Environment variables
Required and optional environment variables for Brain.
See .env.example in the repository for the full commented list.
| Variable | Purpose |
|---|
BRAIN_DATABASE_URL | Postgres URL (DATABASE_URL also accepted) |
BETTER_AUTH_SECRET | Session signing (openssl rand -base64 32) |
COMMAND_CODE_API_KEY | Command Code models (omit only if you rely solely on custom models) |
| Variable | Purpose |
|---|
BRAIN_PUBLIC_URL | Public origin (cookies, OAuth redirects, SEO) |
BETTER_AUTH_URL | Usually the same as BRAIN_PUBLIC_URL |
BRAIN_BOOTSTRAP_TOKEN | Required to create the first operator in production |
PORT | Next listen port (default 3000) |
EVE_NEXT_PRODUCTION_PORT | eve loopback port in production start (default 4274) |
| Variable | Purpose |
|---|
BRAIN_INTERNAL_TOKEN | Bearer between eve ↔ Next for scheduled runs |
BRAIN_INTERNAL_URL | Next origin for due-sweep (default http://127.0.0.1:3000) |
BRAIN_OPERATOR_USER_ID | Optional host operator for briefs (defaults to first user) |
EVE_BASE_URL / BRAIN_EVE_URL | Optional direct eve HTTP host for server-side runs |
| Variable | Purpose |
|---|
BRAIN_EMAIL_FROM | From header for invites / reset mail |
BRAIN_SMTP_URL | Prefer a single SMTP URL |
BRAIN_SMTP_HOST / PORT / SECURE / USER / PASS | Discrete SMTP fields |
| Variable | Purpose |
|---|
BRAIN_LICENSE_SECRET | Signs/verifies BRAIN1 keys (falls back to BETTER_AUTH_SECRET) |
Brain pins microsandbox for Agent coding. There is no Brain-specific sandbox API key in .env.example. Hosts may need the microsandbox platform install or MSB_PATH pointing at the binary — see Attached repo.
Prefer Tools → Set up / Menu Connect. Env remains deploy-time fallback:
| Apps | Variables |
|---|
| Slack | SLACK_MCP_CLIENT_ID, SLACK_MCP_CLIENT_SECRET |
| Slack inbound (Events / HITL) | SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET, optional SLACK_INBOUND_CHANNEL_IDS |
| Asana | ASANA_MCP_CLIENT_ID, ASANA_MCP_CLIENT_SECRET |
| Gmail | GOOGLE_MCP_CLIENT_ID, GOOGLE_MCP_CLIENT_SECRET |
| GitHub | GITHUB_MCP_CLIENT_ID, GITHUB_MCP_CLIENT_SECRET |
| Snowflake | SNOWFLAKE_MCP_SERVER_URL, SNOWFLAKE_PAT_TOKEN |
| MongoDB | MONGODB_MCP_URL, MONGODB_MCP_TOKEN |
| MCP Toolbox | TOOLBOX_MCP_URL, TOOLBOX_MCP_TOKEN |
| Rybbit | RYBBIT_MCP_URL, RYBBIT_MCP_TOKEN |
| Bytebot | BYTEBOT_MCP_URL, BYTEBOT_MCP_TOKEN |
DCR apps (ClickUp, Notion, Linear, Atlassian, Zernio, Sentry, dFlow) do not need client id/secret env vars.
- Treat the host as trusted: MCP tokens live under
.eve/
- Use strong secrets for
BETTER_AUTH_SECRET, BRAIN_BOOTSTRAP_TOKEN, and BRAIN_INTERNAL_TOKEN
- Prefer private network + SSL for Postgres (
?sslmode=require when required)
- Keep
BRAIN_PUBLIC_URL accurate behind reverse proxies so OAuth callbacks stay correct
- Vitest uses
BRAIN_TEST_DATABASE_URL / brain_test — never your operator DB
