# Environment variables

## General

<table><thead><tr><th width="379">Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_LICENSE_KEY</td><td>UI Bakery license key. To get your key <a href="https://uibakery.io/contact-us">contact us</a>.</td></tr><tr><td>UI_BAKERY_APP_SERVER_NAME</td><td>Full domain address where UI Bakery is hosted. For example <code>https://bakery.mycompany.com</code>.</td></tr><tr><td>UI_BAKERY_PORT</td><td>Defines the port UI Bakery is run on.</td></tr><tr><td>UI_BAKERY_SINGLE_ORGANIZATION</td><td>When <code>true</code>, all attempts to register new workspaces except 1st will fail.</td></tr><tr><td>UI_BAKERY_MAINTENANCE_TIME_GMT</td><td>Enables maintenance mode notice, format - Wed Sep 28 2022 16:08:13 GMT+0100</td></tr><tr><td>UI_BAKERY_MAINTENANCE_NOTICE_PRIOR_HOURS</td><td>How many hours prior to maintenance the notice must be shown</td></tr><tr><td>UI_BAKERY_EMBEDDED_ENABLE_ACTIONS_EXECUTION</td><td>If true, allows calling actions when UI Bakery is embedded in an iframe</td></tr><tr><td>UI_BAKERY_ENABLED_FEATURE_FLAGS</td><td>Comma-separated list of globally <a href="on-premise-features/activating-features-under-a-feature-flag">enabled feature flags</a>.</td></tr><tr><td>UI_BAKERY_TEMPLATE_MAKER_ACCOUNT_PASSWORD</td><td>An account to manage instance app templates. Empty value disables the access (default).</td></tr><tr><td>UI_BAKERY_AUTOMATIC_BACKUP_INTERVAL</td><td>The interval defines how often UI Bakery has to create automatic backups of your project in milliseconds. Default 15 minutes.</td></tr><tr><td>UI_BAKERY_AUTOMATIC_BACKUP_RETENTION</td><td>Defines how long UI Bakery should persist automatic backup in milliseconds. Default 1 week.</td></tr><tr><td>UI_BAKERY_REQUEST_MAX_SIZE</td><td>Max size of the request, 50M by default.</td></tr><tr><td>UI_BAKERY_GIT_PR_URL_TEMPLATE</td><td><a href="https://bitbucket.company_name.com/projects/%7Buser%7D/repos/%7Bproject%7D/pull-requests?create&#x26;sourceBranch={activeBranch}">https://bitbucket.company_name.com/projects/{user}/repos/{project}/pull-requests?create&#x26;sourceBranch={activeBranch}</a></td></tr><tr><td>UI_BAKERY_LOG_RETENTION</td><td>The time to persist audit logs and automation execution logs. Default infinity. Ex: <code>7d</code>, <code>90d</code></td></tr><tr><td>UI_BAKERY_LOG_RETENTION_BATCH_SIZE</td><td>Sets the batch size for log processing during cleanup. Default is 100.</td></tr></tbody></table>

## Database

| Environment variable name  | Description                                                                                             |
| -------------------------- | ------------------------------------------------------------------------------------------------------- |
| UI\_BAKERY\_DB\_DATABASE   | MySQL database name, must be specified when external database is used.                                  |
| UI\_BAKERY\_DB\_HOST       | MySQL host name, must be specified when external database is used.                                      |
| UI\_BAKERY\_DB\_PASSWORD   | MySQL user password, must be specified when external database is used.                                  |
| UI\_BAKERY\_DB\_PORT       | MySQL port, must be specified when external database is used.                                           |
| UI\_BAKERY\_DB\_USERNAME   | MySQL user name, must be specified when external database is used.                                      |
| UI\_BAKERY\_DB\_POOL\_SIZE | Database connection pool size, can be specified when external database is used. Default value is `100`. |

## Encryption secrets

Installation script generates these secrets automatically. Generating of custom secrets is covered [here](https://docs.uibakery.io/on-premise/install-and-update/recommendations/generate-custom-secrets).

| Environment variable name                 | Description                                                                                                                                                                                    |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| UI\_BAKERY\_CREDENTIALS\_SECRET           | Encryption key for data source credentials. Must be exactly 32 characters long. Changing this variable on an existing instance may lead to losing access to the already connected data source. |
| UI\_BAKERY\_JWT\_SECRET                   | JWT secret is used to sign user requests to UI Bakery API.                                                                                                                                     |
| UI\_BAKERY\_JWT\_REFRESH\_SECRET          | Similar to `UI_BAKERY_JWT_SECRET` but for refresh token.                                                                                                                                       |
| UI\_BAKERY\_JWT\_SERVICE\_ACCOUNT\_SECRET | Similar to `UI_BAKERY_JWT_SECRET` but used by automations.                                                                                                                                     |
| UI\_BAKERY\_PROJECT\_PRIVATE\_KEY\_SECRET | Encryption key for Git SSH credentials. Must be exactly 32 characters long. Changing this variable on an existing instance may lead to losing access to the already connected Git repository.  |
| UI\_BAKERY\_AUTH\_DEVICE\_INFO\_SECRET    | Used for the encryption of device info.                                                                                                                                                        |

## Data sources

<table><thead><tr><th width="367">Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_DATASOURCE_TIMEOUT</td><td>Datasource request timeout in milliseconds. Default value is <code>90000</code>.</td></tr><tr><td>UI_BAKERY_DATASOURCE_MAX_SIZE</td><td>Datasource request's maximum response size in bytes. The default value is <code>50000000</code> ( approx. 50MB), and the max value is <code>2147483647</code> (approx. 2.15GB)</td></tr><tr><td>UI_BAKERY_REQUEST_MAX_SIZE</td><td>Maximum client request payload size. Default value is <code>50M</code></td></tr><tr><td>UI_BAKERY_GSHEET_CLIENT_ID</td><td>Google Sheet API Client Id. Must be provided when GSheet datasource is required.</td></tr><tr><td>UI_BAKERY_GSHEET_CLIENT_SECRET</td><td>Google Sheet API Client Secret. Must be provided when GSheet datasource is required.</td></tr><tr><td>UI_BAKERY_SALESFORCE_CLIENT_ID</td><td>Salesforce API Client Id. Must be provided when Salesforce datasource is required.</td></tr><tr><td>UI_BAKERY_SALESFORCE_CLIENT_SECRET</td><td>Salesforce API Client Secret. Must be provided when Salesforce datasource is required.</td></tr><tr><td>UI_BAKERY_HTTPS_PROXY_URL</td><td>HTTPS Proxy URL to send HTTPS requests from datasource through proxy</td></tr><tr><td>UI_BAKERY_SNOWFLAKE_CONFIGURATION</td><td>JSON configuration object for the snowflake-sdk</td></tr><tr><td>UI_BAKERY_SSH_PUBLIC_KEY</td><td>SSH public key for SSH data source configuration</td></tr><tr><td>UI_BAKERY_SSH_TUNNEL_USER</td><td>SSH user for SSH data source configuration</td></tr><tr><td>UI_BAKERY_SSH_TUNNEL_KEY</td><td>SSH tunnel key for SSH data source configuration</td></tr><tr><td>UI_BAKERY_SSH_TUNNEL_PASSWORD</td><td>SSH tunnel password for SSH data source configuration</td></tr><tr><td>UI_BAKERY_DATASOURCE_MSSQL_POOL_MAX<br>UI_BAKERY_DATASOURCE_MYSQL_POOL_MAX<br>UI_BAKERY_DATASOURCE_MARIADB_POOL_MAX<br>UI_BAKERY_DATASOURCE_POSTGRES_POOL_MAX<br>UI_BAKERY_DATASOURCE_REDSHIFT_POOL_MAX<br>UI_BAKERY_DATASOURCE_SNOWFLAKE_POOL_MAX</td><td>The maximum number of simultaneous requests to the database in a single connection. Type -  <code>number</code>, default value - <code>5</code>.</td></tr><tr><td>UI_BAKERY_DATASOURCE_MSSQL_POOL_ACQUIRE<br>UI_BAKERY_DATASOURCE_MYSQL_POOL_ACQUIRE<br>UI_BAKERY_DATASOURCE_MARIADB_POOL_ACQUIRE<br>UI_BAKERY_DATASOURCE_POSTGRES_POOL_ACQUIRE<br>UI_BAKERY_DATASOURCE_REDSHIFT_POOL_ACQUIRE<br>UI_BAKERY_DATASOURCE_SNOWFLAKE_POOL_ACQUIRE</td><td>The maximum wait time, in milliseconds, for acquiring a free connection when all connections are in use. Type - <code>number</code>, default value - <code>90000ms</code> (90 sec).</td></tr></tbody></table>

## Authentication

| Environment variable name                                   | Description                                                                                                                                                                                                                  |
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| UI\_BAKERY\_EMAIL\_AUTH\_ENABLED                            | By default is `true`. Can be set to `false` to allow authentication only with OAuth2 or SAML SSO.                                                                                                                            |
| UI\_BAKERY\_REGISTER\_URL                                   | The URL for the UI Bakery Sign Up page. Default value is `/register`.                                                                                                                                                        |
| UI\_BAKERY\_GOOGLE\_CLIENT\_ID                              | Google OAuth Client Id. Must be provided to enable authentication with Google.                                                                                                                                               |
| UI\_BAKERY\_AUTH\_RESTRICTED\_DOMAIN                        | Used to restrict which email addresses are allowed to authenticate with OAuth2. For example, `mycompany.com`.                                                                                                                |
| UI\_BAKERY\_OAUTH\_CLIENT\_ID                               | OAuth2 client id.                                                                                                                                                                                                            |
| UI\_BAKERY\_OAUTH\_SECRET                                   | OAuth2 client secret.                                                                                                                                                                                                        |
| UI\_BAKERY\_OAUTH\_SCOPE                                    | OAuth2 scope, space separated string.                                                                                                                                                                                        |
| UI\_BAKERY\_OAUTH\_AUTH\_URL                                | Authorization URL for OAuth2.                                                                                                                                                                                                |
| UI\_BAKERY\_OAUTH\_TOKEN\_URL                               | Token endpoint URL for OAuth2.                                                                                                                                                                                               |
| UI\_BAKERY\_OAUTH\_USERINFO\_URL                            | Userinfo endpoint URL for OAuth2.                                                                                                                                                                                            |
| UI\_BAKERY\_OAUTH\_EMAIL\_KEY                               | Email key attribute name for OAuth2. Default is '`email`'.                                                                                                                                                                   |
| UI\_BAKERY\_OAUTH\_ID\_KEY                                  | Id key attribute name for OAuth2. Default is '`sub`'.                                                                                                                                                                        |
| UI\_BAKERY\_OAUTH\_TOKEN\_URL\_ADDITIONAL\_PARAMS           | Additional params for the token endpoint. Accepts JSON.                                                                                                                                                                      |
| UI\_BAKERY\_OAUTH\_GET\_CLAIMS\_FROM\_TOKEN                 | When set to `true`, the `access_token` attributes will be used as the source of claims instead of obtaining them from the `userinfo` endpoint.                                                                               |
| UI\_BAKERY\_OAUTH\_SIGN\_OUT\_WHEN\_TOKEN\_EXPIRED          | If the option is enabled and the OAuth token cannot be refreshed, the user will be logged out of UI Bakery. Default is `false`.                                                                                              |
| UI\_BAKERY\_OAUTH\_TOAST\_WHEN\_TOKEN\_EXPIRED              | If the option is enabled and the token refresh request fails, a short message will be displayed to the user before signing out.                                                                                              |
| UI\_BAKERY\_OAUTH\_INITIATE\_SIGN\_IN\_WHEN\_TOKEN\_EXPIRED | If the option is enabled and the token refresh request fails, the user will be redirected to the SSO login page instead of following the logout redirect.                                                                    |
| UI\_BAKERY\_OAUTH\_FORCE\_TOKEN\_REFRESH                    | If the option is enabled, a refresh of the OAuth token will be attempted each time the UI Bakery JWT token is refreshed. Default is `false`.                                                                                 |
| UI\_BAKERY\_OAUTH\_SYNC\_ROLES\_ON\_TOKEN\_REFRESH          | When enabled, UI Bakery will synchronize roles on every refresh of the OAuth token. Default is `false`.                                                                                                                      |
| UI\_BAKERY\_OAUTH\_REFRESH\_TOKEN\_ON\_VISIBLE              | If enabled, the token will be refreshed every time the UI Bakery tab becomes active.                                                                                                                                         |
| UI\_BAKERY\_OAUTH\_DISABLE\_MFA                             | Set to `true` to disable UI Bakery MFA for OpenID.                                                                                                                                                                           |
| UI\_BAKERY\_SAML\_ENABLED                                   | Set to `true` to enable SAML authentication.                                                                                                                                                                                 |
| UI\_BAKERY\_SAML\_ENTITY\_ID                                | Global unique name (Entity ID) for SAML Entity. For example `http://adapplicationregistry.onmicrosoft.com/myorganization/myapp`. Required for SAML authentication.                                                           |
| UI\_BAKERY\_SAML\_METADATA\_URL                             | URL to SAML metadata XML. Required for SAML authentication.                                                                                                                                                                  |
| UI\_BAKERY\_SAML\_DISABLE\_MFA                              | Set to `true` to disable UI Bakery MFA for SAML.                                                                                                                                                                             |
| UI\_BAKERY\_SSO\_LOGIN\_AUTO                                | When `true`, the SSO authentication flow starts as soon as a user opens the Sign In or Sign up page. When `false`, a user must explicitly click the `Login with SAML` link.                                                  |
| UI\_BAKERY\_SSO\_NAME\_CLAIM                                | Name of the custom attribute for SSO that will be used for the UI Bakery user name. Default value is `name`.                                                                                                                 |
| UI\_BAKERY\_SSO\_ROLE\_CLAIM                                | Name of the custom attribute for SSO that will be used for UI Bakery role mapping. Default value is `role`.                                                                                                                  |
| UI\_BAKERY\_SSO\_WORKSPACE\_CLAIM                           | Name of the custom attribute for SSO that will be used to assign a user to a particular workspace. See [docs](https://docs.uibakery.io/sso/troubleshooting#allow-custom-emails-to-join-workspace).                           |
| UI\_BAKERY\_SSO\_SYNC\_ROLES                                | Enable roles synchronization from the Identity Server to UI Bakery.                                                                                                                                                          |
| UI\_BAKERY\_SSO\_SYNC\_ROLES\_ON\_LOGIN                     | Enable roles sync on login.                                                                                                                                                                                                  |
| UI\_BAKERY\_SSO\_HARD\_SYNC\_ROLES                          | Rewrite roles on sync.                                                                                                                                                                                                       |
| UI\_BAKERY\_SSO\_SYNC\_ROLES\_FOR\_EDITOR\_AND\_ADMIN       | Sync roles for Admin and Editor roles.                                                                                                                                                                                       |
| UI\_BAKERY\_SSO\_ROLE\_MAPPING                              | Key-pair role mapping where the key is an SSO provider custom claim and the value is the UI Bakery role name, for example, `UI_BAKERY_SSO_ROLE_MAPPING=identityRoleName->bakeryRoleName,identityRoleName2->bakeryRoleName2`. |
| UI\_BAKERY\_SSO\_SYNC\_ROLES\_BY\_NAME                      | The default value is `true`. Can be set to `false` to sync roles using only values from the `UI_BAKERY_SSO_ROLE_MAPPING` variable.                                                                                           |
| UI\_BAKERY\_AUTH\_MULTI\_TAB\_LOGOUT                        | If any tab is signed out, then signout from all UI Bakery tabs is initiated.                                                                                                                                                 |
| UI\_BAKERY\_AUTH\_MAX\_FAILED\_LOGIN\_ATTEMPTS              | The maximum number of failed login attempts allowed for a user. This includes failed attempts for both login credentials and MFA challenges, if MFA is enabled.                                                              |
| UI\_BAKERY\_OAUTH2\_LOG\_LEVEL                              | <p>Can be set to <code>DEBUG</code> to enable extra OAUTH logs in <code>bakery-back</code> container.<br><mark style="color:$warning;">Be cautious, as this setting reveals user tokens.</mark></p>                          |
| UI\_BAKERY\_SSO\_BROADCAST\_TOKEN                           | Can be set to `true` to provide OAUTH access\_token in the UI Bakery `{{user.token}}` variable.                                                                                                                              |
| UI\_BAKERY\_JWT\_ACCESS\_TOKEN\_EXPIRATION                  | Defines UI Bakery access token lifetime in ms. Default value is `3600000` (10 minutes).                                                                                                                                      |
| UI\_BAKERY\_JWT\_REFRESH\_TOKEN\_EXPIRATION                 | Defines the UI Bakery refresh token's lifetime in milliseconds. The default value is `2592000000` (30 days). After this period of inactivity, users will be logged out of UI Bakery.                                         |
| UI\_BAKERY\_PASSWORD\_MIN\_LENGTH                           | Minimum password length. Default is `8`.                                                                                                                                                                                     |
| UI\_BAKERY\_PASSWORD\_DISALLOW\_EMAIL                       | If `true`, disallow passwords that contain the user’s email. Default is `false`.                                                                                                                                             |
| UI\_BAKERY\_PASSWORD\_MAX\_HISTORY\_SIZE                    | Number of previous passwords that cannot be reused. Default is `0` (disabled).                                                                                                                                               |
| UI\_BAKERY\_PASSWORD\_CHANGE\_FREQUENCY\_LIMIT              | Minimum interval between password changes. Duration format (e.g. 24h, 180d). Default is `0s` (disabled).                                                                                                                     |
| UI\_BAKERY\_PASSWORD\_MAX\_AGE                              | Maximum password age. After this period the user must change the password. Duration format (e.g. 24h, 180d). Default is `0s` (disabled).                                                                                     |

## Multi-factor authentication

| Environment variable name                      | Description                                                                             |
| ---------------------------------------------- | --------------------------------------------------------------------------------------- |
| UI\_BAKERY\_MFA\_SECRET                        | **Required.** Used for encryption of cookies and secrets. Should be 32 characters long. |
| UI\_BAKERY\_OTP\_SERVICE\_NAME                 | Service name that will be used in the QR code. Default is "`UI Bakery`".                |
| UI\_BAKERY\_OTP\_ALGORITHM                     | Algorithm used for generating codes. Default is "`SHA1`".                               |
| UI\_BAKERY\_OTP\_PERIOD\_SECONDS               | Code rotation period. Default is `30`.                                                  |
| UI\_BAKERY\_MFA\_REMEMBER\_SECONDS             | Defines the lifetime for the remember device cookie. Default is `2592000` (30 days).    |
| UI\_BAKERY\_MFA\_ALLOWED\_AUTHENTICATORS\_TEXT | Multifactor setup/enter screens - list of available authenticators.                     |
| UI\_BAKERY\_MFA\_SETUP\_TEXT                   | Multifactor setup/enter screens - details on how to set up MFA.                         |

## User sessions

<table><thead><tr><th width="384.58984375">Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_AUTH_DEVICE_INFO_SECRET</td><td>Used for the encryption of device info.</td></tr><tr><td>UI_BAKERY_AUTH_DISABLE_USER_SESSION_VALIDATION</td><td>Disables user session tokens validation in the database. Checks only the user's JWT token.</td></tr><tr><td>UI_BAKERY_USER_SESSION_CLEANUP_CRON</td><td>A CRON job removing invalid tokens. Default is <code>0 0 2 * * *</code> each day at 2 a.m.</td></tr><tr><td>UI_BAKERY_USER_SESSION_CLEANUP_BATCH_SIZE</td><td>The maximum number of records deleted by the CRON job in one batch. Default is <code>500</code>.</td></tr><tr><td>UI_BAKERY_USER_SESSION_CLEANUP_MAX_ITEMS_PER_JOB</td><td>The maximum number of items deleted by the CRON job in one batch. Default is <code>50000</code>.<br>This value takes precedence over the value of<code>UI_BAKERY_USER_SESSION_CLEANUP_BATCH_SIZE</code></td></tr><tr><td>UI_BAKERY_AUTH_REFRESH_TOKEN_GRACE_PERIOD_SECONDS</td><td>The duration for which the recalled refresh token is considered valid. Default is <code>10 seconds</code>.</td></tr></tbody></table>

## Branding

<table><thead><tr><th>Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_APP_TITLE</td><td>HTML <code>&#x3C;title/></code> tag content. Default value is <code>UI Bakery</code>.</td></tr><tr><td>UI_BAKERY_GTM</td><td>Arbitary HTML that will be added after the open <code>&#x3C;body></code> tag. Can be used to provide custom styles or scripts <code>&#x3C;style>.header-container { background-color: aquamarine!important; }&#x3C;/style> &#x3C;script type="text/javascript" src="http://expansionscollective.com/testscripts/jquery.fullPage.js">&#x3C;/script></code></td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_BACKGROUND_URL</td><td>URL to image. Allows you to set custom background image for auth screen.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_CARD_STYLES</td><td>CSS styles for card on auth screens. <code>background: transparent; box-shadow: none;</code>.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_HEADER_STYLES</td><td>CSS styles for card headers ("Login" and "Signup") on auth screens. <code>font-weight: 600; font-size: 2rem;</code>.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_GOOGLE_BTN_STYLES</td><td>CSS styles for "LOGIN WITH GOOGLE" button on auth screens. <code>background: white; border: none;</code>.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_LOGO_STYLES</td><td>CSS styles for logo on auth screens. <code>margin-bottom: 2rem; width: 100%; height: 2.5rem;</code></td></tr><tr><td>UI_BAKERY_BRANDING_FAVICON</td><td>URL to image. Allows you to set custom favicon.</td></tr><tr><td>UI_BAKERY_BRANDING_LOADER</td><td>Loader image. <code>&#x3C;svg class="loader-logo">&#x3C;/svg></code>, <code>class="loader-logo"</code> is required.</td></tr><tr><td>UI_BAKERY_BRANDING_LOADER_STYLES</td><td>CSS styles for loader. <code>background: #003D4C; transform: scale(2)</code>.</td></tr><tr><td>UI_BAKERY_BRANDING_LOGO_URL</td><td>URL to image. Allows you to replace UI Bakery logo.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_SSO_BTN_TEXT</td><td>Custom text on the SSO button. <code>Login with my SSO</code></td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_SSO_BTN_STYLES</td><td>CSS styles for the SSO button. <code>margin-bottom: 1rem</code></td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_SSO_BTN_ICON</td><td>URL to image. Allows you to place image on the SSO button.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_SSO_BTN_ICON_STYLES</td><td>CSS styles for a image on the SSO button. <code>height: 1rem; width: auto</code></td></tr><tr><td>UI_BAKERY_BRANDING_MENU_LOGO_URL</td><td>URL to image. Allows you to replace UI Bakery logo in top left corner of the workspace.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_FORGOT_PASSWORD_LINK_HIDDEN</td><td><code>true</code> or <code>false</code> - show the reset password link.</td></tr><tr><td>UI_BAKERY_BRANDING_AUTH_SIGN_UP_LINK_HIDDEN</td><td><code>true</code> or <code>false</code> - show the sign up link.</td></tr><tr><td>UI_BAKERY_ONBOARDING_URL</td><td>Link to a "Get a demo" button (builder &#x26; user menu). Set to an empty string to hide the button.</td></tr><tr><td>UI_BAKERY_INTRO_VIDEO_URL</td><td>Link to a "Watch video intro" button (builder &#x26; user menu). Set to an empty string to hide the button.</td></tr><tr><td>UI_BAKERY_CONTACT_EMAIL</td><td>Contact email address (e.g. <code>someone@yourdomain.com</code>).</td></tr><tr><td>UI_BAKERY_TERMS_OF_SERVICE_URL</td><td>Link to "Terms of Service" on the sign-up page.</td></tr><tr><td>UI_BAKERY_PRIVACY_POLICY_URL</td><td>Link to "Privacy Policy" on the sign-up page.</td></tr><tr><td>UI_BAKERY_ROBOTS_TXT</td><td><p>Content for the robots.txt file. By default, it denies any crawling:</p><pre><code>User-agent: *
Disallow: /
</code></pre></td></tr><tr><td>UI_BAKERY_SITEMAP_XML</td><td>Content for the sitemap.xml file. By default, it is empty.</td></tr></tbody></table>

## Mailing

| Environment variable name                             | Description                                                                                                                                                  |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| UI\_BAKERY\_MAILING\_PROVIDER                         | Should be set to `smtp` or `sendgrid` to enable email messages. Default value is `noop`                                                                      |
| UI\_BAKERY\_MAILING\_EMAIL\_FROM                      | Email sender address. Default value is `admin@uibakery.io`.                                                                                                  |
| UI\_BAKERY\_MAILING\_NAME\_FROM                       | Email sender name. Default value is `UI Bakery`.                                                                                                             |
| SENDGRID\_API\_KEY                                    | SendGrid API key. Required if SendGrid is set as a email sender.                                                                                             |
| UI\_BAKERY\_MAILING\_WELCOME\_SUBJECT                 | Subject for welcome email. Default value is `Welcome to UI Bakery workspace`.                                                                                |
| UI\_BAKERY\_MAILING\_WELCOME\_TEMPLATE                | Can be HTML string or SendGrid email template ID. Supported variables: `{{userName}}` and `{{userEmail}}`.                                                   |
| UI\_BAKERY\_MAILING\_WELCOME\_EMAIL\_FROM             | Email sender address for welcome email. The default email sender address is used if not set.                                                                 |
| UI\_BAKERY\_MAILING\_WELCOME\_EMAIL\_FROM\_NAME       | Email sender name for welcome email. The default email sender name is used if not set.                                                                       |
| UI\_BAKERY\_MAILING\_CONFIRM\_EMAIL\_CHANGE\_SUBJECT  | Subject for email change email. Default value is `Change email request`.                                                                                     |
| UI\_BAKERY\_MAILING\_CONFIRM\_EMAIL\_CHANGE\_TEMPLATE | Can be HTML string or SendGrid email template ID. Supported variables: `{{userName}}`, `{{userEmail}}` and `{{changeEmailUrl}}`.                             |
| UI\_BAKERY\_MAILING\_RESET\_PASSWORD\_SUBJECT         | Subject for password reset email. Default value is `Reset password request`.                                                                                 |
| UI\_BAKERY\_MAILING\_RESET\_PASSWORD\_TEMPLATE        | Can be HTML string or SendGrid email template ID. Supported variables: `{{userName}}`, `{{userEmail}}` and `{{resetPasswordUrl}}`.                           |
| UI\_BAKERY\_MAILING\_SHARE\_WITH\_USER\_SUBJECT       | Subject for inviting user email. Default value is `You are invited to UI Bakery workspace`.                                                                  |
| UI\_BAKERY\_MAILING\_SHARE\_WITH\_USER\_TEMPLATE      | Can be an HTML string or SendGrid email template ID. Supported variables: `{{userName}}`, `{{userEmail}}`, `{{organizationUrl}}` and `{{organizationName}}`. |
| UI\_BAKERY\_MAILING\_REQUEST\_TO\_JOIN\_SUBJECT       | Subject for the request to join email. Default value is `User would like to join your organization`.                                                         |
| UI\_BAKERY\_MAILING\_REQUEST\_TO\_JOIN\_TEMPLATE      | Can be an HTML string or SendGrid email template ID. Supported variables: `{{userName}}`, `{{userEmail}}`                                                    |
| UI\_BAKERY\_MAILING\_AUTOMATION\_ERROR\_SUBJECT       | Supported variables: `{{workflowName}}`                                                                                                                      |
| UI\_BAKERY\_MAILING\_AUTOMATION\_ERROR\_TEMPLATE      | Can be an HTML string or SendGrid email template ID. Supported variables: `{{errorMessage}}, {{workflowName}}`                                               |
| UI\_BAKERY\_SMTP\_HOST                                | Host of SMPT server. Required if `smtp` is set as a email provider.                                                                                          |
| UI\_BAKERY\_SMTP\_PORT                                | Password for SMPT server. Required if `smtp` is set as a email provider.                                                                                     |
| UI\_BAKERY\_SMTP\_ENCRYPTION                          | Default value is `tls`                                                                                                                                       |

## Automations

<table><thead><tr><th width="402">Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_RUN_AUTOMATION_IN_SECURE_CONTEXT</td><td>In Automations, the execution of code actions should occur within a secure sandbox environment that does not have access to server APIs. This behavior is set to the default value of true.</td></tr><tr><td>UI_BAKERY_AUTOMATION_TIMEOUT</td><td>The timeout for the automation execution; the default timeout is =90000</td></tr><tr><td>UI_BAKERY_AUTOMATION_CODE_EXECUTION_TIMEOUT</td><td>The default timeout for JS execution in an automation; the default timeout is <code>=30000</code></td></tr><tr><td>UI_BAKERY_INTERNAL_API_URL</td><td>Path to <code>bakery-back</code> container. Default value is <a href="http://bakery-back:8080">http://bakery-back:8080</a></td></tr></tbody></table>

## Audit logs

<table><thead><tr><th width="404.5">Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_AUDIT_LOGS_BUFFER_TIME</td><td>How long to collect logs before logging them</td></tr><tr><td>UI_BAKERY_AUDIT_LOGS_BUFFER_SIZE</td><td>How many logs to collect before logging them</td></tr><tr><td>UI_BAKERY_AUDIT_LOGS_LOG_PAYLOAD</td><td>Store requests payload</td></tr><tr><td>UI_BAKERY_AUDIT_LOGS_DISABLED</td><td>Disables logging of audit logs</td></tr><tr><td>UI_BAKERY_AUDIT_LOGS_ALLOWED_TYPES</td><td>Allow logging of only certain types, comma-separated. Available types: LOG_IN, SIGN_UP, USER_ROLES_ASSIGNED, INVITE_USER, USER_REMOVED, CUSTOM_ROLE_CREATED, CUSTOM_ROLE_UPDATED, CUSTOM_ROLE_REMOVED, SYSTEM_ROLE_UPDATED, NEW_APP, OPEN_APP, DEPLOY_APP, PAGE_VIEW, PROJECT_REMOVED, CONNECT_DATASOURCE, UPDATE_DATASOURCE, DELETE_DATASOURCE, OPEN_BUILDER, EXIT_BUILDER, APP_MODEL_OVERWRITE, APP_HISTORY_SNAPSHOT_RESTORE, ACTION_SUCCESS, ACTION_ERROR, ACTION_REQUEST, AUTOMATION_ERROR, AUTOMATION_SUCCESS, CREATE_DATABASE_TABLE, DELETE_DATABASE_TABLE, DUPLICATE_DATABASE_TABLE, UPDATE_DATABASE_TABLE</td></tr></tbody></table>

## UI Bakery Postgres

<table><thead><tr><th width="404.5">Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_INTERNAL_DATABASE_ENABLED</td><td>Default <code>true</code>. Set to <code>false</code> to disable UI Bakery Postgres on your instance.</td></tr><tr><td>UI_BAKERY_INTERNAL_DATABASE_SERVICE_URL</td><td>API URL for UI Bakery Postgres service communication. Defaults to the Datasource container.`<a href="http://datasource:6060/bakeryDatabase">http://datasource:6060/bakeryDatabase</a>`</td></tr><tr><td>UI_BAKERY_INTERNAL_DATABASE_HOST</td><td>Postgres host</td></tr><tr><td>UI_BAKERY_INTERNAL_DATABASE_PORT</td><td>Postgres port</td></tr><tr><td>UI_BAKERY_INTERNAL_DATABASE_USERNAME</td><td>Database username used for connection</td></tr><tr><td>UI_BAKERY_INTERNAL_DATABASE_PASSWORD</td><td>Database user password</td></tr><tr><td>UI_BAKERY_INTERNAL_DATABASE_DATABASE</td><td>Default database name used for connection</td></tr><tr><td>UI_BAKERY_INTERNAL_DATABASE_SYNC_SIZE_INTERVAL</td><td>To regulate the limitations on UI Bakery Cloud, set the frequency at which the database size is synced with your UI Bakery workspace. Use <code>0</code> to turn off synchronization.</td></tr></tbody></table>

## UI Bakery AI

<table><thead><tr><th width="404.5">Environment variable name</th><th>Description</th></tr></thead><tbody><tr><td>UI_BAKERY_INTERNAL_AI_ENABLED</td><td>Default <code>true</code>. Set to <code>false</code> to disable UI Bakery AI on your instance.</td></tr><tr><td>UI_BAKERY_INTERNAL_AI_DEFAULT_OPENAI_API_KEY</td><td>Default AI data source key. By default, it is not set for on-prem instances.</td></tr></tbody></table>

## Other

| Environment variable name           | Description                                                                                                                                                                                                                                             |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| UI\_BAKERY\_BASE\_PATH              | Default `/`. Can be altered to host UI Bakery under base path - [see docs](https://docs.uibakery.io/on-premise/networking-and-security/custom-base-url).                                                                                                |
| UI\_BAKERY\_WORKBENCH\_URL          | Default `/workbench`                                                                                                                                                                                                                                    |
| UI\_BAKERY\_WORKBENCH\_BASE\_PATH   | Default `/workbench/`                                                                                                                                                                                                                                   |
| UI\_BAKERY\_DATASOURCE\_RATE\_LIMIT | Sets the rate limit for requests to data sources per user. Example values include `2r/s` (2 requests per second) or `120r/m` (120 requests per minute). By default, rate limiting is disabled.                                                          |
| UI\_BAKERY\_AUTH\_RATE\_LIMIT       | Sets the rate limit for requests to auth endpoints (such as login/register/reset-password) per user. By default, rate limiting is disabled.                                                                                                             |
| UI\_BAKERY\_API\_RATE\_LIMIT        | Sets the rate limit for requests to UI Bakery general API (for example: loading apps/themes or workspace settings) per user. By default, rate limiting is disabled.                                                                                     |
| UI\_BAKERY\_RATE\_LIMIT\_VARIABLE   | Specifies the key used for rate limiting, by default set to `$remote_addr` (user's IP address). If a reverse proxy like Cloudflare is in use, adjust this to the appropriate header, such as `$http_cf_connecting_ip`, to correctly identify client IPs |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.uibakery.io/on-premise/environment-variables.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
Environment variable name	Description
UI_BAKERY_LICENSE_KEY	UI Bakery license key. To get your key contact us.
UI_BAKERY_APP_SERVER_NAME	Full domain address where UI Bakery is hosted. For example `https://bakery.mycompany.com`.
UI_BAKERY_PORT	Defines the port UI Bakery is run on.
UI_BAKERY_SINGLE_ORGANIZATION	When `true`, all attempts to register new workspaces except 1st will fail.
UI_BAKERY_MAINTENANCE_TIME_GMT	Enables maintenance mode notice, format - Wed Sep 28 2022 16:08:13 GMT+0100
UI_BAKERY_MAINTENANCE_NOTICE_PRIOR_HOURS	How many hours prior to maintenance the notice must be shown
UI_BAKERY_EMBEDDED_ENABLE_ACTIONS_EXECUTION	If true, allows calling actions when UI Bakery is embedded in an iframe
UI_BAKERY_ENABLED_FEATURE_FLAGS	Comma-separated list of globally enabled feature flags.
UI_BAKERY_TEMPLATE_MAKER_ACCOUNT_PASSWORD	An account to manage instance app templates. Empty value disables the access (default).
UI_BAKERY_AUTOMATIC_BACKUP_INTERVAL	The interval defines how often UI Bakery has to create automatic backups of your project in milliseconds. Default 15 minutes.
UI_BAKERY_AUTOMATIC_BACKUP_RETENTION	Defines how long UI Bakery should persist automatic backup in milliseconds. Default 1 week.
UI_BAKERY_REQUEST_MAX_SIZE	Max size of the request, 50M by default.
UI_BAKERY_GIT_PR_URL_TEMPLATE	https://bitbucket.company_name.com/projects/{user}/repos/{project}/pull-requests?create&sourceBranch={activeBranch}
UI_BAKERY_LOG_RETENTION	The time to persist audit logs and automation execution logs. Default infinity. Ex: `7d`, `90d`
UI_BAKERY_LOG_RETENTION_BATCH_SIZE	Sets the batch size for log processing during cleanup. Default is 100.
Environment variable name	Description
UI_BAKERY_DATASOURCE_TIMEOUT	Datasource request timeout in milliseconds. Default value is `90000`.
UI_BAKERY_DATASOURCE_MAX_SIZE	Datasource request's maximum response size in bytes. The default value is `50000000` ( approx. 50MB), and the max value is `2147483647` (approx. 2.15GB)
UI_BAKERY_REQUEST_MAX_SIZE	Maximum client request payload size. Default value is `50M`
UI_BAKERY_GSHEET_CLIENT_ID	Google Sheet API Client Id. Must be provided when GSheet datasource is required.
UI_BAKERY_GSHEET_CLIENT_SECRET	Google Sheet API Client Secret. Must be provided when GSheet datasource is required.
UI_BAKERY_SALESFORCE_CLIENT_ID	Salesforce API Client Id. Must be provided when Salesforce datasource is required.
UI_BAKERY_SALESFORCE_CLIENT_SECRET	Salesforce API Client Secret. Must be provided when Salesforce datasource is required.
UI_BAKERY_HTTPS_PROXY_URL	HTTPS Proxy URL to send HTTPS requests from datasource through proxy
UI_BAKERY_SNOWFLAKE_CONFIGURATION	JSON configuration object for the snowflake-sdk
UI_BAKERY_SSH_PUBLIC_KEY	SSH public key for SSH data source configuration
UI_BAKERY_SSH_TUNNEL_USER	SSH user for SSH data source configuration
UI_BAKERY_SSH_TUNNEL_KEY	SSH tunnel key for SSH data source configuration
UI_BAKERY_SSH_TUNNEL_PASSWORD	SSH tunnel password for SSH data source configuration
UI_BAKERY_DATASOURCE_MSSQL_POOL_MAX UI_BAKERY_DATASOURCE_MYSQL_POOL_MAX UI_BAKERY_DATASOURCE_MARIADB_POOL_MAX UI_BAKERY_DATASOURCE_POSTGRES_POOL_MAX UI_BAKERY_DATASOURCE_REDSHIFT_POOL_MAX UI_BAKERY_DATASOURCE_SNOWFLAKE_POOL_MAX	The maximum number of simultaneous requests to the database in a single connection. Type - `number`, default value - `5`.
UI_BAKERY_DATASOURCE_MSSQL_POOL_ACQUIRE UI_BAKERY_DATASOURCE_MYSQL_POOL_ACQUIRE UI_BAKERY_DATASOURCE_MARIADB_POOL_ACQUIRE UI_BAKERY_DATASOURCE_POSTGRES_POOL_ACQUIRE UI_BAKERY_DATASOURCE_REDSHIFT_POOL_ACQUIRE UI_BAKERY_DATASOURCE_SNOWFLAKE_POOL_ACQUIRE	The maximum wait time, in milliseconds, for acquiring a free connection when all connections are in use. Type - `number`, default value - `90000ms` (90 sec).
Environment variable name	Description
UI_BAKERY_AUTH_DEVICE_INFO_SECRET	Used for the encryption of device info.
UI_BAKERY_AUTH_DISABLE_USER_SESSION_VALIDATION	Disables user session tokens validation in the database. Checks only the user's JWT token.
UI_BAKERY_USER_SESSION_CLEANUP_CRON	A CRON job removing invalid tokens. Default is `0 0 2 * * *` each day at 2 a.m.
UI_BAKERY_USER_SESSION_CLEANUP_BATCH_SIZE	The maximum number of records deleted by the CRON job in one batch. Default is `500`.
UI_BAKERY_USER_SESSION_CLEANUP_MAX_ITEMS_PER_JOB	The maximum number of items deleted by the CRON job in one batch. Default is `50000`. This value takes precedence over the value of`UI_BAKERY_USER_SESSION_CLEANUP_BATCH_SIZE`
UI_BAKERY_AUTH_REFRESH_TOKEN_GRACE_PERIOD_SECONDS	The duration for which the recalled refresh token is considered valid. Default is `10 seconds`.
Environment variable name	Description
UI_BAKERY_APP_TITLE	HTML `<title/>` tag content. Default value is `UI Bakery`.
UI_BAKERY_GTM	Arbitary HTML that will be added after the open `<body>` tag. Can be used to provide custom styles or scripts `<style>.header-container { background-color: aquamarine!important; }</style> <script type="text/javascript" src="http://expansionscollective.com/testscripts/jquery.fullPage.js"></script>`
UI_BAKERY_BRANDING_AUTH_BACKGROUND_URL	URL to image. Allows you to set custom background image for auth screen.
UI_BAKERY_BRANDING_AUTH_CARD_STYLES	CSS styles for card on auth screens. `background: transparent; box-shadow: none;`.
UI_BAKERY_BRANDING_AUTH_HEADER_STYLES	CSS styles for card headers ("Login" and "Signup") on auth screens. `font-weight: 600; font-size: 2rem;`.
UI_BAKERY_BRANDING_AUTH_GOOGLE_BTN_STYLES	CSS styles for "LOGIN WITH GOOGLE" button on auth screens. `background: white; border: none;`.
UI_BAKERY_BRANDING_AUTH_LOGO_STYLES	CSS styles for logo on auth screens. `margin-bottom: 2rem; width: 100%; height: 2.5rem;`
UI_BAKERY_BRANDING_FAVICON	URL to image. Allows you to set custom favicon.
UI_BAKERY_BRANDING_LOADER	Loader image. `<svg class="loader-logo"></svg>`, `class="loader-logo"` is required.
UI_BAKERY_BRANDING_LOADER_STYLES	CSS styles for loader. `background: #003D4C; transform: scale(2)`.
UI_BAKERY_BRANDING_LOGO_URL	URL to image. Allows you to replace UI Bakery logo.
UI_BAKERY_BRANDING_AUTH_SSO_BTN_TEXT	Custom text on the SSO button. `Login with my SSO`
UI_BAKERY_BRANDING_AUTH_SSO_BTN_STYLES	CSS styles for the SSO button. `margin-bottom: 1rem`
UI_BAKERY_BRANDING_AUTH_SSO_BTN_ICON	URL to image. Allows you to place image on the SSO button.
UI_BAKERY_BRANDING_AUTH_SSO_BTN_ICON_STYLES	CSS styles for a image on the SSO button. `height: 1rem; width: auto`
UI_BAKERY_BRANDING_MENU_LOGO_URL	URL to image. Allows you to replace UI Bakery logo in top left corner of the workspace.
UI_BAKERY_BRANDING_AUTH_FORGOT_PASSWORD_LINK_HIDDEN	`true` or `false` - show the reset password link.
UI_BAKERY_BRANDING_AUTH_SIGN_UP_LINK_HIDDEN	`true` or `false` - show the sign up link.
UI_BAKERY_ONBOARDING_URL	Link to a "Get a demo" button (builder & user menu). Set to an empty string to hide the button.
UI_BAKERY_INTRO_VIDEO_URL	Link to a "Watch video intro" button (builder & user menu). Set to an empty string to hide the button.
UI_BAKERY_CONTACT_EMAIL	Contact email address (e.g. `someone@yourdomain.com`).
UI_BAKERY_TERMS_OF_SERVICE_URL	Link to "Terms of Service" on the sign-up page.
UI_BAKERY_PRIVACY_POLICY_URL	Link to "Privacy Policy" on the sign-up page.
UI_BAKERY_ROBOTS_TXT	Content for the robots.txt file. By default, it denies any crawling: `User-agent: * Disallow: /`
UI_BAKERY_SITEMAP_XML	Content for the sitemap.xml file. By default, it is empty.
Environment variable name	Description
UI_BAKERY_RUN_AUTOMATION_IN_SECURE_CONTEXT	In Automations, the execution of code actions should occur within a secure sandbox environment that does not have access to server APIs. This behavior is set to the default value of true.
UI_BAKERY_AUTOMATION_TIMEOUT	The timeout for the automation execution; the default timeout is =90000
UI_BAKERY_AUTOMATION_CODE_EXECUTION_TIMEOUT	The default timeout for JS execution in an automation; the default timeout is `=30000`
UI_BAKERY_INTERNAL_API_URL	Path to `bakery-back` container. Default value is http://bakery-back:8080
Environment variable name	Description
UI_BAKERY_AUDIT_LOGS_BUFFER_TIME	How long to collect logs before logging them
UI_BAKERY_AUDIT_LOGS_BUFFER_SIZE	How many logs to collect before logging them
UI_BAKERY_AUDIT_LOGS_LOG_PAYLOAD	Store requests payload
UI_BAKERY_AUDIT_LOGS_DISABLED	Disables logging of audit logs
UI_BAKERY_AUDIT_LOGS_ALLOWED_TYPES	Allow logging of only certain types, comma-separated. Available types: LOG_IN, SIGN_UP, USER_ROLES_ASSIGNED, INVITE_USER, USER_REMOVED, CUSTOM_ROLE_CREATED, CUSTOM_ROLE_UPDATED, CUSTOM_ROLE_REMOVED, SYSTEM_ROLE_UPDATED, NEW_APP, OPEN_APP, DEPLOY_APP, PAGE_VIEW, PROJECT_REMOVED, CONNECT_DATASOURCE, UPDATE_DATASOURCE, DELETE_DATASOURCE, OPEN_BUILDER, EXIT_BUILDER, APP_MODEL_OVERWRITE, APP_HISTORY_SNAPSHOT_RESTORE, ACTION_SUCCESS, ACTION_ERROR, ACTION_REQUEST, AUTOMATION_ERROR, AUTOMATION_SUCCESS, CREATE_DATABASE_TABLE, DELETE_DATABASE_TABLE, DUPLICATE_DATABASE_TABLE, UPDATE_DATABASE_TABLE
Environment variable name	Description
UI_BAKERY_INTERNAL_DATABASE_ENABLED	Default `true`. Set to `false` to disable UI Bakery Postgres on your instance.
UI_BAKERY_INTERNAL_DATABASE_SERVICE_URL	API URL for UI Bakery Postgres service communication. Defaults to the Datasource container.`http://datasource:6060/bakeryDatabase`
UI_BAKERY_INTERNAL_DATABASE_HOST	Postgres host
UI_BAKERY_INTERNAL_DATABASE_PORT	Postgres port
UI_BAKERY_INTERNAL_DATABASE_USERNAME	Database username used for connection
UI_BAKERY_INTERNAL_DATABASE_PASSWORD	Database user password
UI_BAKERY_INTERNAL_DATABASE_DATABASE	Default database name used for connection
UI_BAKERY_INTERNAL_DATABASE_SYNC_SIZE_INTERVAL	To regulate the limitations on UI Bakery Cloud, set the frequency at which the database size is synced with your UI Bakery workspace. Use `0` to turn off synchronization.
Environment variable name	Description
UI_BAKERY_INTERNAL_AI_ENABLED	Default `true`. Set to `false` to disable UI Bakery AI on your instance.
UI_BAKERY_INTERNAL_AI_DEFAULT_OPENAI_API_KEY	Default AI data source key. By default, it is not set for on-prem instances.