Prisme.ai services can be configured through various environment variables. This reference provides a comprehensive list of available configuration options for your deployment.

​
Configuration Methods

​
Docker Setup

In a Docker deployment, configure these variables in the root docker-compose.yml file. See the Docker Compose documentation for more details.

​
Developer Setup

In a development environment, create a services/*/.env file containing key/value pairs:

WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=someBucketName
...

To run a service directly from its Docker image, add an env_file option to its services/*/docker-compose.yml file:

console:
  entrypoint: npm start --prefix services/console
  restart: on-failure
  image: registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-console:latest
  ports:
    - "3000:3000"
  env_file: ./.env

Note 1: Default values may differ depending on the selected start mode (Docker or Developer), especially URL-related variables.

Note 2: Relative paths start from the executing service directory.

​
Variable Categories

​
Domains & URLs

Configure the URLs and domains used by Prisme.ai services.

NameServiceDescriptionDefault Value
GATEWAY_API_HOSTapi-gateway, workspaces, eventsapi-gateway internal URL for internal requests (i.e., contact fetching, public JWKS)http://localhost:3001/v2
API_URLconsole, pages, api-gateway, runtimeapi-gateway public URLhttp://studio.local.prisme.ai:3001/v2
CONSOLE_URLapi-gateway, console, pages, runtimeStudio URL, used for emails, auth redirections & runtime variable {{global.studioUrl}}http://studio.local.prisme.ai:3000
PAGES_HOSTapi-gateway, console, pages, runtimePages base domain starting with a ’.’, workspace slug will be prefixed as a subdomain. Used for pages builder, pages sign-in redirection from api gateway, & runtime variable {{global.pagesUrl}}.pages.local.prisme.ai:3100

​
Databases & Storage

​
Redis Configuration

NameServiceDescriptionDefault Value
BROKER_HOSTAll servicesRedis broker URL (must be the same across services)redis://localhost:6379/0
BROKER_PASSWORDAll servicesRedis broker password
BROKER_NAMESPACEAll servicesOptional namespace to segment events when database instance is shared by multiple platforms
BROKER_TOPIC_MAXLENAll servicesRedis streams max length before getting truncated (Capped Streams)10000
BROKER_EMIT_MAXLENAll servicesMaximum size (in bytes) of emitted events100000
SESSIONS_STORAGE_HOSTapi-gatewayRedis URL for sessions storageredis://localhost:6379/0
SESSIONS_STORAGE_PASSWORDapi-gatewayRedis password for sessions storage
CONTEXTS_CACHE_HOSTruntimeRedis URL for contexts persistenceredis://localhost:6379/0
CONTEXTS_CACHE_PASSWORDruntimeRedis password for contexts persistence
EVENTS_TOPICS_CACHE_HOSTeventsRedis URL for event userTopics persistenceBROKER_HOST variable
EVENTS_TOPICS_CACHE_PASSWORDeventsRedis password for event userTopics persistence

​
MongoDB Configuration

NameServiceDescriptionDefault Value
PERMISSIONS_STORAGE_HOSTAll servicesMongoDB URL for permissions storage (must be the same for both workspaces & events)mongodb://localhost:27017/permissions
USERS_STORAGE_HOSTapi-gatewayMongoDB URL for users storagemongodb://localhost:27017/users

​
Elasticsearch Configuration

NameServiceDescriptionDefault Value
EVENTS_STORAGE_ES_HOSTeventsElasticsearch URL for events persistencehttp://localhost:9200
EVENTS_STORAGE_ES_USEReventsElasticsearch user for events persistence
EVENTS_STORAGE_ES_PASSWORDeventsElasticsearch password for events persistence
EVENTS_STORAGE_ES_BULK_REFRESHeventsEnable Elastic “refresh” option when bulk inserting events (might cause overhead)no

​
Storage Configuration

Prisme.ai supports multiple storage backends for workspaces and uploads. Available storage types are:

  • FILESYSTEM: Local file system storage
  • S3_LIKE: Amazon S3 or compatible services (MinIO, etc.)
  • AZURE_BLOB: Azure Blob Storage
  • GCS : Google Cloud Storage

​
Workspaces Storage

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_TYPEruntime & workspacesStorage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)FILESYSTEM
WORKSPACES_STORAGE_FILESYSTEM_DIRPATHruntime & workspacesDirectory path for filesystem storage../../data/models/

​
S3-Compatible Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEYruntime & workspacesS3 access key
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEYruntime & workspacesS3 secret key
WORKSPACES_STORAGE_S3_LIKE_ENDPOINTruntime & workspacesS3 endpoint
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAMEruntime & workspacesS3 bucket name
WORKSPACES_STORAGE_S3_LIKE_REGIONruntime & workspacesS3 region
STORAGE_S3_LIKE_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited S3 requests5

​
Azure Blob Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_AZURE_BLOB_CONTAINERruntime & workspacesAzure Blob container namemodels
WORKSPACES_STORAGE_AZURE_BLOB_CONNECTION_STRINGruntime & workspacesAzure Blob connection string

​
GCS Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_GCS_BUCKETruntime & workspacesGCS bucket name (required)
WORKSPACES_STORAGE_GCS_KEYFILEPATHruntime & workspacesService account configuration filepathGOOGLE_APPLICATION_CREDENTIALS environment variable
WORKSPACES_STORAGE_GCS_PROJECTIDruntime & workspacesGCS project id, only required when using apiKey
WORKSPACES_STORAGE_GCS_APIKEYruntime & workspacesApi key
STORAGE_GCS_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited GCS requests5

If WORKSPACES_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only WORKSPACES_STORAGE_GCS_BUCKET is required.

​
File Uploads Storage

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_TYPEruntime & workspacesStorage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)FILESYSTEM
UPLOADS_STORAGE_FILESYSTEM_DIRPATHruntime & workspacesDirectory path for filesystem storage../../data/models/

​
S3-Compatible Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEYruntime & workspacesS3 access key
UPLOADS_STORAGE_S3_LIKE_SECRET_KEYruntime & workspacesS3 secret key
UPLOADS_STORAGE_S3_LIKE_ENDPOINTruntime & workspacesS3 endpoint
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAMEruntime & workspacesS3 bucket name
UPLOADS_STORAGE_S3_LIKE_REGIONruntime & workspacesS3 region
STORAGE_S3_LIKE_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited S3 requests5
UPLOADS_STORAGE_S3_LIKE_BASE_URLruntime & workspacesBase download URL (if omitted, workspaces API will be used as proxy)

​
Azure Blob Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_AZURE_BLOB_CONTAINERruntime & workspacesAzure Blob container namemodels
UPLOADS_STORAGE_AZURE_BLOB_CONNECTION_STRINGruntime & workspacesAzure Blob connection string
UPLOADS_STORAGE_AZURE_BLOB_BASE_URLruntime & workspacesBase download URL (if omitted, workspaces API will be used as proxy)

​
GCS Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_GCS_BUCKETruntime & workspacesGCS bucket name (required)
UPLOADS_STORAGE_GCS_KEYFILEPATHruntime & workspacesService account configuration filepathGOOGLE_APPLICATION_CREDENTIALS environment variable
UPLOADS_STORAGE_GCS_PROJECTIDruntime & workspacesGCS project id, only required when using apiKey
UPLOADS_STORAGE_GCS_APIKEYruntime & workspacesApi key
STORAGE_GCS_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited GCS requests5
UPLOADS_STORAGE_GCS_BASE_URLruntime & workspacesBase download URL (if omitted, workspaces API will be used as proxy)

If UPLOADS_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only UPLOADS_STORAGE_GCS_BUCKET is required.

Notes on uploads bucket:

By default, the driver stores all uploads inside the same bucket for both public and private files. This bucket must allow public access and enable object-level ACLs, letting the driver selectively set objects as public or private.

If these options are restricted in your environment, you can configure two separate buckets for public/private objects:

  1. Both buckets can maintain default settings (which prohibit public access and disable object-level ACLs)
  2. The public bucket should be served through a CDN allowed to access all objects (or any more restrictive pattern you prefer)

In this setup, UPLOADS_STORAGE_S3_* variables configure the private bucket, while UPLOADS_PUBLIC_STORAGE_S3_* variables configure the public bucket.

You can provide separate credentials for the public bucket or simply set these two variables to use the same credentials:

UPLOADS_PUBLIC_STORAGE_S3_LIKE_BUCKET_NAME="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BASE_URL="your CDN public base URL"

Equivalent variables exist for GCS :

UPLOADS_PUBLIC_STORAGE_GCS_BUCKET="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_GCS_BASE_URL="your CDN public base URL"

To avoid public buckets without creating a second bucket behind CloudFront, you can force all file download requests to go through the Prisme.ai API by not providing the UPLOADS_STORAGE_*_BASE_URL environment variable.

​
Authentication & Security

​
OIDC Configuration

NameServiceDescriptionDefault Value
OIDC_PROVIDER_URLapi-gateway, pages, console, runtimeOIDC Authorization public server URL (rarely needs changing)API_URL without base path
OIDC_INTERNAL_PROVIDER_URLapi-gatewayOIDC Authorization internal server URL (rarely needs changing)By precedence: GATEWAY_API_HOST, OIDC_PROVIDER_URL, or API_URL
OIDC_STUDIO_CLIENT_IDapi-gateway, consoleStudio OIDC client IDlocal-client-id
OIDC_STUDIO_CLIENT_SECRETapi-gatewayStudio OIDC client secret (known only by api-gateway)local-client-id
OIDC_CLIENT_REGISTRATION_TOKENapi-gatewayAccess token required for OIDC clients registration APIlocal-client-id
OIDC_WELL_KNOWN_URLapi-gatewayOIDC provider configuration discovery URL (only for external providers)
JWKS_URLapi-gatewayEndpoint for retrieving JWKS as part of the JWKS strategyOIDC_INTERNAL_PROVIDER_URL/oidc/jwks

​
Session & Token Configuration

NameServiceDescriptionDefault Value
SESSION_COOKIES_MAX_AGEapi-gatewayAuth server session cookies expiration (in seconds)2592000 (1 month)
ACCESS_TOKENS_MAX_AGEapi-gatewaySession expiration for both anonymous & authenticated sessions (in seconds)2592000 (1 month)
SESSION_COOKIES_SIGN_SECRETapi-gatewaySession cookies signing secret
SOCKETIO_COOKIE_MAX_AGEeventsSocket.io cookie maxAgeDefault from ‘cookie’ NodeJS module

​
Security Settings

NameServiceDescriptionDefault Value
CORS_ADDITIONAL_ALLOWED_ORIGINSapi-gatewayAdditional allowed CORS origins (beyond STUDIO_URL, PAGES_HOST, and workspace custom domains)
CSP_HEADERconsole, pagesContent Security Policy header for frontend services (if undefined, no CSP header is returned)
PASSWORD_VALIDATION_REGEXPapi-gatewayPassword validation regular expression.{8,32}
ACCOUNT_VALIDATION_METHODapi-gatewayAccount validation method on signup: “auto”, “email”, or “manual”email

​
Service-Specific Configuration

​
API Gateway

NameServiceDescriptionDefault Value
PORTapi-gatewayListening port number3001
GATEWAY_CONFIG_PATHapi-gatewayPath to gateway.config.yml../../gateway.config.yml
AUTH_PROVIDERS_CONFIGapi-gatewayPath to authProviders.config.yml../../authProviders.config.yml
INTERNAL_API_KEYapi-gateway, workspacesAPI key for internal services to access events /sys/cleanup API
WORKSPACES_API_URLapi-gatewayprismeai-workspaces internal URLhttp://workspaces:3002
EVENTS_API_URLapi-gatewayprismeai-events internal URLhttp://events:3004
RUNTIME_API_URLapi-gatewayprismeai-runtime internal URLhttp://runtime:3003
X_FORWARDED_HEADERSapi-gatewayAdd X-Forwarded-* headers on proxied requestsyes
SUPER_ADMIN_EMAILSapi-gatewayComma-separated list of user emails with access to all workspaces (e.g., “admin@example.com,user@company.com”)None

​
Console

NameServiceDescriptionDefault Value
PORTconsoleListening port number3000
WEBSOCKETS_DEFAULT_TRANSPORTSconsole, pagesDefault Socket.io transport methodspolling,websocket

​
Events Service

NameServiceDescriptionDefault Value
PORTeventsListening port number3004
EVENTS_BUFFER_FLUSH_ATeventsPersist events in data lake after this many events128
EVENTS_BUFFER_HIGH_WATERMARKeventsStop listening for new events when this many are waiting to be persisted256
EVENTS_BUFFER_FLUSH_EVERYeventsPersist events every N milliseconds, even if EVENTS_BUFFER_FLUSH_AT not reached5000
EVENTS_RETENTION_DAYSeventsDays events are kept in data lake before removal180
EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYSeventsDelete workspace events if inactive for more than N days & with fewer than EVENTS_CLEANUP_WORKSPACE_MAX_EVENTS15
EVENTS_CLEANUP_WORKSPACE_MAX_EVENTSeventsDelete workspace events if inactive for more than EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYS & with fewer than N events100
EVENTS_SCHEDULED_DELETION_DAYSeventsDays events are kept in data lake after workspace deletion90

​
Runtime Service

NameServiceDescriptionDefault Value
PORTruntimeListening port number3003
MAXIMUM_SUCCESSIVE_CALLSruntimeMaximum automation executions for the same correlation ID20
CONTEXT_RUN_EXPIRE_TIMEruntimeRun context expiration time in seconds60
CONTEXT_UNAUTHENTICATED_SESSION_EXPIRE_TIMEruntimeSession context expiration time in seconds for unauthenticated sessions3600 (1 hour)
ADDITIONALGLOBAL_VARS*runtimeAdditional variables available from global context (e.g., ADDITIONAL_GLOBAL_VARS_apiUrl becomes {{global.apiUrl}})None
WORKSPACECONFIG{{workspaceSlug}}_{{variableName}}runtimeVariables available for specific workspacesNone
APPCONFIG{{appSlug}}_{{variableName}}runtimeVariables available for specific appsNone
FETCH_FORBIDDEN_HOSTSruntimeComma-separated list of forbidden hostnames in fetch instruction
FETCH_MAX_RETRIESruntimeMaximum fetch retries3
FETCH_RETRY_CODESruntimeError codes that trigger fetch retriesECONNRESET,UND_ERR_SOCKET,EPIPE,EHOSTUNREACH,ENETUNREACH
FETCH_RETRY_STATUSruntimeResponse status codes that trigger fetch retries429,503,502

​
Workspaces Service

NameServiceDescriptionDefault Value
PORTworkspacesListening port number3002
UPLOADS_ALLOWED_MIMETYPESworkspacesComma-separated list of allowed upload MIME typesimage/,text/,video/,audio/,application/*
UPLOADS_FORBIDDEN_MIMETYPESworkspacesComma-separated list of forbidden upload MIME types (no wildcards)
UPLOADS_DEFAULT_VISIBILITYworkspacesDefault upload visibility if not specified in API requestpublic
UPLOADS_MAX_SIZEworkspaces, api-gateway, runtimeMaximum upload size in bytes10000000 (10MB)
IMPORT_BATCH_SIZEworkspacesMaximum parallel save requests during imports50

​
Performance & Limits

​
Rate Limiting

NameServiceDescriptionDefault Value
RATE_LIMIT_SIGNUPapi-gatewayMaximum signups per IP per minute1
RATE_LIMIT_ANONYMOUS_LOGINapi-gatewayMaximum anonymous logins per IP per minute10
RATE_LIMIT_PRISMEAI_LOGINapi-gatewayMaximum email/password login attempts per email per minute5
RATE_LIMIT_PASSWORD_RESETapi-gatewayMaximum password reset requests per IP per minute1

​
Integration & APIs

NameServiceDescriptionDefault Value
OPENAPI_FILEPATHAll servicesPath to Swagger file for requests & events validation../specifications/swagger.yml

​
Examples

​
S3 Storage Configuration

# Configure workspace storage with S3
WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=prisme-workspaces
WORKSPACES_STORAGE_S3_LIKE_REGION=us-west-1
WORKSPACES_STORAGE_S3_LIKE_BASE_URL=https://prisme-workspaces.s3.us-west-1.amazonaws.com

# Configure uploads with the same credentials but different bucket
UPLOADS_STORAGE_TYPE=S3_LIKE
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
UPLOADS_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAME=prisme-uploads
UPLOADS_STORAGE_S3_LIKE_REGION=us-west-1
UPLOADS_STORAGE_S3_LIKE_BASE_URL=https://prisme-uploads.s3.us-west-1.amazonaws.com

​
Authentication and Rate Limiting for Production

# Set a strong password policy
PASSWORD_VALIDATION_REGEXP= "YOUR_REGEX"

# Enable manual account validation
ACCOUNT_VALIDATION_METHOD=manual

# Configure super admins
SUPER_ADMIN_EMAILS=admin@company.com,security@company.com

# Set stricter rate limits
RATE_LIMIT_SIGNUP=1
RATE_LIMIT_ANONYMOUS_LOGIN=5
RATE_LIMIT_PRISMEAI_LOGIN=3
RATE_LIMIT_PASSWORD_RESET=1

​
Custom Domain Configuration

# Configure custom domain for platform access
CONSOLE_URL=https://studio.company.com
API_URL=https://api.company.com/v2
PAGES_HOST=.apps.company.com

Was this page helpful?

Raise issue