General environment variables
Reference documentation for general environment variables.
| Self-hosted Retool Availability | |||
|---|---|---|---|
| Self-hosted Edge | Generally Available | ||
| Self-hosted Stable | Generally Available | ||
Self-hosted Retool is available on an Enterprise plan only.
General environment variables available for use with Self-hosted Retool deployments.
Only configure environment variables when needed. You can configure many environment variables from your organization's Settings rather than directly editing your deployment's configuration file.
You must restart your instance after setting any variables for them to take effect.
ADMIN_API_ACCESS_TOKEN
If non-empty, Retool creates an API access token with the provided string value. Requires ADMIN_USER_EMAIL to be set to a valid email address of an admin user.
| Type | string |
| Format | Authentication Key |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
ADMIN_API_ACCESS_TOKEN=api-key
ADMIN_API_ACCESS_TOKEN_SCOPES
Comma-separated list of scopes to be assigned to the API access token created using ADMIN_API_ACCESS_TOKEN environment variable.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
ADMIN_API_ACCESS_TOKEN_SCOPES=source_control:read,source_control:write,groups:read,groups:write,spaces:read,spaces:write,folders:read,folders:write,permissions:all:read,permissions:all:write
ADMIN_USER_EMAIL
If non-empty, Retool creates an admin user with the provided email in the Admin Space.
| Type | string |
| Format | Email Address |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
ADMIN_USER_EMAIL=admin@example.com
ALLOW_SAME_ORIGIN_OPTION
Whether to use allow-same-origin for iframes and custom components. If this is not true, custom components are heavily restricted in their behavior. Refer to the configure same-origin and sandbox guide to learn more.
| Type | boolean |
| Format | True/False |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
ALLOW_SAME_ORIGIN_OPTION=false
API_CALLS_PER_MINUTE
Retool API uses a point system for rate limiting where endpoint requests cost a certain number of points. The default is 300 points in a 60 second window. If you exceed this, Retool blocks any subsequent API calls for 60 seconds. You can increase the number of points with the API_CALLS_PER_MIN environment variable.
| Type | number |
| Format | Integer |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | 300 |
Examples
API_CALLS_PER_MINUTE=300
BASE_DOMAIN
The full URL of your Retool deployment for user invitations and password resets. This also needs to be set if you dynamically set callback URLs on protected resources.
| Type | string |
| Format | URL |
| Configurability | Update the deployment's configuration file. |
| Required | Required |
| Default | null |
Examples
BASE_DOMAIN=https://retool.example.com
CREATE_FIRST_ORG
If set to true, Retool automatically creates the first organization on the instance. This is useful for automated provisioning of Retool instances.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
CREATE_FIRST_ORG=true
CUSTOM_RETOOL_SANDBOX_RESTRICTIONS
The JavaScript sandbox restrictions to allow. Specify space-separated values for multiple restrictions. Only configure custom sandbox restrictions if you are comfortable with the security implications.
| Type | string |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
CUSTOM_RETOOL_SANDBOX_RESTRICTIONS=allow-downloads
DEBUG
Whether to enable verbose logging for debugging purposes.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
DEBUG=true
DISABLE_IMAGE_PROXY
Whether to disable the proxy used for publicly embedded apps.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
DISABLE_IMAGE_PROXY=true
DISABLE_INTERCOM
Disable Retool's support widget in the frontend. Refer to the Retool Support page to learn how to contact Retool.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
DISABLE_INTERCOM=true
DISABLE_MEMORY_AND_CPU_USAGE_LOGGING
Whether to disable logging of memory and CPU usage.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
DISABLE_MEMORY_AND_CPU_USAGE_LOGGING=true
DISABLE_PUBLIC_PAGES
Whether to disable public access to Retool apps. If set to true, also set DISABLE_IMAGE_PROXY to true to fully disable public access.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
DISABLE_PUBLIC_PAGES=true
DOMAINS
The domains to use for EntityID in SAML requests and obtaining SSL certificates when setting up HTTPS.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
DOMAINS=retool.your-domain.com -> http://api:3000
HIDE_PROD_AND_STAGING_TOGGLES
Whether to hide the Production and Staging toggles in the Retool interface.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
HIDE_PROD_AND_STAGING_TOGGLES=true
HOST_HEADER_NAME
Retool backend expects Host header to contain the host used in the original request. This is important for Spaces to work properly. If your self-hosted instance has a proxy or load-balancer in front of the Retool backend, you can specify a different header that contains the original host.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | HOST_HEADER_NAME |
Examples
HOST_HEADER_NAME=x-forwarded-host
HTML_ESCAPE_RETOOL_EXPRESSIONS
Whether to escape HTML in `` expressions. If set to true, all HTML in expressions is escaped.
| Type | boolean |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
HTML_ESCAPE_RETOOL_EXPRESSIONS=true
HTTP_PROXY
The HTTP proxy to use for all HTTP requests.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
HTTP_PROXY=http://proxy.example.com:8080
LICENSE_KEY
The license key for your Retool deployment. This is required for Retool to validate that your instance is properly licensed.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
LICENSE_KEY=key_1234567890
MULTIPLAYER_SERVER_PORT
The port on which to run the multiplayer server. Configure to match your proxy settings.
| Type | string |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
MULTIPLAYER_SERVER_PORT=3009
NO_PROXY
A comma-separated list of hosts that should not be proxied.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
NO_PROXY=localhost,*.service.company
NODE_TLS_REJECT_UNAUTHORIZED
Whether to reject unauthorized TLS certificates. This setting is insecure and not recommended for production instances
| Type | boolean |
| Format | True/False |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | false |
Examples
NODE_TLS_REJECT_UNAUTHORIZED=false
NUM_WORKERS
The number of worker threads for the api container. The default value is Math.min(Math.max(1, numCPUs), 3), where numCPUs is the number of logical CPU cores on the machine determined by Node.js.
| Type | number |
| Format | Integer |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | 0 |
Examples
NUM_WORKERS=4
RETOOL_ENVIRONMENT
The environment for SCIM provisioning and Source Control alerts.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | production |
Examples
RETOOL_ENVIRONMENT=production
RETOOL_EXPOSED_{NAME}
Use the RETOOL_EXPOSED_ prefix to store secrets that you can use when configuring resources. Only underscores and alphanumeric characters are supported.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
RETOOL_EXPOSED_{NAME}=RETOOL_EXPOSED_DB_USERNAME=db_user
SANDBOX_DOMAIN
The sandbox domain to use.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
SANDBOX_DOMAIN=https://not-your-primary-domain.com
SERVICE_TYPE
Comma-separated list of Retool services to run within a container. If unset, all services run in the same container.
| Type | string |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
SERVICE_TYPE=MAIN_BACKEND,JOBS_RUNNER
SERVICE_TYPE=MULTIPLAYER
USAGE_API_TOKEN
The access token to enable Usage Analytics. Please reach out to your Retool account manager to obtain this token.
| Type | string |
| Format | Plain Text |
| Configurability | Update the deployment's configuration file. |
| Required | Optional |
| Default | null |
Examples
USAGE_API_TOKEN=accessToken