRECT_URI= # Microsoft 365 official integration OAuth client. # Redirect URI should match /api/integrations/oauth/callback. # Leave tenant ID as `common` for a multi-tenant app, or set a specific Entra tenant ID. MICROSOFT_OAUTH_CLIENT_ID=your-microsoft-oauth-client-id MICROSOFT_OAUTH_CLIENT_SECRET=your-microsoft-oauth-client-secret MICROSOFT_OAUTH_REDIRECT_URI= MICROSOFT_OAUTH_TENANT_ID=common # Slack official integration OAuth client. # Redirect URI should match /api/integrations/oauth/callback. SLACK_OAUTH_CLIENT_ID=your-slack-oauth-client-id SLACK_OAUTH_CLIENT_SECRET=your-slack-oauth-client-secret SLACK_OAUTH_REDIRECT_URI= # Figma official integration OAuth client. # Redirect URI should match /api/integrations/oauth/callback. FIGMA_OAUTH_CLIENT_ID=your-figma-oauth-client-id FIGMA_OAUTH_CLIENT_SECRET=your-figma-oauth-client-secret FIGMA_OAUTH_REDIRECT_URI= # GitHub official integration OAuth client. # Redirect URI should match /api/integrations/oauth/callback. # Prefer least-privilege OAuth scopes for your use case. # Read-oriented examples: public_repo (public repositories), repo:status (commit status), read:org (org membership). # Avoid broad blanket scopes unless explicitly required by a specific write workflow. GITHUB_OAUTH_CLIENT_ID=your-github-oauth-client-id GITHUB_OAUTH_CLIENT_SECRET=your-github-oauth-client-secret GITHUB_OAUTH_REDIRECT_URI= # Spotify official integration OAuth client. # Redirect URI should match /api/integrations/oauth/callback. SPOTIFY_OAUTH_CLIENT_ID=your-spotify-oauth-client-id SPOTIFY_OAUTH_CLIENT_SECRET=your-spotify-oauth-client-secret SPOTIFY_OAUTH_REDIRECT_URI= # Trello official integration API key. # This is used for Trello account connections in Official Integrations. # Users still connect their own Trello account token per agent in the UI. TRELLO_API_KEY=your-trello-api-key ######################################## # Tools and media services ######################################## # Brave Search API key — used for: # • Native web_search tool (search the web without driving the browser) # Get your key at: https://api.search.brave.com/ BRAVE_SEARCH_API_KEY=your-brave-search-api-key-here # Deepgram API key — used for: # • Voice transcription (Deepgram Nova-3 multilingual) # Without this key: Deepgram-backed voice transcription is unavailable. # Get your key at: https://console.deepgram.com/ DEEPGRAM_API_KEY=your-deepgram-api-key-here DEEPGRAM_BASE_URL=https://api.deepgram.com DEEPGRAM_MODEL=nova-3 DEEPGRAM_LANGUAGE=multi ######################################## # Local model runtime ######################################## OLLAMA_URL=http://localhost:11434 # Connected integration memory refresh cadence in milliseconds. NEOAGENT_MEMORY_INGESTION_INTERVAL_MS=600000 ######################################## # Messaging and voice integrations ######################################## MESHTASTIC_ENABLED=true ######################################## # Stripe billing (optional) ######################################## # Set to true or 1 to enable the billing system. When disabled (default), # no billing routes are exposed and no payment UI is shown anywhere. # NEOAGENT_BILLING_ENABLED=false # Stripe API keys — required when billing is enabled. # Use test keys (sk_test_...) during development; live keys in production. # STRIPE_SECRET_KEY=sk_test_... # STRIPE_PUBLISHABLE_KEY=pk_test_... # Webhook signing secret from your Stripe dashboard (Developers > Webhooks). # STRIPE_WEBHOOK_SECRET=whsec_... # Length of free trial periods in days (default: 14). # BILLING_TRIAL_DAYS=14