Prisme.ai services can be configured through various environment variables. This reference provides a comprehensive list of available configuration options for your deployment.

​
Configuration Methods

​
Docker Setup

In a Docker deployment, configure these variables in the root docker-compose.yml file. See the Docker Compose documentation for more details.

​
Developer Setup

In a development environment, create a services/*/.env file containing key/value pairs: 
WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=someBucketName
...
To run a service directly from its Docker image, add an env_file option to its services/*/docker-compose.yml file: 
console:
  entrypoint: npm start --prefix services/console
  restart: on-failure
  image: registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-console:latest
  ports:
    - "3000:3000"
  env_file: ./.env
Note 1: Default values may differ depending on the selected start mode (Docker or Developer), especially URL-related variables. Note 2: Relative paths start from the executing service directory.

​
Variable Categories

​
Domains & URLs

Configure the URLs and domains used by Prisme.ai services.
NameServiceDescriptionDefault Value
INTERNAL_API_URLapi-gateway, workspaces, events, runtime, console, pagesapi-gateway internal URL for internal requests (i.e., contact fetching, public JWKS, runtime fetches)http://localhost:3001/v2
API_URLconsole, pages, api-gateway, runtime, workspacesapi-gateway public URLhttp://studio.local.prisme.ai:3001/v2
CONSOLE_URLapi-gateway, console, pages, runtimeStudio URL, used for emails, auth redirections & runtime variable {{global.studioUrl}}http://studio.local.prisme.ai:3000
PAGES_HOSTapi-gateway, console, pages, runtimePages base domain starting with a ’.’, workspace slug will be prefixed as a subdomain. Used for pages builder, pages sign-in redirection from api gateway, & runtime variable {{global.pagesUrl}}.pages.local.prisme.ai:3100

​
Databases & Storage

​
Redis Configuration

NameServiceDescriptionDefault Value
BROKER_HOSTAll servicesRedis broker URL (must be the same across services)redis://localhost:6379/0
BROKER_PASSWORDAll servicesRedis broker password
BROKER_TLS_CA_FILEAll servicesRedis TLS CA filepath
BROKER_NAMESPACEAll servicesOptional namespace to segment events when database instance is shared by multiple platforms
BROKER_TOPIC_MAXLENAll servicesRedis streams max length before getting truncated (Capped Streams)10000
BROKER_EMIT_MAXLENAll servicesMaximum size (in bytes) of emitted events100000
BROKER_EMIT_EXECUTED_AUTOMATION_MAXLENruntimeMaximum size (in bytes) of emitted runtime.automations.executed events10000
SESSIONS_STORAGE_HOSTapi-gatewayRedis URL for sessions storageredis://localhost:6379/0
SESSIONS_STORAGE_PASSWORDapi-gatewayRedis password for sessions storage
SESSIONS_STORAGE_TLS_CA_FILEapi-gatewayRedis TLS CA filepath
CONTEXTS_CACHE_HOSTruntimeRedis URL for contexts persistenceredis://localhost:6379/0
CONTEXTS_CACHE_PASSWORDruntimeRedis password for contexts persistence
CONTEXTS_CACHE_TLS_CA_FILEruntimeRedis TLS CA filepath
EVENTS_TOPICS_CACHE_HOSTeventsRedis URL for event userTopics persistenceBROKER_HOST variable
EVENTS_TOPICS_CACHE_PASSWORDeventsRedis password for event userTopics persistence
EVENTS_TOPICS_CACHE_TLS_CA_FILEeventsRedis TLS CA filepath

​
MongoDB Configuration

NameServiceDescriptionDefault Value
PERMISSIONS_STORAGE_HOSTAll servicesMongoDB URL for permissions storage (must be the same for both workspaces & events)mongodb://localhost:27017/permissions
USERS_STORAGE_HOSTapi-gatewayMongoDB URL for users storagemongodb://localhost:27017/users

​
Elasticsearch Configuration

NameServiceDescriptionDefault Value
EVENTS_STORAGE_DRIVEReventsEvents storage driver (support elasticseach or opensearch)elasticsearch
EVENTS_STORAGE_ES_HOSTeventsElasticsearch URL for events persistencehttp://localhost:9200
EVENTS_STORAGE_ES_USEReventsElasticsearch user for events persistence
EVENTS_STORAGE_ES_PASSWORDeventsElasticsearch password for events persistence
EVENTS_STORAGE_ES_BULK_REFRESHeventsEnable Elastic “refresh” option when bulk inserting events (might cause overhead)no

​
Storage Configuration

Prisme.ai supports multiple storage backends for workspaces and uploads. Available storage types are:
  • FILESYSTEM: Local file system storage
  • S3_LIKE: Amazon S3 or compatible services (MinIO, etc.)
  • AZURE_BLOB: Azure Blob Storage
  • GCS : Google Cloud Storage

​
Workspaces Storage

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_TYPEruntime & workspacesStorage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)FILESYSTEM
WORKSPACES_STORAGE_FILESYSTEM_DIRPATHruntime & workspacesDirectory path for filesystem storage../../data/models/

​
S3-Compatible Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEYruntime & workspacesS3 access key
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEYruntime & workspacesS3 secret key
WORKSPACES_STORAGE_S3_LIKE_ENDPOINTruntime & workspacesS3 endpoint
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAMEruntime & workspacesS3 bucket name
WORKSPACES_STORAGE_S3_LIKE_REGIONruntime & workspacesS3 region
STORAGE_S3_LIKE_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited S3 requests5

​
Azure Blob Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_AZURE_BLOB_CONTAINERruntime & workspacesAzure Blob container namemodels
WORKSPACES_STORAGE_AZURE_BLOB_CONNECTION_STRINGruntime & workspacesAzure Blob connection string

​
GCS Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_GCS_BUCKETruntime & workspacesGCS bucket name (required)
WORKSPACES_STORAGE_GCS_KEYFILEPATHruntime & workspacesService account configuration filepathGOOGLE_APPLICATION_CREDENTIALS environment variable
WORKSPACES_STORAGE_GCS_PROJECTIDruntime & workspacesGCS project id, only required when using apiKey
WORKSPACES_STORAGE_GCS_APIKEYruntime & workspacesApi key
STORAGE_GCS_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited GCS requests5
If WORKSPACES_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only WORKSPACES_STORAGE_GCS_BUCKET is required.

​
File Uploads Storage

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_TYPEworkspacesStorage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)FILESYSTEM
UPLOADS_STORAGE_FILESYSTEM_DIRPATHworkspacesDirectory path for filesystem storage../../data/models/

​
S3-Compatible Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEYworkspacesS3 access key
UPLOADS_STORAGE_S3_LIKE_SECRET_KEYworkspacesS3 secret key
UPLOADS_STORAGE_S3_LIKE_ENDPOINTworkspacesS3 endpoint
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAMEworkspacesS3 bucket name
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BUCKET_NAMEworkspacesS3 bucket name for public assets (required if the private uploads bucket does not support object level ACL)
UPLOADS_STORAGE_S3_LIKE_REGIONworkspacesS3 region
STORAGE_S3_LIKE_MAX_RETRIESworkspacesMaximum retries on rate-limited S3 requests5
UPLOADS_STORAGE_S3_LIKE_BASE_URLworkspacesBase download URL (if omitted, workspaces API will be used as proxy)

​
Azure Blob Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_AZURE_BLOB_CONTAINERworkspacesAzure Blob container namemodels
UPLOADS_STORAGE_AZURE_BLOB_CONNECTION_STRINGworkspacesAzure Blob connection string
UPLOADS_STORAGE_AZURE_BLOB_BASE_URLworkspacesBase download URL (if omitted, workspaces API will be used as proxy)

​
GCS Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_GCS_BUCKETworkspacesGCS bucket name (required)
UPLOADS_PUBLIC_STORAGE_GCS_BUCKETworkspacesGCS bucket name for public assets (required if the private uploads bucket does not support object level ACL)
UPLOADS_STORAGE_GCS_KEYFILEPATHworkspacesService account configuration filepathGOOGLE_APPLICATION_CREDENTIALS environment variable
UPLOADS_STORAGE_GCS_PROJECTIDworkspacesGCS project id, only required when using apiKey
UPLOADS_STORAGE_GCS_APIKEYworkspacesApi key
STORAGE_GCS_MAX_RETRIESworkspacesMaximum retries on rate-limited GCS requests5
UPLOADS_STORAGE_GCS_BASE_URLworkspacesBase download URL (if omitted, workspaces API will be used as proxy)
If UPLOADS_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only UPLOADS_STORAGE_GCS_BUCKET is required. Notes on uploads bucket: By default, the driver stores all uploads inside the same bucket for both public and private files. This bucket must allow public access and enable object-level ACLs, letting the driver selectively set objects as public or private. If these options are restricted in your environment, you can configure two separate buckets for public/private objects:
  1. Both buckets can maintain default settings (which prohibit public access and disable object-level ACLs)
  2. The public bucket could be served through a CDN allowed to access all objects (or any more restrictive pattern you prefer)
In this setup, UPLOADS_STORAGE_S3_* variables configure the private bucket, while UPLOADS_PUBLIC_STORAGE_S3_* variables configure the “public” bucket (i.e dedicated to public assets, but not necessarily public itself). You can provide separate credentials for the public bucket or simply set these two variables to use the same credentials: 
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BUCKET_NAME="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BASE_URL="your OPTIONAL CDN public base URL"
Equivalent variables exist for GCS : 
UPLOADS_PUBLIC_STORAGE_GCS_BUCKET="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_GCS_BASE_URL="your OPTIONAL CDN public base URL"
To avoid public buckets / CDN, you can force all file download requests to go through the Prisme.ai API by not providing the UPLOADS_STORAGE_*_BASE_URL environment variable.

​
Authentication & Security

​
OIDC Configuration

NameServiceDescriptionDefault Value
OIDC_PROVIDER_URLapi-gateway, pages, console, runtimeOIDC Authorization public server URL (rarely needs changing)API_URL without base path
OIDC_INTERNAL_PROVIDER_URLapi-gatewayOIDC Authorization internal server URL (rarely needs changing)By precedence: INTERNAL_API_URL, OIDC_PROVIDER_URL, or API_URL
OIDC_STUDIO_CLIENT_IDapi-gateway, consoleStudio OIDC client IDlocal-client-id
OIDC_STUDIO_CLIENT_SECRETapi-gatewayStudio OIDC client secret (known only by api-gateway)local-client-id
OIDC_CLIENT_REGISTRATION_TOKENapi-gatewayAccess token required for OIDC clients registration APIlocal-client-id
OIDC_WELL_KNOWN_URLapi-gatewayOIDC provider configuration discovery URL (only for external providers)
JWKS_URLapi-gatewayEndpoint for retrieving JWKS as part of the JWKS strategyOIDC_INTERNAL_PROVIDER_URL/oidc/jwks

​
Session & Token Configuration

NameServiceDescriptionDefault Value
SESSION_COOKIES_MAX_AGEapi-gatewayAuth server session cookies expiration (in seconds)2592000 (1 month)
ACCESS_TOKENS_MAX_AGEapi-gatewaySession expiration for both anonymous & authenticated sessions (in seconds)2592000 (1 month)
SESSION_COOKIES_SIGN_SECRETapi-gatewaySession cookies signing secret
SOCKETIO_COOKIE_MAX_AGEeventsSocket.io cookie maxAgeDefault from ‘cookie’ NodeJS module

​
Security Settings

NameServiceDescriptionDefault Value
CORS_ADDITIONAL_ALLOWED_ORIGINSapi-gatewayAdditional allowed CORS origins (beyond STUDIO_URL, PAGES_HOST, and workspace custom domains)
CSP_HEADERconsole, pagesContent Security Policy header for frontend services (if undefined, no CSP header is returned)
PASSWORD_VALIDATION_REGEXPapi-gatewayPassword validation regular expression.{8,32}
ACCOUNT_VALIDATION_METHODapi-gatewayAccount validation method on signup: “auto”, “email”, or “manual”email

​
Service-Specific Configuration

​
API Gateway

NameServiceDescriptionDefault Value
PORTapi-gatewayListening port number3001
GATEWAY_CONFIG_PATHapi-gatewayPath to gateway.config.yml../../gateway.config.yml
AUTH_PROVIDERS_CONFIGapi-gatewayPath to authProviders.config.yml../../authProviders.config.yml
INTERNAL_API_KEYapi-gateway, workspacesAPI key for internal services to access events /sys/cleanup API
WORKSPACES_API_URLapi-gatewayprismeai-workspaces internal URLhttp://workspaces:3002
EVENTS_API_URLapi-gatewayprismeai-events internal URLhttp://events:3004
RUNTIME_API_URLapi-gatewayprismeai-runtime internal URLhttp://runtime:3003
X_FORWARDED_HEADERSapi-gatewayAdd X-Forwarded-* headers on proxied requestsyes
SUPER_ADMIN_EMAILSapi-gatewayComma-separated list of user emails with access to all workspaces (e.g., “admin@example.com,user@company.com”)None
REQUEST_MAX_SIZEapi-gatewayMaximum request body size (format from bodyParser.json)1mb

​
Console

NameServiceDescriptionDefault Value
PORTconsoleListening port number3000
CUSTOMIZATION_ENDPOINTconsole, pageurl toward ops_manager for customization webhook, using the internal API URL
WEBSOCKETS_DEFAULT_TRANSPORTSconsole, pagesDefault Socket.io transport methodspolling,websocket

​
Events Service

NameServiceDescriptionDefault Value
PORTeventsListening port number3004
EVENTS_BUFFER_FLUSH_ATeventsPersist events in data lake after this many events128
EVENTS_BUFFER_HIGH_WATERMARKeventsStop listening for new events when this many are waiting to be persisted256
EVENTS_BUFFER_FLUSH_EVERYeventsPersist events every N milliseconds, even if EVENTS_BUFFER_FLUSH_AT not reached5000
EVENTS_RETENTION_DAYSeventsDays events are kept in data lake before removal180
EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYSeventsDelete workspace events if inactive for more than N days & with fewer than EVENTS_CLEANUP_WORKSPACE_MAX_EVENTS15
EVENTS_CLEANUP_WORKSPACE_MAX_EVENTSeventsDelete workspace events if inactive for more than EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYS & with fewer than N events100
EVENTS_SCHEDULED_DELETION_DAYSeventsDays events are kept in data lake after workspace deletion (min_age parameter for the policy-events-deletion-scheduled ILM policy)90
ELASTIC_SEARCH_TIMEOUTeventsBest effort timeout for search requests : https://www.elastic.co/docs/solutions/search/the-search-api#search-timeout20000ms
EVENTS_CLEANUP_AUTOMATION_EXECUTED_EXPIRATIONeventsExpiration period enforced by /cleanup API for payload & output fields of runtime.automations.executed events. Can also be tuned from Helm prismeai-events.events.automationExecutedExpiration value14d

​
Runtime Service

NameServiceDescriptionDefault Value
PORTruntimeListening port number3003
MAXIMUM_SUCCESSIVE_CALLSruntimeMaximum automation executions for the same correlation ID20
CONTEXT_RUN_EXPIRE_TIMEruntimeRun context expiration time in seconds60
CONTEXT_UNAUTHENTICATED_SESSION_EXPIRE_TIMEruntimeSession context expiration time in seconds for unauthenticated sessions3600 (1 hour)
ADDITIONALGLOBAL_VARS*runtimeAdditional variables available from global context (e.g., ADDITIONAL_GLOBAL_VARS_apiUrl becomes {{global.apiUrl}})None
WORKSPACECONFIG{{workspaceSlug}}_{{variableName}}runtimeVariables available for specific workspacesNone
APPCONFIG{{appSlug}}_{{variableName}}runtimeVariables available for specific appsNone
FETCH_FORBIDDEN_HOSTSruntimeComma-separated list of forbidden hostnames in fetch instruction
FETCH_MAX_RETRIESruntimeMaximum fetch retries3
FETCH_RETRY_CODESruntimeError codes that trigger fetch retriesECONNRESET,UND_ERR_SOCKET,EPIPE,EHOSTUNREACH,ENETUNREACH
FETCH_RETRY_STATUSruntimeResponse status codes that trigger fetch retries429,503,502
RUNNER_MAX_THREADSruntimeNumber of worker_threads per runtime instance1
AUTOMATION_FETCH_DIRECT_CALLruntimeForce cross workspaces HTTP calls to be direct internal calls instead of HTTP requeststrue

​
Workspaces Service

NameServiceDescriptionDefault Value
PORTworkspacesListening port number3002
UPLOADS_ALLOWED_MIMETYPESworkspacesComma-separated list of allowed upload MIME typesimage/,text/,video/,audio/,application/*
UPLOADS_FORBIDDEN_MIMETYPESworkspacesComma-separated list of forbidden upload MIME types (no wildcards)
UPLOADS_DEFAULT_VISIBILITYworkspacesDefault upload visibility if not specified in API requestpublic
UPLOADS_MAX_SIZEworkspaces, api-gateway, runtimeMaximum upload size in bytes10000000 (10MB)
IMPORT_BATCH_SIZEworkspacesMaximum parallel save requests during imports50

​
Performance & Limits

​
Rate Limiting

NameServiceDescriptionDefault Value
RATE_LIMIT_SIGNUPapi-gatewayMaximum signups per IP per minute1
RATE_LIMIT_ANONYMOUS_LOGINapi-gatewayMaximum anonymous logins per IP per minute10
RATE_LIMIT_PRISMEAI_LOGINapi-gatewayMaximum email/password login attempts per email per minute5
RATE_LIMIT_PASSWORD_RESETapi-gatewayMaximum password reset requests per IP per minute1

​
Integration & APIs

NameServiceDescriptionDefault Value
OPENAPI_FILEPATHAll servicesPath to Swagger file for requests & events validation../specifications/swagger.yml

​
Examples

​
S3 Storage Configuration

# Configure workspace storage with S3
WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=prisme-workspaces
WORKSPACES_STORAGE_S3_LIKE_REGION=us-west-1
WORKSPACES_STORAGE_S3_LIKE_BASE_URL=https://prisme-workspaces.s3.us-west-1.amazonaws.com

# Configure uploads with the same credentials but different bucket
UPLOADS_STORAGE_TYPE=S3_LIKE
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
UPLOADS_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAME=prisme-uploads
UPLOADS_STORAGE_S3_LIKE_REGION=us-west-1
UPLOADS_STORAGE_S3_LIKE_BASE_URL=https://prisme-uploads.s3.us-west-1.amazonaws.com

​
Authentication and Rate Limiting for Production

# Set a strong password policy
PASSWORD_VALIDATION_REGEXP= "YOUR_REGEX"

# Enable manual account validation
ACCOUNT_VALIDATION_METHOD=manual

# Configure super admins
SUPER_ADMIN_EMAILS=admin@company.com,security@company.com

# Set stricter rate limits
RATE_LIMIT_SIGNUP=1
RATE_LIMIT_ANONYMOUS_LOGIN=5
RATE_LIMIT_PRISMEAI_LOGIN=3
RATE_LIMIT_PASSWORD_RESET=1

​
Custom Domain Configuration

# Configure custom domain for platform access
CONSOLE_URL=https://studio.company.com
API_URL=https://api.company.com/v2
PAGES_HOST=.apps.company.com