> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.crewai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> Non-sensitive configuration passed to application pods as environment variables.

### Application Configuration

<ParamField path="envVars.APPLICATION_HOST" type="string" default="localhost">
  Hostname where the application is accessible.

  **Required:** Yes

  **Examples:**

  * Production: `"crewai.company.com"`
  * Development: `"localhost:2603"`
  * LoadBalancer: `"a1b2c3-1234.us-west-2.elb.amazonaws.com"`

  **Impact:** Used for generating URLs, OAuth callbacks, CORS validation, and webhook endpoints.

  **Important:** Must match actual access URL. Incorrect value causes:

  * OAuth authentication failures
  * Invalid webhook URLs
  * CORS rejection
</ParamField>

<ParamField path="envVars.APPLICATION_INTERNAL_URL" type="string" default="auto-generated">
  Internal URL for inter-service communication within the Kubernetes cluster.

  **Auto-Generated:** By default, this value is automatically generated using the format:

  ```
  <protocol>://<release-name>-web.<namespace>.svc.cluster.local:<port>
  ```

  **Protocol Detection:**

  * `https://` when `web.enableSslFromPuma: true`
  * `http://` when `web.enableSslFromPuma: false`

  **Override When:**

  * Using custom internal service discovery
  * Routing through internal proxy or service mesh
  * Non-standard networking configuration

  **Examples:**

  * Auto-generated: `"http://crewai-platform-web.crewai.svc.cluster.local:3000"`
  * Auto-generated (TLS): `"https://crewai-platform-web.crewai.svc.cluster.local:3000"`
  * Custom: `"https://crewai-internal.company.local"`

  **Leave Empty:** To use auto-generated value (recommended for most deployments).
</ParamField>

<ParamField path="envVars.RAILS_ENV" type="string" default="production (chart template)">
  Rails environment mode.

  **Default:** The chart automatically sets `RAILS_ENV` to `production` for all deployments. You do not need to set this value in your configuration file for production deployments.

  **When to Set:** Only configure `envVars.RAILS_ENV` when deploying a non-production Rails environment (development, staging, or test).

  **Valid Values:**

  * `"production"` - Production mode (optimized, logging minimized) - **Default, no configuration needed**
  * `"development"` - Development mode (detailed logging, auto-reload)
  * `"staging"` - Staging mode (production-like with extra logging)
  * `"test"` - Test mode (not for deployment)
</ParamField>

<ParamField path="envVars.CREWAI_FACTORY" type="boolean" default="true">
  Enable CrewAI Factory features.

  **Purpose:** Required for core CrewAI Platform functionality.
</ParamField>

<ParamField path="envVars.RAILS_LOG_LEVEL" type="string" default="info">
  Rails application log level.

  **Valid Values:** `"debug"`, `"info"`, `"warn"`, `"error"`, `"fatal"`

  **Recommendations:**

  * Production: `"info"` or `"warn"`
  * Staging: `"info"`
  * Development: `"debug"`

  **Performance Impact:** `"debug"` generates significantly more log output and can impact performance.
</ParamField>

<ParamField path="envVars.DEFAULT_REGION" type="string" default="us-west-2">
  Default AWS region for regional services.
</ParamField>

<ParamField path="envVars.LOGS_BUCKET" type="string" default="">
  S3 bucket for application log shipping.

  **Optional:** Leave empty to disable log shipping to S3.
</ParamField>

<ParamField path="envVars.RAILS_RELATIVE_URL_ROOT" type="string">
  URL prefix for mounting Rails application at a subpath.

  **Default:** Commented out

  **Example:**

  ```yaml theme={null}
  envVars:
    RAILS_RELATIVE_URL_ROOT: "/crewai"
  ```

  **Use Case:** Deploying at `https://company.com/crewai/` instead of `https://company.com/`.
</ParamField>

<ParamField path="envVars.SESSION_EXPIRATION_MINUTES" type="integer">
  Controls session timeout due to inactivity, in minutes. When set, users are logged out automatically after this period of inactivity.

  **Optional:** Leave unset to use the application's built-in session defaults.

  **Example:**

  ```yaml theme={null}
  envVars:
    SESSION_EXPIRATION_MINUTES: "60"
  ```

  **Use Case:** Enforce stricter session policies for security compliance (e.g., log users out after 30 or 60 minutes of inactivity).
</ParamField>

### CrewAI Built-in Integration

<ParamField path="envVars.CREWAI_OAUTH_API_BASE_URL" type="string" default="auto-generated">
  Internal URL for Built-in Integrations service communication.

  **Auto-Generated:** When `oauth.enabled: true`, this value is automatically generated using the format:

  ```
  http://<release-name>-oauth.<namespace>.svc.cluster.local:<port>
  ```

  **Purpose:** The Rails application uses this URL to communicate internally with the Built-in Integrations service for third-party integration management (Gmail, Google Calendar, Microsoft Outlook, etc.).

  **Default Generated Value:** `"http://crewai-oauth.crewai.svc.cluster.local:8787"`

  **Auto-Generation Details:**

  * Protocol: Always `http://` (internal cluster communication)
  * Service name: `<release-name>-oauth`
  * Namespace: Current release namespace
  * Port: `8787` (default Built-in Integrations service port)

  **Override When:**

  * Using custom service mesh routing
  * Built-in Integrations service hosted externally
  * Non-standard internal networking

  **Examples:**

  * Auto-generated (default): `"http://crewai-oauth.crewai.svc.cluster.local:8787"`
  * Custom: `"http://oauth-service.custom-namespace.svc.cluster.local:8080"`

  **Important:**

  * This is for **internal** service-to-service communication
  * External OAuth callbacks use the Ingress configuration (`oauth.ingress.host`)
  * Communication is authenticated using `CREWAI_OAUTH_API_KEY` secret

  **Leave Empty:** To use auto-generated value (recommended for most deployments).

  **Related Configuration:**

  * Built-in Integrations service configuration: See [CrewAI Built-in Integrations Reference](/reference/chart-values/oauth)
  * OAuth secrets: `secrets.OAUTH_INTERNAL_API_KEY` (auto-populated as `CREWAI_OAUTH_API_KEY` for Rails)
</ParamField>

### OIDC Identity Provider Configuration

<ParamField path="envVars.OIDC_ISSUER" type="string" default="auto-generated">
  OIDC issuer URL advertised in the platform's OIDC discovery document and token claims.

  **Auto-Generated:** By default, uses the application's public URL (constructed from `APPLICATION_HOST`).

  **Purpose:** This value is advertised in `/.well-known/openid-configuration` and embedded in the `iss` claim of all OIDC tokens issued by the platform. Cloud-provider trust policies must reference this exact URL when configuring workload identity federation.

  **Cloud Provider Trust Configuration:**

  When configuring workload identity federation, cloud providers require the exact issuer URL:

  * **AWS IAM OIDC Identity Providers:** The issuer URL must match the identity provider URL configured in IAM
  * **GCP Workload Identity Federation:** The issuer URI must match the OIDC provider configuration
  * **Azure Federated Credentials:** The issuer must match the federated credential subject

  **When to Override:**

  * Using a custom domain different from `APPLICATION_HOST`
  * Load balancer or reverse proxy rewrites the host header
  * Multi-region deployments with a canonical issuer URL
  * Migrating from one domain to another (must update cloud provider trust policies)

  **Important:**

  * Cloud provider trust policies pin to this exact URL
  * Changing this value invalidates all existing trust relationships
  * Must be a publicly accessible HTTPS URL (HTTP only for local development)
  * Must match the URL where `/.well-known/openid-configuration` is accessible

  **Examples:**

  * Auto-generated (default): Leave empty to use `"https://<APPLICATION_HOST>"`
  * Custom domain: `"https://auth.company.com"`
  * Development: `"http://localhost:2603"`

  **Related Configuration:**

  * OIDC signing material: `secrets.OIDC_PRIVATE_KEY` and `secrets.OIDC_KEY_ID` (auto-generated)
  * Public key endpoint: Available at `<OIDC_ISSUER>/oauth2/jwks`
  * Discovery document: Available at `<OIDC_ISSUER>/.well-known/openid-configuration`

  **Leave Empty:** To use auto-generated value based on `APPLICATION_HOST` (recommended for most deployments).
</ParamField>

### Wharf Observability

<Note>
  The following environment variables are automatically injected when `wharf.enabled: true`. These variables enable distributed tracing integration between the CrewAI Platform and the Wharf OTLP trace collector.
</Note>

<ParamField path="envVars.WHARF_URL" type="string" default="auto-generated">
  Internal URL for Wharf OTLP trace collector service communication.

  **Auto-Generated:** When `wharf.enabled: true`, this value is automatically generated using the format:

  ```
  http://<release-name>-wharf.<namespace>.svc.cluster.local:80
  ```

  **Purpose:** The Rails application and workers use this URL to submit OpenTelemetry traces to the Wharf service for distributed tracing and observability.

  **Default Generated Value:** `"http://crewai-platform-wharf.crewai.svc.cluster.local:80"`

  **Auto-Generation Details:**

  * Protocol: Always `http://` (internal cluster communication)
  * Service name: `<release-name>-wharf`
  * Namespace: Current release namespace
  * Port: `80` (Kubernetes service port, forwards to container port 8080)

  **Important:**

  * This is for **internal** service-to-service communication within the Kubernetes cluster
  * Automatically configured — no manual configuration needed
  * Traces are authenticated using the `WHARF_JWT_SECRET` environment variable
  * Only injected when Wharf is enabled

  **Related Configuration:**

  * Wharf service configuration: See [Wharf OTLP Trace Collector Reference](/reference/chart-values/wharf)
  * Wharf secrets: `secrets.WHARF_JWT_SECRET` (auto-generated and shared with Rails)
</ParamField>

<ParamField path="envVars.WHARF_JWT_SECRET" type="string" default="auto-generated">
  JWT secret for authenticating trace submissions to the Wharf service.

  **Auto-Injected:** When `wharf.enabled: true`, this environment variable is automatically populated from the `WHARF_JWT_SECRET` Kubernetes secret.

  **Purpose:** Authenticates OTLP trace submissions from the Rails application and workers to the Wharf trace collector.

  **Auto-Generation:** The secret value is automatically generated using `randAlphaNum 64` if not explicitly provided in `secrets.WHARF_JWT_SECRET`.

  **Important:**

  * Automatically configured — no manual configuration needed
  * Same value is shared between Rails application and Wharf service
  * Only injected when Wharf is enabled
  * Persists across upgrades via Helm's `lookup` function

  **ArgoCD Users:** The underlying secret (`secrets.WHARF_JWT_SECRET`) must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).

  **Related Configuration:**

  * Wharf service configuration: See [Wharf OTLP Trace Collector Reference](/reference/chart-values/wharf)
  * Secret configuration: See [Secrets Reference - Wharf Secrets](/reference/chart-values/secrets#wharf-secrets)
</ParamField>

### Authentication Configuration

<ParamField path="envVars.AUTH_PROVIDER" type="string" default="">
  Authentication provider type.

  **Required:** Yes

  **Valid Values:**

  * `"local"` - Local username/password authentication
  * `"entra_id"` - Microsoft Entra ID (Azure AD) authentication
  * `"okta"` - Okta authentication
  * `"workos"` - WorkOS authentication
  * `"keycloak"` - Keycloak authentication

  **Requirements by Provider:**

  **local:**

  * No additional configuration needed
  * Users managed in CrewAI Platform database

  **entra\_id:**

  * `envVars.ENTRA_ID_CLIENT_ID` required
  * `envVars.ENTRA_ID_TENANT_ID` required
  * `secrets.ENTRA_ID_CLIENT_SECRET` required
  * `envVars.ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID` optional (for CLI authentication)
  * `envVars.ENTRA_ID_CUSTOM_OPENID_SCOPE` optional
  * Azure AD application configured with redirect URI: `https://your-domain/auth/entra_id/callback`
  * Users authenticated via Microsoft

  **okta:**

  * `envVars.OKTA_SITE` required
  * `envVars.OKTA_CLIENT_ID` required
  * `secrets.OKTA_CLIENT_SECRET` required
  * `envVars.OKTA_AUTHORIZATION_SERVER` required
  * `envVars.OKTA_AUDIENCE` required
  * `envVars.OKTA_DEVICE_AUTHORIZATION_CLIENT_ID` optional (for CLI authentication)
  * `envVars.OKTA_USE_ORG_AUTH_SERVER` optional (default: `"false"`)
  * Okta application configured with redirect URI: `https://your-domain/auth/okta/callback`
  * Users authenticated via Okta

  **workos:**

  * `envVars.WORKOS_CLIENT_ID` required
  * `secrets.WORKOS_API_KEY` required
  * `envVars.WORKOS_AUTHKIT_DOMAIN` required
  * `envVars.WORKOS_COOKIE_PASSWORD` required
  * WorkOS application configured with redirect URI: `https://your-domain/auth/workos/callback`
  * Users authenticated via WorkOS

  **keycloak:**

  * `envVars.KEYCLOAK_CLIENT_ID` required
  * `envVars.KEYCLOAK_SITE` required
  * `envVars.KEYCLOAK_BASE_URL` optional (only for custom context paths)
  * `envVars.KEYCLOAK_REALM` required
  * `secrets.KEYCLOAK_CLIENT_SECRET` required
  * Keycloak client configured with redirect URI: `https://your-domain/auth/keycloak/callback`
  * Users authenticated via Keycloak
  * See [Keycloak SSO Configuration Guide](/features/keycloak-sso) for detailed setup instructions
</ParamField>

#### Okta Configuration

<ParamField path="envVars.OKTA_SITE" type="string" default="">
  Okta organization URL.

  **Format:** `https://your-domain.okta.com` or `https://your-domain.oktapreview.com`

  **When Required:** `AUTH_PROVIDER: okta`

  **Purpose:** Base URL where the Okta admin console is accessible.

  **Example:**

  ```yaml theme={null}
  envVars:
    AUTH_PROVIDER: "okta"
    OKTA_SITE: "https://company.okta.com"
    OKTA_CLIENT_ID: "0oa1234567890abcdef"
    OKTA_AUTHORIZATION_SERVER: "default"
    OKTA_AUDIENCE: "api://default"
    OKTA_DEVICE_AUTHORIZATION_CLIENT_ID: "0oa9876543210fedcba"
    OKTA_USE_ORG_AUTH_SERVER: "false"

  secrets:
    OKTA_CLIENT_SECRET: "your-client-secret"
  ```
</ParamField>

<ParamField path="envVars.OKTA_CLIENT_ID" type="string" default="">
  Okta application client ID for web application authentication.

  **When Required:** `AUTH_PROVIDER: okta`

  **Obtaining:** Found in Okta Admin Console under Applications > Your App > General Settings.

  **Note:** This client ID is for web application authentication. CLI authentication requires a separate client configured in `OKTA_DEVICE_AUTHORIZATION_CLIENT_ID`.
</ParamField>

<ParamField path="envVars.OKTA_AUTHORIZATION_SERVER" type="string" default="">
  Okta authorization server identifier.

  **Purpose:** Specifies which authorization server to use for authenticating users assigned to the web application.

  **Common Values:**

  * `"default"` - Default authorization server
  * `"aus1234567890abcdef"` - Custom authorization server ID

  **When Required:** `AUTH_PROVIDER: okta`

  **Finding:** Okta Admin Console > Security > API > Authorization Servers.
</ParamField>

<ParamField path="envVars.OKTA_AUDIENCE" type="string" default="">
  Okta API audience identifier.

  **Purpose:** Audience used by the authorization server to authenticate users assigned to the web application. Must match the audience configured in the authorization server specified by `OKTA_AUTHORIZATION_SERVER`.

  **Common Values:**

  * `"api://default"` - Default audience
  * `"https://your-domain.okta.com"` - Custom audience

  **When Required:** `AUTH_PROVIDER: okta`

  **Finding:** Okta Admin Console > Security > API > Authorization Servers. Choose the audience from the same authorization server as configured in `OKTA_AUTHORIZATION_SERVER`.
</ParamField>

<ParamField path="envVars.OKTA_DEVICE_AUTHORIZATION_CLIENT_ID" type="string" default="">
  Okta client ID for CLI device authorization flow.

  **When Required:** `AUTH_PROVIDER: okta` and CLI authentication needed

  **Purpose:** Enables CLI authentication using OAuth 2.0 Device Authorization Grant flow.

  **Important:** Okta requires a **separate, dedicated application** for the device authorization flow. This client ID must be different from the web application client (`OKTA_CLIENT_ID`).

  **Client Configuration Requirements:**

  * Create a dedicated application in Okta for device authorization
  * Configure the application with device authorization flow enabled
  * This must be a different application from the web application

  **Obtaining:** Found in Okta Admin Console under Applications > Your CLI App > General Settings.

  **Example:**

  ```yaml theme={null}
  envVars:
    OKTA_CLIENT_ID: "0oa1234567890abcdef"                        # Web app client
    OKTA_DEVICE_AUTHORIZATION_CLIENT_ID: "0oa9876543210fedcba"   # CLI client
  ```

  **Leave Empty:** If CLI authentication is not required.
</ParamField>

<ParamField path="envVars.OKTA_USE_ORG_AUTH_SERVER" type="string" default="false">
  Use Okta organization authorization server instead of custom authorization server.

  **Valid Values:**

  * `"true"` - Use the organization authorization server
  * `"false"` - Use a custom authorization server (default)

  **Default:** `"false"` (uses custom authorization server)

  **Purpose:** Specifies whether to use Okta's "organization authorization server" or a "custom authorization server" for authentication.

  **When to Set to "true":**

  * Using Okta's default organization authorization server
  * Not using a custom authorization server configuration

  **When to Keep "false":**

  * Using a custom authorization server (most common)
  * Default configuration

  **Example:**

  ```yaml theme={null}
  envVars:
    OKTA_USE_ORG_AUTH_SERVER: "true"
  ```
</ParamField>

#### Entra ID Configuration

<ParamField path="envVars.ENTRA_ID_CLIENT_ID" type="string" default="">
  Microsoft Entra ID (Azure AD) application (client) ID for web application authentication.

  **Format:** UUID (e.g., `12345678-1234-1234-1234-123456789012`)

  **When Required:** `AUTH_PROVIDER: entra_id`

  **Obtaining:** Azure Portal > App Registrations > Your App > Overview > Application (client) ID.

  **Example:**

  ```yaml theme={null}
  envVars:
    AUTH_PROVIDER: "entra_id"
    ENTRA_ID_CLIENT_ID: "12345678-1234-1234-1234-123456789012"
    ENTRA_ID_TENANT_ID: "87654321-4321-4321-4321-210987654321"
    ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID: "98765432-5678-5678-5678-876543210987"
    ENTRA_ID_CUSTOM_OPENID_SCOPE: "api://12345678-1234-1234-1234-123456789012/access"

  secrets:
    ENTRA_ID_CLIENT_SECRET: "your-client-secret"
  ```

  **Note:** This client ID is for web application authentication. CLI authentication can use the same application or a separate one via `ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID`.
</ParamField>

<ParamField path="envVars.ENTRA_ID_TENANT_ID" type="string" default="">
  Microsoft Entra ID (Azure AD) directory (tenant) ID.

  **Format:** UUID (e.g., `87654321-4321-4321-4321-210987654321`)

  **When Required:** `AUTH_PROVIDER: entra_id`

  **Obtaining:** Azure Portal > App Registrations > Your App > Overview > Directory (tenant) ID.
</ParamField>

<ParamField path="envVars.ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID" type="string" default="">
  Microsoft Entra ID client ID for CLI device authorization flow.

  **When Required:** `AUTH_PROVIDER: entra_id` and CLI authentication needed

  **Purpose:** Enables CLI authentication using OAuth 2.0 Device Authorization Grant flow.

  **Flexibility:** Entra ID allows using the same application for authenticating both web and CLI. You can either:

  * **Use the same client ID** as `ENTRA_ID_CLIENT_ID` (simpler, single application)
  * **Use a dedicated application** with a different client ID (more granular control)

  **Obtaining:** Azure Portal > App Registrations > Your App > Overview > Application (client) ID.

  **Example - Same Application:**

  ```yaml theme={null}
  envVars:
    ENTRA_ID_CLIENT_ID: "12345678-1234-1234-1234-123456789012"
    ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID: "12345678-1234-1234-1234-123456789012"  # Same as web
  ```

  **Example - Separate Application:**

  ```yaml theme={null}
  envVars:
    ENTRA_ID_CLIENT_ID: "12345678-1234-1234-1234-123456789012"                      # Web app
    ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID: "98765432-5678-5678-5678-876543210987" # CLI app
  ```

  **Leave Empty:** If CLI authentication is not required.
</ParamField>

<ParamField path="envVars.ENTRA_ID_CUSTOM_OPENID_SCOPE" type="string" default="">
  Custom OpenID scope for Entra ID authentication.

  **When Required:** `AUTH_PROVIDER: entra_id` (optional but recommended)

  **Purpose:** Specifies a custom API scope exposed by your Entra ID application for enhanced authentication.

  **Format:** `api://<application-id>/<scope-name>` (e.g., `api://12345678-1234-1234-1234-123456789012/access`)

  **Obtaining:** Azure Portal > App Registrations > Your App > Expose an API > Scopes.

  **Common Scope Names:**

  * `access` - General access scope
  * `user_impersonation` - User impersonation scope
  * Custom scope names defined in your application

  **Example:**

  ```yaml theme={null}
  envVars:
    ENTRA_ID_CUSTOM_OPENID_SCOPE: "api://12345678-1234-1234-1234-123456789012/access"
  ```

  **Leave Empty:** To use default OpenID scopes without custom API scopes.
</ParamField>

#### WorkOS Configuration

<ParamField path="envVars.WORKOS_CLIENT_ID" type="string" default="">
  WorkOS application client ID.

  **When Required:** `AUTH_PROVIDER: workos`

  **Obtaining:** WorkOS Dashboard > Main Page > Client ID.

  **Example:**

  ```yaml theme={null}
  envVars:
    AUTH_PROVIDER: "workos"
    WORKOS_CLIENT_ID: "client_01HXYZ123ABC456"
    WORKOS_AUTHKIT_DOMAIN: "company.authkit.com"
    WORKOS_COOKIE_PASSWORD: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

  secrets:
    WORKOS_API_KEY: "sk_live_abc123..."
  ```
</ParamField>

<ParamField path="envVars.WORKOS_AUTHKIT_DOMAIN" type="string" default="">
  WorkOS AuthKit domain for authentication.

  **Format:** `your-domain.authkit.com` (custom domain) or WorkOS-provided default domain

  **When Required:** `AUTH_PROVIDER: workos`

  **Purpose:** Specifies the AuthKit domain used for WorkOS authentication flows.

  **Obtaining:** WorkOS Dashboard > Developer > Domains. Can be a custom domain or the default one provided by WorkOS.

  **Example - Custom Domain:**

  ```yaml theme={null}
  envVars:
    WORKOS_AUTHKIT_DOMAIN: "company.authkit.com"
  ```

  **Example - Default Domain:**

  ```yaml theme={null}
  envVars:
    WORKOS_AUTHKIT_DOMAIN: "auth-12345.workos.com"
  ```
</ParamField>

<ParamField path="envVars.WORKOS_COOKIE_PASSWORD" type="string" default="">
  Cookie encryption password for WorkOS authentication.

  **When Required:** `AUTH_PROVIDER: workos`

  **Purpose:** Used to encrypt cookies stored in the browser during WorkOS authentication flows.

  **Format:** Random string, maximum 32 characters

  **Security:** Must be a cryptographically secure random string. Generate using:

  ```bash theme={null}
  openssl rand -base64 32 | cut -c -32
  ```

  **Example:**

  ```yaml theme={null}
  envVars:
    WORKOS_COOKIE_PASSWORD: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
  ```

  **Important:**

  * Keep this value secret and secure
  * Use a different value for each environment (dev, staging, production)
  * Changing this value will invalidate all existing user sessions
  * Never commit this value to version control
</ParamField>

#### Keycloak Configuration

<ParamField path="envVars.KEYCLOAK_CLIENT_ID" type="string" default="">
  Keycloak client ID for web application authentication.

  **When Required:** `AUTH_PROVIDER: keycloak`

  **Obtaining:** Found in Keycloak Admin Console under Clients > Your Client > Settings.

  **Example:**

  ```yaml theme={null}
  envVars:
    AUTH_PROVIDER: "keycloak"
    KEYCLOAK_CLIENT_ID: "crewai-factory"
    KEYCLOAK_SITE: "https://keycloak.company.com"
    KEYCLOAK_BASE_URL: "/auth"  # Optional: only if using custom base path
    KEYCLOAK_REALM: "crewai"
    KEYCLOAK_AUDIENCE: "account"
    KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID: "crewai-factory-cli"

  secrets:
    KEYCLOAK_CLIENT_SECRET: "your-client-secret"
  ```

  **Note:** This client ID is for web application authentication. CLI authentication requires a separate client configured in `KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID`.
</ParamField>

<ParamField path="envVars.KEYCLOAK_SITE" type="string" default="">
  Keycloak server URL.

  **Format:** `https://keycloak.yourdomain.com` or `http://localhost:8080` (development)

  **When Required:** `AUTH_PROVIDER: keycloak`

  **Purpose:** Base URL where the Keycloak admin console is accessible.

  **Example:**

  ```yaml theme={null}
  envVars:
    KEYCLOAK_SITE: "https://keycloak.company.com"
  ```
</ParamField>

<ParamField path="envVars.KEYCLOAK_BASE_URL" type="string" default="">
  Keycloak default context path.

  **Default:** `""` (empty string)

  **When Required:** `AUTH_PROVIDER: keycloak` (optional - only needed for specific Keycloak configurations)

  **Purpose:** Specifies the base context path for your Keycloak instance. This is used when Keycloak is configured with a custom base path, typically from older versions or custom deployments.

  **When to Set:**

  * Using Keycloak versions older than 17 (default was `/auth`)
  * Migrated from Keycloak 17+ but kept the old `/auth` path for backwards compatibility
  * Keycloak started with `--http-relative-path` parameter

  **When to Leave Empty:**

  * Using Keycloak 17+ without custom context path (most common)
  * Authorization URLs look like: `https://keycloak.yourdomain.com/realms/crewai`

  **Determining Your Base URL:**

  Check your Keycloak authorization URL structure:

  * If it looks like: `https://keycloak.yourdomain.com/auth/realms/crewai` → Set to `"/auth"`
  * If it looks like: `https://keycloak.yourdomain.com/realms/crewai` → Leave empty `""`

  **Example - Keycloak with /auth path:**

  ```yaml theme={null}
  envVars:
    KEYCLOAK_SITE: "https://keycloak.company.com"
    KEYCLOAK_BASE_URL: "/auth"
    KEYCLOAK_REALM: "crewai"
  ```

  **Example - Keycloak 17+ (no base path):**

  ```yaml theme={null}
  envVars:
    KEYCLOAK_SITE: "https://keycloak.company.com"
    KEYCLOAK_BASE_URL: ""  # or omit this field
    KEYCLOAK_REALM: "crewai"
  ```

  **Note:** This value corresponds to the `--http-relative-path` parameter used when starting Keycloak. If you didn't specify this parameter during Keycloak startup, leave this field empty.
</ParamField>

<ParamField path="envVars.KEYCLOAK_REALM" type="string" default="">
  Keycloak realm name.

  **When Required:** `AUTH_PROVIDER: keycloak`

  **Obtaining:** Found in Keycloak Admin Console - visible in the realm dropdown or URL path.

  **Common Values:**

  * `"master"` - Default Keycloak realm
  * `"crewai"` - Custom realm for CrewAI
  * `"company"` - Organization-specific realm

  **Example:**

  ```yaml theme={null}
  envVars:
    KEYCLOAK_REALM: "crewai"
  ```
</ParamField>

<ParamField path="envVars.KEYCLOAK_AUDIENCE" type="string" default="account">
  Keycloak audience value for token validation.

  **Default:** `"account"`

  **Purpose:** Validates the `aud` claim in access tokens issued by Keycloak.

  **Default Behavior:** Keycloak includes `"account"` as the default audience in access tokens, representing the built-in account management service. This default value works for most installations without additional Keycloak configuration.

  **When to Override:**

  * Your organization requires a custom audience value
  * You have configured custom audience mappers in Keycloak

  **Warning:**

  Changing this value requires corresponding Keycloak configuration using client scopes and audience mappers. Misconfigured audience values will cause authentication failures, particularly for CLI authentication.

  **Example with Custom Audience:**

  ```yaml theme={null}
  envVars:
    KEYCLOAK_AUDIENCE: "crewai-platform"
  ```

  **Important:** Only change this value if you have specifically configured a custom audience in your Keycloak client settings. The default `"account"` value works for standard Keycloak installations.

  **See Also:** [Keycloak SSO Configuration Guide - Configuring the Audience](/features/keycloak-sso#configuring-the-audience) for detailed information on custom audience configuration.
</ParamField>

<ParamField path="envVars.KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID" type="string" default="">
  Keycloak client ID for CLI device authorization flow.

  **When Required:** `AUTH_PROVIDER: keycloak` and CLI authentication needed

  **Purpose:** Enables CLI authentication using OAuth 2.0 Device Authorization Grant flow.

  **Important:** This must be a **separate client** from the web application client (`KEYCLOAK_CLIENT_ID`). The device authorization client must be configured as a public client with only the "OAuth 2.0 Device Authorization Grant" authentication flow enabled.

  **Client Configuration Requirements:**

  * **Client authentication:** Off (public client)
  * **Authentication flow:** Only "OAuth 2.0 Device Authorization Grant" enabled
  * **Standard flow:** Must be disabled

  **Example:**

  ```yaml theme={null}
  envVars:
    KEYCLOAK_CLIENT_ID: "crewai-factory"                    # Web app client
    KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID: "crewai-factory-cli"  # CLI client
  ```

  **Setup Guide:** See [Keycloak SSO Configuration Guide - CLI Authentication](/features/keycloak-sso#configure-the-cli-to-use-keycloak-as-your-oauth2-provider) for detailed client creation steps.

  **Leave Empty:** If CLI authentication is not required.
</ParamField>

### Crew Deployment Configuration

<Note>
  Crews deployed by any provider authenticate back to the platform with JWTs signed by `secrets.DEPLOYMENT_INSTANCE_JWT_SECRET` (auto-generated, see [Secrets Reference - Deployment Instance Secrets](/reference/chart-values/secrets#deployment-instance-secrets)). No manual configuration is required for the secret itself.
</Note>

<ParamField path="envVars.PROVIDER" type="string" default="BUILDKIT_KUBERNETES">
  Crew container build and deployment provider.

  **Valid Values:**

  * `"BUILDKIT_KUBERNETES"` - Use BuildKit service for builds (recommended)

  **When Using BUILDKIT\_KUBERNETES:**

  * Requires `buildkit.enabled: true`
  * Builds occur in-cluster
  * No external dependencies
</ParamField>

<ParamField path="envVars.BUILDKIT_IMAGE_OVERRIDE" type="string" default="auto-generated">
  BuildKit image reference for container builds.

  **Auto-Generated:** When `buildkit.enabled: true`, this value is automatically generated from the BuildKit image configuration:

  ```
  BUILDKIT_IMAGE_OVERRIDE = <buildkit.image.host>/<buildkit.image.name>:<buildkit.image.tag>
  ```

  **Purpose:** Ensures the application uses the same BuildKit image version as the deployed BuildKit service, maintaining version consistency.

  **Default Generated Value:**

  ```
  images.crewai.com/proxy/crewai/crewai/crewai/buildkit:v2026.0408.105
  ```

  **Override Behavior:**

  * When `buildkit.enabled: true`, the auto-generated value takes precedence
  * Custom values in `envVars.BUILDKIT_IMAGE_OVERRIDE` are ignored to prevent version mismatches
  * To change the BuildKit image, configure `buildkit.image.*` values instead

  **Example:**

  ```yaml theme={null}
  buildkit:
    enabled: true
    image:
      host: "registry.company.com"
      name: "buildkit/buildkit"
      tag: "v2026.0408.105"
  ```

  Automatically generates: `"registry.company.com/buildkit/buildkit:v2026.0408.105"`

  **Leave Empty:** To use auto-generated value (recommended when BuildKit is enabled).
</ParamField>

### Container Registry Configuration

<ParamField path="envVars.CONTAINER_REGISTRY_HOSTNAME" type="string" default="auto-generated">
  Container registry hostname for pulling Docker Hub images.

  **Auto-Generated:** By default, this value is automatically generated using one of these formats:

  Without `global.imageNamePrefixOverride`:

  ```
  <global.imageRegistry>/proxy/dockerhub
  ```

  With `global.imageNamePrefixOverride`:

  ```
  <global.imageRegistry>/<imageNamePrefixOverride>
  ```

  **Default Generated Value:** `"images.crewai.com/proxy/dockerhub"` (when `global.imageRegistry: "images.crewai.com"` and no override)

  **Purpose:** Configures where the application pulls base images from Docker Hub. This is particularly important for air-gapped environments or when using a private registry mirror.

  **Fallback Behavior:**

  When `CONTAINER_REGISTRY_HOSTNAME` is empty or not set:

  1. If `global.imageNamePrefixOverride` is set, uses `<imageRegistry>/<imageNamePrefixOverride>`
  2. Otherwise, uses `<imageRegistry>/proxy/dockerhub`

  This ensures Docker Hub images are pulled through the same registry as other platform components with consistent path structure.

  **Example with imageNamePrefixOverride:**

  ```yaml theme={null}
  global:
    imageRegistry: "123456789012.dkr.ecr.us-west-2.amazonaws.com"
    imageNamePrefixOverride: "crewai/"
  ```

  Auto-generates: `"123456789012.dkr.ecr.us-west-2.amazonaws.com/crewai/"`

  **When to Override:**

  * Air-gapped deployments with internal registry
  * Using a pull-through cache registry
  * Corporate registry requirements
  * Private Docker Hub mirror with different path structure
  * Custom path structure not covered by `imageNamePrefixOverride`

  **Examples:**

  * Auto-generated (default): Leave empty to use `"images.crewai.com/proxy/dockerhub"`
  * Auto-generated (with override): Leave empty to use `"<imageRegistry>/<imageNamePrefixOverride>"`
  * Internal registry: `"registry.company.com/dockerhub-mirror"`
  * Harbor registry: `"harbor.company.com/proxy-cache/dockerhub"`
  * Direct Docker Hub (not recommended): `"docker.io"`

  **Automatic Generation:** This value is automatically generated by the chart's template logic when not explicitly set.

  **Note:** This affects base images used during crew container builds.

  **Leave Empty:** To use auto-generated value (recommended for most deployments).
</ParamField>

<ParamField path="envVars.CREW_IMAGE_REGISTRY_OVERRIDE" type="string" default="">
  Registry where built crew container images are stored.

  **Required:** Yes - Chart installation will fail if this value is not set.

  **Validation:** The Helm chart includes validation that enforces this requirement. If `envVars.CREW_IMAGE_REGISTRY_OVERRIDE` is empty or not provided, the deployment will fail with an error message during installation.

  **Purpose:** Specifies the registry where CrewAI Platform pushes built crew images. The suffix `/crewai-enterprise` is automatically appended.

  **Behavior:**

  * Images are pushed to: `<CREW_IMAGE_REGISTRY_OVERRIDE>/crewai-enterprise/<image-name>:<tag>`
  * Registry must be accessible from both build pods and runtime pods
  * Requires appropriate push/pull credentials
  * Validation occurs at deployment time (before resources are created)

  **Examples:**

  * AWS ECR: `"123456789012.dkr.ecr.us-west-2.amazonaws.com"`
  * Azure ACR: `"mycompany.azurecr.io"`
  * Google Artifact Registry (GAR): `"us-west1-docker.pkg.dev/my-project/my-repo"`
  * JFrog Artifactory: `"acme.jfrog.io"`
  * Internal registry: `"registry.company.local:5000"`

  **Important:** The registry must exist and the platform must have push permissions. CrewAI Platform automatically appends `/crewai-enterprise`, so ensure the resulting repository path exists and accepts pushes.

  **Error Message:** If not set, you will see: `"envVars.CREW_IMAGE_REGISTRY_OVERRIDE is required. See: https://enterprise-docs.crewai.com/reference/chart-values/environment-variables#param-env-vars-crew-image-registry-override"`
</ParamField>

<ParamField path="envVars.AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE" type="string" default="auto-generated">
  Registry hostname for automation base images.

  **Default Generated Value:** `"images.crewai.com"` (when `global.imageRegistry: "images.crewai.com"`)

  **Purpose:** Specifies the registry where automation base images are stored. This is used in combination with `AUTOMATION_ECR_REPOSITORY_PREFIX` and `AUTOMATION_BASE_IMAGE_NAME` to construct the full image path for crew container builds.
</ParamField>

<ParamField path="envVars.AUTOMATION_ECR_REPOSITORY_PREFIX" type="string" default="auto-generated">
  Repository prefix for automation base images in the registry.

  **Auto-Generated:** By default, this value is automatically generated using one of these values:

  With `global.imageNamePrefixOverride`:

  ```
  <imageNamePrefixOverride>
  ```

  Without `global.imageNamePrefixOverride`:

  ```
  proxy/crewai/crewai/
  ```

  **Default Generated Value:** `"proxy/crewai/crewai/"` (when no override is set)

  **Purpose:** Adds an organizational prefix to automation base image paths within the registry. This prefix is prepended to the automation base image name when constructing the full image path.

  **Fallback Behavior:**

  When `AUTOMATION_ECR_REPOSITORY_PREFIX` is empty or not set:

  1. If `global.imageNamePrefixOverride` is set, uses that value
  2. Otherwise, uses `"proxy/crewai/crewai/"`

  This ensures automation base images use the same path structure as other platform components when mirroring to a private registry.

  **Full Image Path Construction:**

  ```
  <AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE>/<AUTOMATION_ECR_REPOSITORY_PREFIX><AUTOMATION_BASE_IMAGE_NAME>
  ```

  **Example - Default Configuration:**

  ```yaml theme={null}
  envVars:
    AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE: "images.crewai.com"
    AUTOMATION_ECR_REPOSITORY_PREFIX: "" # Auto-generates to "proxy/crewai/crewai/"
    AUTOMATION_BASE_IMAGE_NAME: "crewai-enterprise-preinstalled-v2:latest"
  ```

  Results in: `images.crewai.com/proxy/crewai/crewai/crewai-enterprise-preinstalled-v2:latest`

  **Example - With imageNamePrefixOverride:**

  ```yaml theme={null}
  global:
    imageRegistry: "123456789012.dkr.ecr.us-west-2.amazonaws.com"
    imageNamePrefixOverride: "crewai/"

  envVars:
    AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE: "" # Auto-generates to imageRegistry
    AUTOMATION_ECR_REPOSITORY_PREFIX: "" # Auto-generates to "crewai/"
    AUTOMATION_BASE_IMAGE_NAME: "crewai-enterprise-preinstalled-v2:latest"
  ```

  Results in: `123456789012.dkr.ecr.us-west-2.amazonaws.com/crewai/crewai-enterprise-preinstalled-v2:latest`

  **When to Override:**

  * Custom path structure not covered by `imageNamePrefixOverride`
  * Different prefix for automation images vs. platform images
  * Migration from one naming scheme to another

  **Automatic Generation:** This value is automatically generated by the chart's template logic when not explicitly set.

  **Use Cases:**

  * Aligning with Replicated proxy path structure for consistency
  * Multi-tenant registry organization
  * Namespace separation in shared registries
  * Compliance with corporate naming conventions
  * Maintaining path structure consistency with proxy registries
  * Simplified paths when using `imageNamePrefixOverride`

  **Leave Empty:** To use auto-generated value (recommended for most deployments).
</ParamField>

<ParamField path="envVars.AUTOMATION_BASE_IMAGE_NAME" type="string" default="crewai-enterprise-preinstalled-v2:latest">
  Base image name used for building crew containers.

  **Purpose:** Specifies the foundational image containing CrewAI dependencies and runtime.

  **Default:** `"crewai-enterprise-preinstalled-v2:latest"`

  **Format:** `<image-name>:<tag>`

  **When to Change:**

  * Using custom base image with additional dependencies
  * Pinning to specific version for consistency
  * Testing new base image versions

  **Example - Version Pinning:**

  ```yaml theme={null}
  envVars:
    AUTOMATION_BASE_IMAGE_NAME: "crewai-enterprise-preinstalled-v2:0.9.9"
  ```

  **Note:** The base image must be accessible from the configured registry and contain all required CrewAI runtime dependencies.
</ParamField>

### Storage Configuration

<ParamField path="envVars.STORAGE_SERVICE" type="string" default="">
  File storage backend service.

  **Required:** Yes (unless using MinIO)

  **Valid Values:**

  * `"amazon"` - Amazon S3 or S3-compatible storage
  * `"microsoft"` - Azure Blob Storage
  * `"google"` - Google Cloud Storage (GCS)

  **When Using amazon:**

  * Requires `envVars.AWS_REGION`
  * Requires `envVars.AWS_BUCKET`
  * Requires `secrets.AWS_ACCESS_KEY_ID` and `secrets.AWS_SECRET_ACCESS_KEY` (or IRSA)
  * Optional `envVars.AWS_ENDPOINT` for S3-compatible services

  **When Using microsoft:**

  * Requires `envVars.AZURE_STORAGE_ACCOUNT_NAME`
  * Requires `secrets.AZURE_STORAGE_ACCESS_KEY` (or Workload Identity)

  **When Using google:**

  * Requires `envVars.GCS_PROJECT_ID`
  * Requires `envVars.GCS_BUCKET`
  * Requires `envVars.GCS_IAM_SIGNING: "true"` (when using Workload Identity)
  * Optional `envVars.GCS_SIGNING_EMAIL` (auto-detected if using Workload Identity)
  * No static credentials needed with Workload Identity
</ParamField>

<ParamField path="envVars.AWS_ENDPOINT" type="string" default="">
  S3-compatible storage endpoint URL.

  **When to Set:**

  * Using MinIO: `"http://crewai-minio:9000"`
  * Using Wasabi: `"https://s3.wasabisys.com"`
  * Using DigitalOcean Spaces: `"https://nyc3.digitaloceanspaces.com"`

  **When to Leave Empty:**

  * Using AWS S3 (uses regional endpoint automatically)
</ParamField>

<ParamField path="envVars.AWS_REGION" type="string" default="">
  AWS region for S3 bucket.

  **Examples:** `"us-west-2"`, `"eu-central-1"`, `"ap-southeast-1"`

  **Required For:** `STORAGE_SERVICE: amazon`
</ParamField>

<ParamField path="envVars.AWS_BUCKET" type="string" default="">
  S3 bucket name for file storage.

  **Examples:** `"crewai-prod-storage"`, `"company-crewai-files"`

  **Required For:** `STORAGE_SERVICE: amazon`
</ParamField>

<ParamField path="envVars.AZURE_STORAGE_ACCOUNT_NAME" type="string" default="">
  Azure Storage account name.

  **Required For:** `STORAGE_SERVICE: microsoft`
</ParamField>

<ParamField path="envVars.AZURE_CONTAINER_NAME" type="string" default="">
  Azure Blob Storage container name for file storage.

  **Required For:** `STORAGE_SERVICE: microsoft`

  **Example:** `"crewai-storage"`
</ParamField>

<ParamField path="envVars.GCS_PROJECT_ID" type="string" default="">
  Google Cloud project ID for GCS access.

  **Required For:** `STORAGE_SERVICE: google`

  **Example:** `"my-gcp-project"`

  **How to Find:**

  ```bash theme={null}
  gcloud config get-value project
  ```
</ParamField>

<ParamField path="envVars.GCS_BUCKET" type="string" default="">
  GCS bucket name for file storage.

  **Required For:** `STORAGE_SERVICE: google`

  **Examples:** `"crewai-prod-storage"`, `"company-crewai-files"`

  **Example:**

  ```yaml theme={null}
  envVars:
    STORAGE_SERVICE: google
    GCS_PROJECT_ID: my-project
    GCS_BUCKET: crewai-storage
    GCS_IAM_SIGNING: "true"
  ```
</ParamField>

<ParamField path="envVars.GCS_IAM_SIGNING" type="string" default="">
  Enable IAM-based signed URL generation for GCS.

  **Required:** `"true"` (when using Workload Identity)

  **Purpose:** When using GKE Workload Identity, the application doesn't have a private key for local URL signing. Setting this to `"true"` instructs the platform to use the IAM `signBlob` API instead.

  **Values:**

  * `"true"` - Use IAM signBlob API for signed URLs (required for Workload Identity)
  * `""` (empty) - Use local signing with service account key (requires JSON keyfile)

  **Prerequisites:**

  * Service account must have `roles/iam.serviceAccountTokenCreator` role
  * Workload Identity binding configured via `serviceAccount.annotations`

  **Example:**

  ```yaml theme={null}
  serviceAccount:
    annotations:
      iam.gke.io/gcp-service-account: crewai-platform@my-project.iam.gserviceaccount.com

  envVars:
    STORAGE_SERVICE: google
    GCS_PROJECT_ID: my-project
    GCS_BUCKET: crewai-storage
    GCS_IAM_SIGNING: "true"
  ```

  **See Also:** [GCP Integration Guide - GCS Configuration](/cloud-providers/gcp#google-cloud-storage-for-object-storage) for complete GCS setup with Workload Identity.
</ParamField>

<ParamField path="envVars.GCS_SIGNING_EMAIL" type="string" default="">
  Service account email for GCS signed URL generation.

  **Default Behavior:** When empty, automatically detected from GKE metadata server (when using Workload Identity).

  **When to Set:** Only needed if you want to explicitly specify the service account email, or if auto-detection fails.

  **Format:** `"service-account-name@project-id.iam.gserviceaccount.com"`

  **Example:**

  ```yaml theme={null}
  envVars:
    STORAGE_SERVICE: google
    GCS_PROJECT_ID: my-project
    GCS_BUCKET: crewai-storage
    GCS_IAM_SIGNING: "true"
    GCS_SIGNING_EMAIL: crewai-platform@my-project.iam.gserviceaccount.com
  ```

  **Production Recommendation:** Leave empty to use auto-detection (preferred for Workload Identity deployments).
</ParamField>

### Built-in LLM Configuration

<ParamField path="envVars.BUILT_IN_LLM_PROVIDER" type="string" default="openai">
  LLM provider for built-in platform AI features.

  <Note>
    These variables configure platform-level AI features (prompt improvement, automation description generation, flow chat) and are unrelated to Studio V2. Studio V2 uses a separately configured LLM connection created post-install in the web UI. Setting `BUILT_IN_LLM_PROVIDER` does not activate or configure Studio V2.
  </Note>

  **Purpose:** Specifies which LLM provider to use for internal platform features such as:

  * Improving Studio prompts
  * Generating automation descriptions
  * Chatting with flows
  * Other AI-assisted platform capabilities

  **Valid Values:**

  * `"openai"` - OpenAI provider (GPT models)
  * `"anthropic"` - Anthropic provider (Claude models)

  **Requirements:**

  * Requires `secrets.BUILT_IN_LLM_API_KEY` to be set with a valid API key for the chosen provider
  * Requires `envVars.BUILT_IN_LLM_MODEL` to be set with a supported model for the provider

  **Example:**

  ```yaml theme={null}
  envVars:
    BUILT_IN_LLM_PROVIDER: "openai"
    BUILT_IN_LLM_MODEL: "gpt-4o-mini"

  secrets:
    BUILT_IN_LLM_API_KEY: "sk-proj-abc123..."
  ```
</ParamField>

<ParamField path="envVars.BUILT_IN_LLM_MODEL" type="string" default="gpt-4.1-mini">
  Model name for built-in LLM provider.

  **Purpose:** Specifies which model to use for internal platform AI features.

  **OpenAI Models (BUILT\_IN\_LLM\_PROVIDER: "openai"):**

  * `"gpt-4o-mini"` - Recommended for most use cases (cost-effective, fast)
  * `"gpt-4o"` - More capable, higher cost
  * `"gpt-4-turbo"` - Previous generation flagship
  * `"gpt-3.5-turbo"` - Older, budget option

  **Anthropic Models (BUILT\_IN\_LLM\_PROVIDER: "anthropic"):**

  * `"claude-3-5-sonnet-20241022"` - Latest Sonnet model (recommended)
  * `"claude-3-5-haiku-20241022"` - Fast and cost-effective
  * `"claude-3-opus-20240229"` - Most capable (higher cost)

  **Considerations:**

  * Balance cost vs. capability based on your usage patterns
  * Internal platform features typically work well with smaller, faster models
  * Larger models may provide better results for complex prompt improvements

  **Example:**

  ```yaml theme={null}
  envVars:
    BUILT_IN_LLM_PROVIDER: "anthropic"
    BUILT_IN_LLM_MODEL: "claude-3-5-sonnet-20241022"

  secrets:
    BUILT_IN_LLM_API_KEY: "sk-ant-abc123..."
  ```
</ParamField>

### Database Configuration

<ParamField path="envVars.DB_HOST" type="string" default="">
  PostgreSQL database hostname or IP address.

  **Auto-Override:** When `postgres.enabled: true`, this value is automatically overridden to the internal PostgreSQL service name (`<fullname>-postgres`).

  **Required For:** External database (`postgres.enabled: false`)

  **Examples:**

  * AWS RDS: `"crewai-prod.cluster-abc.us-west-2.rds.amazonaws.com"`
  * Azure Database: `"crewai-prod.postgres.database.azure.com"`
  * Google Cloud SQL: `"10.1.2.3"` (via Cloud SQL proxy)
</ParamField>

<ParamField path="envVars.DB_PORT" type="string" default="5432">
  PostgreSQL database port.

  **Standard:** `"5432"` (PostgreSQL default)
</ParamField>

<ParamField path="envVars.DB_USER" type="string" default="postgres">
  PostgreSQL username.

  **Recommendation:** Use a dedicated database user (not `postgres` superuser) for production.

  **Override via Secrets:** Can be overridden by setting `secrets.DB_USER` if the username should be treated as sensitive. See [Secrets Configuration - Database Secrets](/reference/chart-values/secrets#database-secrets).
</ParamField>

<ParamField path="envVars.POSTGRES_DB" type="string" default="crewai_plus_production">
  PostgreSQL main database name.

  **Purpose:** Primary database for application data, schema migrations, and business logic.

  **Must Match:** Database created during PostgreSQL initialization.
</ParamField>

<ParamField path="envVars.POSTGRES_CABLE_DB" type="string" default="crewai_plus_cable_production">
  PostgreSQL database name for ActionCable (WebSocket connections).

  **Purpose:** Separate database for real-time WebSocket communication and pub/sub messaging.

  **Must Match:** Cable database created during PostgreSQL initialization.

  **Note:** ActionCable uses a separate database to isolate real-time communication from main application data.
</ParamField>

<ParamField path="envVars.POSTGRES_OAUTH_DB" type="string" default="oauth_db">
  PostgreSQL database name for the Built-in Integrations service.

  **Purpose:** Separate database for storing encrypted OAuth tokens for third-party integrations (Gmail, Google Calendar, Microsoft Outlook, etc.).

  **Default:** `"oauth_db"` - Only used when `postgres.enabled: false` and `oauth.enabled: true`.

  **Behavior:**

  * When `postgres.enabled: true`: Uses `postgres.oauthDatabase` value (database is auto-created)
  * When `postgres.enabled: false`: Uses this value for connecting to the external database

  **External Database Setup:**

  When using an external database, you must manually create the database before deploying:

  ```sql theme={null}
  CREATE DATABASE oauth_db;
  ```

  **Example with External Database:**

  ```yaml theme={null}
  postgres:
    enabled: false

  envVars:
    DB_HOST: "crewai-prod.cluster-xyz.rds.amazonaws.com"
    DB_PORT: "5432"
    DB_USER: "crewai"
    POSTGRES_DB: "crewai_plus_production"
    POSTGRES_CABLE_DB: "crewai_plus_cable_production"
    POSTGRES_OAUTH_DB: "oauth_db"

  secrets:
    DB_PASSWORD: "your-password"

  oauth:
    enabled: true
  ```

  **Note:** The Built-in Integrations service uses its own database separate from the main CrewAI application database for security isolation. All database connections use the same `DB_HOST`, `DB_PORT`, `DB_USER`, and `DB_PASSWORD` configuration.
</ParamField>

<ParamField path="envVars.SKIP_DB_MIGRATIONS" type="string" default="true">
  Skip database migrations during application startup.

  **Default:** `"true"`

  **Purpose:** Database migrations are handled by a dedicated pre-upgrade Helm hook job (helm/templates/jobs/pre-upgrade-migration.yaml:1) that runs before each upgrade, ensuring migrations complete successfully before the application starts.

  **Migration Strategy:**

  * Pre-upgrade hook runs `bin/rails db:migrate` before deployment
  * Pre-upgrade hook runs `bin/rails db:migrate:cable` for Action Cable database
  * Hook waits for PostgreSQL availability (when using internal PostgreSQL)
  * Hook has 3 retry attempts on failure
  * Application pods skip migrations to prevent race conditions

  **When to Change to "false":**

  * Custom deployment workflows that don't use Helm upgrades
  * Manual migration management outside of Helm
  * Debugging migration issues

  **Warning:** Setting to `"false"` can cause race conditions if multiple pods attempt migrations simultaneously. The pre-upgrade hook pattern ensures single-execution migration runs.

  **Example - Disable Migration Hook:**

  ```yaml theme={null}
  envVars:
    SKIP_DB_MIGRATIONS: "false"
  ```

  **Related Configuration:** `migrationJob.nodeSelector` (docs/reference/chart-values/reference.mdx:258) - Configure node placement for migration jobs.
</ParamField>

### Whitelabeling Configuration

<ParamField path="envVars.PLATFORM_SHORT_NAME" type="string" default="">
  Short name for platform branding customization.

  **Purpose:** Customize the platform's short name displayed throughout the user interface for whitelabeling purposes.

  **Default:** `""` (empty) - Uses default "CrewAI" branding

  **When to Set:**

  * Whitelabeling the platform with your company or product name
  * Creating a branded experience for end users
  * Partner or reseller deployments

  **Examples:**

  * `"Acme"` - Short company name
  * `"MyPlatform"` - Product short name
  * `""` - Use default branding

  **Note:** This appears in locations where space is limited (navigation bars, headers, etc.).

  **Leave Empty:** To use default CrewAI branding.
</ParamField>

<ParamField path="envVars.PLATFORM_NAME" type="string" default="">
  Full display name for platform branding customization.

  **Purpose:** Customize the platform's full display name shown throughout the user interface for whitelabeling purposes.

  **Default:** `""` (empty) - Uses default "CrewAI Platform" branding

  **When to Set:**

  * Whitelabeling the platform with your company or product name
  * Creating a branded experience for end users
  * Partner or reseller deployments

  **Examples:**

  * `"Acme AI Platform"` - Full branded name
  * `"MyCompany Automation Platform"` - Custom product name
  * `""` - Use default branding

  **Note:** This appears in page titles, documentation references, and other locations where the full platform name is displayed.

  **Best Practice:** Use in combination with `PLATFORM_SHORT_NAME` for consistent branding across the interface.

  **Leave Empty:** To use default CrewAI Platform branding.
</ParamField>

### Concurrency Settings

<ParamField path="envVars.RAILS_MAX_THREADS" type="integer">
  Maximum threads per Rails process.

  **Default:** Commented out (uses Rails default of `5`)

  **Tuning:**

  * Lower (2-3): Reduce memory usage, lower concurrency
  * Higher (10-15): Increase concurrency, higher memory usage

  **Note:** Must balance with database connection pool size.
</ParamField>

<ParamField path="envVars.WEB_CONCURRENCY" type="integer">
  Number of Puma worker processes.

  **Default:** Commented out (auto-calculated based on available CPU cores)

  **Tuning:**

  * Single-core containers: `1`
  * Multi-core containers: `2-4`

  **Memory Impact:** Each worker process consumes full memory footprint. Total memory = `WEB_CONCURRENCY x per-worker memory`.
</ParamField>

<ParamField path="envVars.WORKER_TIMEOUT" type="integer">
  Background job timeout in seconds.

  **Default:** Commented out (`60` seconds)

  **Adjust For:**

  * Long-running jobs: Increase timeout
  * Quick jobs: Keep default or lower
</ParamField>

<ParamField path="envVars.WORKER_BOOT_TIMEOUT" type="integer">
  Worker process boot timeout in seconds.

  **Default:** Commented out (`120` seconds)

  **Increase If:** Workers fail to start within default timeout.
</ParamField>

### GitHub Configuration

<ParamField path="envVars.GITHUB_USER" type="string" default="joaomdmoura">
  GitHub username or organization for repository access.

  **Auto-Populated:** From Replicated license field

  **Purpose:** Required to pull crewai enterprise repositories.
</ParamField>

<ParamField path="envVars.GITHUB_CLIENT_ID" type="string" default="">
  GitHub App client ID for OAuth-based user authorization.

  **Required For:** GitHub App integration and user authorization during installation.

  **Obtaining:** GitHub App Settings > Client ID (displayed on the app settings page).

  **Related Configuration:**

  * Configure `secrets.GITHUB_CLIENT_SECRET` with the corresponding client secret
  * Configure `envVars.GITHUB_APP_ID` with your GitHub App ID
  * Configure `envVars.GITHUB_APP_URL` with your GitHub App installation URL
  * Configure `secrets.GITHUB_APP_PRIVATE_KEY` with your GitHub App private key

  **Setup Guide:** See [GitHub App Setup Guide](/features/github-app) for complete setup instructions.
</ParamField>

<ParamField path="envVars.GITHUB_APP_URL" type="string" default="">
  GitHub App installation URL for adding the app to user accounts or organizations.

  **Format:** `https://github.com/apps/<your-app-name>/installations/new`

  **Purpose:** Used to redirect users to install the GitHub App on their account or organization.

  **Obtaining:** Replace `<your-app-name>` with your GitHub App's name (URL slug).

  **Example:** `"https://github.com/apps/crewai-factory/installations/new"`

  **Setup Guide:** See [GitHub App Setup Guide](/features/github-app) for detailed instructions.
</ParamField>

<ParamField path="envVars.GITHUB_APP_ID" type="string" default="">
  GitHub App ID for server-to-server API authentication.

  **Format:** String containing numeric ID (e.g., `"853084"`)

  **Important:** GitHub App IDs are numeric values. Always quote them in YAML to prevent Helm from parsing them as numbers instead of strings. Unquoted numeric values can cause deployment failures.

  **Correct:**

  ```yaml theme={null}
  envVars:
    GITHUB_APP_ID: "853084"  # Quoted string
  ```

  **Incorrect:**

  ```yaml theme={null}
  envVars:
    GITHUB_APP_ID: 853084    # Unquoted number - will cause issues
  ```

  **Obtaining:** GitHub App Settings > About section > App ID (displayed at the top of the page).

  **Purpose:** Used with the private key for GitHub API authentication.

  **Required For:** GitHub App API operations and repository access.

  **Setup Guide:** See [GitHub App Setup Guide](/features/github-app) for detailed instructions.
</ParamField>