KaiConfiguration
Every environment variable Kai reads, with its default.
Kai is configured only through the environment. There is no admin page; each
workspace manages its own keys, tools and members in the app.
.env.example lists the same variables with comments.
Required
| Variable | |
|---|---|
KAI_APP_URL | The URL people open, like https://kai.example.com. Sign-in, OAuth redirects and invitation links use it. Default http://localhost:3000. |
KAI_AUTH_SECRET | Signs sessions. openssl rand -hex 32. |
KAI_ENCRYPTION_KEY | 32 bytes as hex (openssl rand -hex 32). Encrypts every stored API key, header value and OAuth token. Back it up with the database; without it they can't be read. |
Accounts and workspaces
| Variable | Default | |
|---|---|---|
KAI_SIGNUP_MODE | invite | invite: only people with a pending invitation can sign up. open: anyone. closed: nobody. The first account on an empty instance, and KAI_ROOT_EMAIL, can always sign up. |
KAI_ROOT_EMAIL | The root user: can always sign up. | |
KAI_WORKSPACE_CREATION | everyone | everyone, or root (only KAI_ROOT_EMAIL can create workspaces). |
KAI_MEMBER_AGENTS | true | Whether members (not only owners and admins) can create their own agents. |
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET | Sign in with Google. Redirect URI: <KAI_APP_URL>/api/auth/callback/google. |
| Variable | Default | |
|---|---|---|
KAI_EMAIL_ADAPTER | local | local prints every email (verification codes included) to the server log. resend sends through Resend. |
RESEND_API_KEY | Required for resend. | |
KAI_EMAIL_FROM | Kai <no-reply@localhost> | The sender. With Resend, its domain must be verified there. |
See Email.
Network and tools
| Variable | Default | |
|---|---|---|
KAI_ALLOW_PRIVATE_NETWORK | false | Lets workspace admins point keys and MCP servers at private, loopback and link-local addresses (per key or server, with a switch). |
KAI_ALLOW_STDIO_MCP | false | Lets workspace admins add stdio MCP servers, which run commands on the Kai host with no sandbox. |
KAI_ENV_* | Values that MCP server settings can read with {{kai.env.KAI_ENV_<NAME>}}, like a directory for the Filesystem server or a shared token. Only names starting with KAI_ENV_ are readable. | |
KAI_LIBRARY_URL | The library service, for the MCP catalog and model data. Unset hides the library. | |
KAI_LIBRARY_PUBLIC_URL | KAI_LIBRARY_URL | Where browsers load library icons from, when that differs (in Compose, the server uses http://library:4100). |
Postgres
| Variable | Default | |
|---|---|---|
POSTGRES_HOST | localhost | |
POSTGRES_PORT | 5432 | |
POSTGRES_DATABASE | kai | |
POSTGRES_USER, POSTGRES_PASSWORD | A superuser, used only by migrate to create roles and apply migrations. | |
POSTGRES_APP_USER, POSTGRES_APP_PASSWORD | kai_app | Workspace data, always under row-level security. |
POSTGRES_AUTH_USER, POSTGRES_AUTH_PASSWORD | kai_auth | Accounts and sessions. |
POSTGRES_SERVICE_USER, POSTGRES_SERVICE_PASSWORD | kai_service | Background work that spans workspaces (the run manager, caches). |
DATABASE_URL | Used by migrate instead of the POSTGRES_* superuser settings, when set. |
Redis
| Variable | Default | |
|---|---|---|
REDIS_URL | redis://localhost:6379 |
Object storage
| Variable | Default | |
|---|---|---|
S3_ENDPOINT | The S3 API endpoint, as the server reaches it. Leave unset for AWS S3. | |
S3_PUBLIC_ENDPOINT | S3_ENDPOINT | The endpoint browsers use for uploads and downloads (presigned URLs). |
S3_REGION | us-east-1 | |
S3_BUCKET | kai | |
S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY | ||
S3_FORCE_PATH_STYLE | false | true for MinIO, SeaweedFS and most self-hosted stores. |
Server
| Variable | Default | |
|---|---|---|
PORT | 3000 | |
HOST | 0.0.0.0 | |
KAI_WEB_DIR | The built web app to serve. Set in the image (/app/web); unset in development, where Vite serves it. | |
KAI_MIGRATIONS_DIR | The SQL migrations, for node server.mjs migrate. Set in the image. | |
NODE_ENV | development | production in the image. |
Development only
| Variable | Default | |
|---|---|---|
KAI_API_PORT | 3001 | The API's port next to the Vite dev server. |
KAI_WEB_PORT | 3000 | The Vite dev server's port. Set KAI_APP_URL to it. |
KAI_API_URL | http://localhost:<KAI_API_PORT> | Where Vite forwards /api. |