Environment variables

This reference lists the environment variables that configure Flowker. The Default column shows the value Flowker applies when you do not set a variable. A dash means that Flowker applies no value of its own. The Required column marks the variables without which the server does not start. A variable marked Sensitive carries a credential. Flowker has two binaries. The API binary serves the HTTP API. The worker binary runs the scheduler that fires schedule-triggered workflows. A variable that applies to one binary says so.

Server

Variable	Description	Default	Required
`ENV_NAME`	Deployment environment: `production`, `staging`, `uat`, `development`, or `local`. Any other value stops the server from starting. With `production`, `PLUGIN_AUTH_ENABLED`, `XSD_SCHEMAS_AUTH_ENABLED`, and `OPENAPI_SCHEMAS_AUTH_ENABLED` must be `true`, or the server does not start.	—	Yes
`SERVER_ADDRESS`	Listen address of the API binary, for example `:4021`.	—	No
`WORKER_SERVER_ADDRESS`	Listen address of the worker binary.	`:4022`	No
`CORS_ALLOWED_ORIGINS`	Comma-separated origins allowed for cross-origin requests.	—	No
`TRUSTED_PROXIES`	Comma-separated CIDR ranges of your load balancers or ingress. Flowker reads the client IP from `X-Forwarded-For` only when the request comes through one of these ranges. Access Manager checks its IP allowlist against that client IP. An entry that is not a CIDR range stops the server from starting.	—	No
`PPROF_ENABLED`	Serve Go profiling data at `/debug/pprof/` on `127.0.0.1:6060`, in the worker binary only.	`false`	No

Deployment

Variable	Description	Default	Required
`DEPLOYMENT_MODE`	Deployment mode. With `saas`, `MONGO_URI` must use `mongodb+srv://` or carry `tls=true` or `ssl=true`, or the server does not start. When it is unset, `/readyz` reports `local`.	—	No

Authentication

Variable	Description	Default	Required
`PLUGIN_AUTH_ENABLED`	Require Access Manager authentication on the workflow, webhook, and management routes. When `false`, these routes do not require a token.	`false`	No
`PLUGIN_AUTH_ADDRESS`	Address of Access Manager. Flowker also gets the token endpoint of the native providers from it, with `/v1/login/oauth/access_token` added at the end.	—	When `PLUGIN_AUTH_ENABLED=true`
`XSD_SCHEMAS_AUTH_ENABLED`	When `true`, the `/v1/xsd-schemas` routes follow `PLUGIN_AUTH_ENABLED`. When `false`, they do not require a token. An unset or unrecognized value counts as `true`.	`true`	No
`OPENAPI_SCHEMAS_AUTH_ENABLED`	When `true`, the `/v1/openapi-schemas` routes follow `PLUGIN_AUTH_ENABLED`. When `false`, they do not require a token. An unset or unrecognized value counts as `true`.	`true`	No

MongoDB

Variable	Description	Default	Required
`MONGO_URI`	MongoDB connection URI. Sensitive.	—	Yes
`MONGO_DB_NAME`	MongoDB database name.	—	Yes
`MONGO_MAX_POOL_SIZE`	Maximum size of the MongoDB connection pool. An unset value, or a value of zero or less, keeps the MongoDB driver default.	—	No
`MONGO_TLS_CA_CERT`	Base64-encoded PEM CA certificate for the MongoDB TLS connection.	—	No

Scheduler and Redis

The worker binary runs the scheduler. Both binaries connect to Redis through the REDIS_* variables. The worker uses Redis for the scheduler queue, and the API binary uses it to queue the run of a parked occurrence.

Variable	Description	Default	Required
`SCHEDULER_ENABLED`	Turn the scheduler on or off. An unset or unrecognized value counts as `true`. The worker binary does not start when the value is `false`.	`true`	No
`REDIS_HOST`	Redis host. When the scheduler is on and the host is empty, the worker binary does not start. The API binary then answers the schedule routes with `FLK-0763`.	—	When `SCHEDULER_ENABLED=true`
`REDIS_PORT`	Redis port.	`6379`	No
`REDIS_PASSWORD`	Redis password. Sensitive.	—	Worker binary, when `SCHEDULER_ENABLED=true` and `DEPLOYMENT_MODE=saas`
`REDIS_TLS`	Use TLS on the Redis connection.	`false`	No
`REDIS_DB`	Logical Redis database index.	`0`	No
`SCHEDULER_CONCURRENCY`	Maximum number of scheduled runs that the worker processes at the same time. A value of zero or less counts as `10`.	`10`	No

Native provider URLs

Flowker reads the base URL of each native provider from these variables instead of from the stored provider configuration. When a variable is empty, Flowker uses the value in the stored configuration.

Variable	Description	Default	Required
`MIDAZ_BASE_URL`	Base URL of the `ledger` provider. It is the transaction base URL and the onboarding base URL.	—	No
`TRACER_BASE_URL`	Base URL of the `tracer` provider.	—	No
`CRM_BASE_URL`	Base URL of the `crm` provider.	—	No
`FEES_BASE_URL`	Base URL of the `fees` provider.	—	No
`IDENTITY_BASE_URL`	Base URL of the `identity` provider.	—	No
`AUTH_BASE_URL`	Base URL of the `auth` provider.	—	No
`OPENAPI_NATIVE_PROVIDERS`	Comma-separated IDs of the native providers that Flowker builds from their published OpenAPI specification. Empty makes every native provider available. Flowker ignores an unknown ID.	—	No

Schema registry and XSD validation

Variable	Description	Default	Required
`SCHEMA_REGISTRY_S3_BUCKET`	S3 bucket that stores the content of the XSD and OpenAPI schemas. Flowker starts without it, but the operations that read or write schema content fail.	—	No
`SCHEMA_REGISTRY_S3_REGION`	AWS region of the bucket. When it is empty, the region comes from the standard AWS configuration.	—	No
`SCHEMA_REGISTRY_CACHE_TTL_SEC`	Lifetime of the cache of parsed provider specifications, in seconds.	`300`	No
`XSD_VALIDATOR_URL`	Base URL of the XSD validator. Empty turns off XML schema validation. The URL must use `https`, or `http` with `XSD_VALIDATOR_ALLOW_INSECURE_HTTP=true`. Any other URL stops the server from starting.	—	No
`XSD_VALIDATOR_ALLOW_INSECURE_HTTP`	Accept an `http://` value in `XSD_VALIDATOR_URL`. Only the value `true`, in any case, turns it on.	`false`	No

Streaming Hub ingress

Variable	Description	Default	Required
`HUB_WEBHOOK_ENABLED`	Serve the signed Streaming Hub route under `/v1/hub/webhooks/`. When `true`, the server does not start without the credential store that holds each signing secret.	`false`	No
`HUB_WEBHOOK_TOLERANCE_SEC`	Freshness window of a delivery signature, in seconds. A value of zero or less counts as the default.	`300`	No

Provider token cache

Variable	Description	Default	Required
`TOKEN_CACHE_MAX_TTL_SEC`	Longest time that Flowker trusts a cached provider token, in seconds, whatever `expires_in` the provider returns.	`3600`	No
`TOKEN_CACHE_JANITOR_INTERVAL_SEC`	Interval at which Flowker deletes expired tokens from the cache, in seconds.	`300`	No
`TOKEN_CACHE_REFRESH_BUFFER_SEC`	Time before expiry at which Flowker gets a new token, in seconds. When it is unset, the refresh window of each provider applies.	—	No

Observability

Variable	Description	Default	Required
`ENABLE_TELEMETRY`	Turn on OpenTelemetry export.	`false`	No
`OTEL_EXPORTER_OTLP_ENDPOINT`	OTLP exporter endpoint.	—	When `ENABLE_TELEMETRY=true`
`OTEL_RESOURCE_SERVICE_NAME`	Service name in telemetry and in the `service` field of `/version`.	`flowker`	No
`OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT`	Deployment environment label in telemetry.	—	No
`OTEL_LIBRARY_NAME`	Instrumentation library name. The logger requires it, also when `ENABLE_TELEMETRY` is `false`.	—	Yes
`LOG_LEVEL`	Log level: `debug`, `info`, `warn`, `error`, `dpanic`, `panic`, or `fatal`. When it is unset, `development` and `local` log at `debug`, and every other environment logs at `info`. An unrecognized level stops the server from starting.	—	No
`SKIP_LIB_COMMONS_TELEMETRY`	Remove the telemetry middleware from the HTTP routes.	`false`	No

Limits and test settings

Variable	Description	Default	Required
`HTTP_MAX_BODY_BYTES`	Largest request body that Flowker sends to a provider, and largest response body that it reads from a provider, in bytes. A value of zero or less counts as the default.	`10485760` (10 MiB)	No
`SSRF_ALLOW_PRIVATE`	Let provider HTTP calls reach private IP addresses. Only the exact value `true` turns it on.	`false`	No
`FAULT_INJECTION_ENABLED`	Answer a request that carries the `X-Test-Fault-Injection` header with a simulated failure.	`false`	No

OpenAPI documentation

Variable	Description	Default	Required
`SWAGGER_ENABLED`	Serve the OpenAPI specification and the docs UI at `/openapi/openapi.json`, `/openapi/openapi.yaml`, and `/openapi/docs`.	`false`	No
`SWAGGER_TITLE`	Title of the docs UI page.	—	No

Overview

Guides

Console

Operations

Environment variables

Server

Deployment

Authentication

MongoDB

Scheduler and Redis

Native provider URLs

Schema registry and XSD validation

Streaming Hub ingress

Provider token cache

Observability

Limits and test settings

OpenAPI documentation

​Server

​Deployment

​Authentication

​MongoDB

​Scheduler and Redis

​Native provider URLs

​Schema registry and XSD validation

​Streaming Hub ingress

​Provider token cache

​Observability

​Limits and test settings

​OpenAPI documentation

Server

Deployment

Authentication

MongoDB

Scheduler and Redis

Native provider URLs

Schema registry and XSD validation

Streaming Hub ingress

Provider token cache

Observability

Limits and test settings

OpenAPI documentation