.env.example

# ── AI Provider (at least one required) ───────────────────────────────────────
ANTHROPIC_API_KEY=
OPENAI_API_KEY=
OPENROUTER_API_KEY=
GEMINI_API_KEY=
XAI_API_KEY=
GROQ_API_KEY=
MISTRAL_API_KEY=
CEREBRAS_API_KEY=
VENICE_API_KEY=
MOONSHOT_API_KEY=
KIMI_API_KEY=
MINIMAX_API_KEY=
ZAI_API_KEY=
AI_GATEWAY_API_KEY=
OPENCODE_API_KEY=
SYNTHETIC_API_KEY=
COPILOT_GITHUB_TOKEN=
XIAOMI_API_KEY=

# ── Deepgram (audio transcription, optional) ─────────────────────────────────
DEEPGRAM_API_KEY=

# ── Amazon Bedrock (uses AWS credential chain) ───────────────────────────────
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=us-east-1
# AWS_SESSION_TOKEN=
# BEDROCK_PROVIDER_FILTER=anthropic

# ── Ollama (local models, no API key needed) ─────────────────────────────────
# Set to your Ollama server URL to enable, e.g. http://host.docker.internal:11434
OLLAMA_BASE_URL=

# ── HTTP Basic Auth (recommended) ────────────────────────────────────────────
# If set, nginx enforces basic auth on all routes (except /healthz).
AUTH_PASSWORD=
AUTH_USERNAME=admin

# ── Gateway ──────────────────────────────────────────────────────────────────
# Bearer token for gateway auth. Auto-generated and persisted if not set.
OPENCLAW_GATEWAY_TOKEN=
OPENCLAW_GATEWAY_PORT=18789
# Gateway bind mode: loopback (default), lan (0.0.0.0), tailnet, auto, or custom.
# Set to "lan" for direct LAN access on port 18789 (bypasses nginx auth).
# Note: LAN access via nginx (port 8080) works regardless of this setting.
# OPENCLAW_GATEWAY_BIND=loopback

# ── Model selection ─────────────────────────────────────────────────────────
# Override the default primary model. Format: provider/model-id
# Examples: opencode/claude-opus-4-5, anthropic/claude-sonnet-4-5-20250929,
#           openrouter/anthropic/claude-opus-4-5, google/gemini-2.5-pro
# If not set, auto-selects based on which provider API key is configured first.
# OPENCLAW_PRIMARY_MODEL=

# ── Custom config (optional) ─────────────────────────────────────────────────
# Mount a full or partial openclaw.json for advanced settings. Env vars override
# on top, so API keys and common settings still work as env vars.
# Example: docker run -v ./my-openclaw.json:/app/config/openclaw.json ...
# OPENCLAW_CUSTOM_CONFIG=/app/config/openclaw.json

# ── Storage ──────────────────────────────────────────────────────────────────
# Mount a persistent volume at /data.
OPENCLAW_STATE_DIR=/data/.openclaw
OPENCLAW_WORKSPACE_DIR=/data/workspace

# ── Channels (optional) ──────────────────────────────────────────────────────
TELEGRAM_BOT_TOKEN=
TELEGRAM_DM_POLICY=pairing
# Comma-separated allowlist of user IDs/usernames.
# Required when dmPolicy=allowlist (e.g. TELEGRAM_ALLOW_FROM=@username,12345)
# Required when dmPolicy=open (must include "*", e.g. TELEGRAM_ALLOW_FROM=*)
# TELEGRAM_ALLOW_FROM=
# TELEGRAM_GROUP_POLICY=allowlist
# TELEGRAM_GROUP_ALLOW_FROM=
# TELEGRAM_REPLY_TO_MODE=first
# TELEGRAM_CHUNK_MODE=length
# TELEGRAM_TEXT_CHUNK_LIMIT=4000
# TELEGRAM_STREAM_MODE=partial
# TELEGRAM_LINK_PREVIEW=true
# TELEGRAM_MEDIA_MAX_MB=5
# TELEGRAM_REACTION_NOTIFICATIONS=own
# TELEGRAM_REACTION_LEVEL=minimal
# TELEGRAM_INLINE_BUTTONS=allowlist
# TELEGRAM_ACTIONS_REACTIONS=true
# TELEGRAM_ACTIONS_STICKER=false
# TELEGRAM_PROXY=
# TELEGRAM_WEBHOOK_URL=
# TELEGRAM_WEBHOOK_SECRET=
# TELEGRAM_WEBHOOK_PATH=/telegram-webhook
# TELEGRAM_MESSAGE_PREFIX=
DISCORD_BOT_TOKEN=
DISCORD_DM_POLICY=pairing
# DISCORD_DM_ALLOW_FROM=
# DISCORD_GROUP_POLICY=allowlist
# DISCORD_REPLY_TO_MODE=off
# DISCORD_CHUNK_MODE=length
# DISCORD_TEXT_CHUNK_LIMIT=2000
# DISCORD_MAX_LINES_PER_MESSAGE=17
# DISCORD_MEDIA_MAX_MB=8
# DISCORD_HISTORY_LIMIT=20
# DISCORD_DM_HISTORY_LIMIT=
# DISCORD_REACTION_NOTIFICATIONS=own
# DISCORD_ALLOW_BOTS=false
# DISCORD_MESSAGE_PREFIX=
# DISCORD_ACTIONS_REACTIONS=true
# DISCORD_ACTIONS_STICKERS=true
# DISCORD_ACTIONS_EMOJI_UPLOADS=true
# DISCORD_ACTIONS_STICKER_UPLOADS=true
# DISCORD_ACTIONS_POLLS=true
# DISCORD_ACTIONS_PERMISSIONS=true
# DISCORD_ACTIONS_MESSAGES=true
# DISCORD_ACTIONS_THREADS=true
# DISCORD_ACTIONS_PINS=true
# DISCORD_ACTIONS_SEARCH=true
# DISCORD_ACTIONS_MEMBER_INFO=true
# DISCORD_ACTIONS_ROLE_INFO=true
# DISCORD_ACTIONS_CHANNEL_INFO=true
# DISCORD_ACTIONS_CHANNELS=true
# DISCORD_ACTIONS_VOICE_STATUS=true
# DISCORD_ACTIONS_EVENTS=true
# DISCORD_ACTIONS_ROLES=false
# DISCORD_ACTIONS_MODERATION=false
SLACK_BOT_TOKEN=
SLACK_APP_TOKEN=
# SLACK_USER_TOKEN=
# SLACK_SIGNING_SECRET=
# SLACK_MODE=socket
# SLACK_WEBHOOK_PATH=/slack/events
# SLACK_DM_POLICY=pairing
# SLACK_DM_ALLOW_FROM=
# SLACK_GROUP_POLICY=open
# SLACK_REPLY_TO_MODE=off
# SLACK_REACTION_NOTIFICATIONS=own
# SLACK_CHUNK_MODE=newline
# SLACK_TEXT_CHUNK_LIMIT=4000
# SLACK_MEDIA_MAX_MB=20
# SLACK_HISTORY_LIMIT=50
# SLACK_ALLOW_BOTS=false
# SLACK_MESSAGE_PREFIX=
# SLACK_ACTIONS_REACTIONS=true
# SLACK_ACTIONS_MESSAGES=true
# SLACK_ACTIONS_PINS=true
# SLACK_ACTIONS_MEMBER_INFO=true
# SLACK_ACTIONS_EMOJI_LIST=true
WHATSAPP_ENABLED=
WHATSAPP_DM_POLICY=pairing
# WHATSAPP_SELF_CHAT_MODE=false
# Comma-separated E.164 phone numbers.
# Required when dmPolicy=allowlist (e.g. WHATSAPP_ALLOW_FROM=+1234567890,+0987654321)
# Required when dmPolicy=open (must include "*", e.g. WHATSAPP_ALLOW_FROM=*)
# WHATSAPP_ALLOW_FROM=
# WHATSAPP_GROUP_POLICY=allowlist
# WHATSAPP_GROUP_ALLOW_FROM=
# WHATSAPP_MEDIA_MAX_MB=50
# WHATSAPP_HISTORY_LIMIT=50
# WHATSAPP_DM_HISTORY_LIMIT=
# WHATSAPP_SEND_READ_RECEIPTS=true
# WHATSAPP_ACK_REACTION_EMOJI=
# WHATSAPP_ACK_REACTION_DIRECT=true
# WHATSAPP_ACK_REACTION_GROUP=mentions
# WHATSAPP_MESSAGE_PREFIX=
# WHATSAPP_ACTIONS_REACTIONS=true

# ── Hooks (webhook automation, optional) ──────────────────────────────────────
# Enables the /hooks endpoint for external webhook triggers (wake, agent, custom).
# When enabled with AUTH_PASSWORD, the hooks path bypasses HTTP basic auth —
# openclaw validates requests using the shared hook token instead.
# Docs: https://docs.openclaw.ai/automation/webhook
# HOOKS_ENABLED=true
# HOOKS_TOKEN=your-shared-secret
# HOOKS_PATH=/hooks

# ── Browser tool (remote CDP sidecar, optional) ──────────────────────────────
# Connect to a Chrome sidecar via Chrome DevTools Protocol.
# Recommended: kasmweb/chrome (full desktop via noVNC on :6901, CDP on :9222).
# Docs: https://docs.openclaw.ai/tools/browser
# BROWSER_CDP_URL=http://browser:9222
# BROWSER_EVALUATE_ENABLED=false
# BROWSER_SNAPSHOT_MODE=
# BROWSER_REMOTE_TIMEOUT_MS=1500
# BROWSER_REMOTE_HANDSHAKE_TIMEOUT_MS=3000
# BROWSER_DEFAULT_PROFILE=

# ── Provider base URL overrides (optional) ───────────────────────────────────
# Custom base URL, e.g. Cloudflare AI Gateway:
#   https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/anthropic
AI_GATEWAY_BASE_URL=
ANTHROPIC_BASE_URL=
MOONSHOT_BASE_URL=
KIMI_BASE_URL=

# ── Extra system packages (optional) ──────────────────────────────────────────
# Space-separated list of apt packages to install at container startup.
# Example: OPENCLAW_DOCKER_APT_PACKAGES=ffmpeg build-essential
# OPENCLAW_DOCKER_APT_PACKAGES=

# ── Custom init script (optional) ─────────────────────────────────────────────
# Script that runs on every container start before openclaw starts.
# Must be executable (chmod +x) and idempotent. Useful for extra runtime setup.
# WARNING: Runs with container privileges. Review scripts from untrusted sources.
# OPENCLAW_DOCKER_INIT_SCRIPT=/data/init.d/init.sh

# ── Port ─────────────────────────────────────────────────────────────────────
PORT=8080

# ── Coolify-specific (auto-set by Coolify) ───────────────────────────────────
# COOLIFY_FQDN         — public FQDN assigned by Coolify
# COOLIFY_URL          — Coolify dashboard URL
# COOLIFY_BRANCH       — git branch deployed