Configuration reference

EntityFlow is configured entirely by environment variables. Boolean variables accept 1, true, yes, or on (case-insensitive); anything else is treated as false.

Deployment & licence

Variable	Default	Purpose
EF_DEPLOYMENT	self-host	Deployment mode: saas or self-host.
EF_LICENSE_KEY	—	Signed offline licence key unlocking self-hosted add-ons. SYILAB issues it; copy it from Licences in your EntityFlow Hub.
EF_LICENSE_CHECKIN_ENABLED	false	Enable optional online licence check-in.

EntityFlow Hub

Variable	Default	Purpose
EF_HUB_URL	https://hub.entityflow.dev	Where the account menu (Manage account) and upgrade prompts send people — your EntityFlow Hub.
EF_OFFICE_KEY	—	Optional, 24+ characters. Enables the platform API that EntityFlow Office and EntityFlow Hub use to administer this instance. Unset, that API does not exist (it answers 404).

Database

Variable	Default	Purpose
EF_DIAGRAM_DB_URL	— (required)	Connection string for the diagram plane.
DATABASE_URL	—	Alias for EF_DIAGRAM_DB_URL.
EF_CONTROL_DB_URL	—	PostgreSQL control plane; required when the diagram DB is not Postgres.
EF_DB_POOL_MAX	10	Maximum database pool connections.
EF_DB_MIGRATE_ON_BOOT	true	Run migrations automatically on startup.

Network

Variable	Default	Purpose
EF_PORT	8787	HTTP port (tRPC + REST).
EF_WS_PORT	8788	Hocuspocus websocket port.
EF_AUTH_BASE_URL	http://localhost:8787	Public base URL used for auth callbacks.
EF_WEB_ORIGIN	http://localhost:5173	Allowed web origin (CORS).

Auth & tenancy

Variable	Default	Purpose
EF_AUTH_SECRET	—	Required in production; 32+ character session secret.
EF_AUTH_RP_ID	localhost	Relying-party ID for passkeys/WebAuthn.
EF_PG_RLS	false	Enable PostgreSQL row-level security.

Email

Sign-in is passwordless: EntityFlow emails a one-time code to whoever signs in. A self-hosted instance therefore needs an email transport before people can sign in.

Variable	Default	Purpose
EF_MAIL_PROVIDER	—	smtp, resend, mailjet or log. When unset, the first configured transport is used.
EF_MAIL_FROM	—	Sender address.
EF_MAIL_FROM_NAME	—	Sender display name.
EF_SMTP_HOST	—	SMTP server host.
EF_SMTP_PORT	587	SMTP server port.
EF_SMTP_USER	—	SMTP user name.
EF_SMTP_PASSWORD	—	SMTP password.
EF_SMTP_SECURE	false	true for implicit TLS (port 465); otherwise STARTTLS is used.
EF_RESEND_API_KEY	—	Resend API key.
EF_MAILJET_API_KEY	—	Mailjet API key.
EF_MAILJET_SECRET_KEY	—	Mailjet secret key.

export EF_MAIL_PROVIDER=smtp
export EF_MAIL_FROM="entityflow@acme.com"
export EF_MAIL_FROM_NAME="EntityFlow"
export EF_SMTP_HOST="smtp.acme.com"
export EF_SMTP_PORT=587
export EF_SMTP_USER="entityflow"
export EF_SMTP_PASSWORD="<smtp-password>"

:::info A saved configuration wins An email configuration saved in the database (by EntityFlow Office) takes precedence over these variables. :::

:::warning log is for development only With EF_MAIL_PROVIDER=log, nothing is sent: emails — sign-in codes included — are written to the server log. Use it only on a development machine. :::

Realtime

Variable	Default	Purpose
EF_COLLAB_DEBOUNCE_MS	2000	Debounce window for persisting CRDT updates.
EF_COLLAB_MAX_DEBOUNCE_MS	10000	Maximum debounce before a forced flush.
EF_COLLAB_ALLOW_ANONYMOUS	false	Allow unauthenticated collaboration (demo only).
EF_REALTIME_REDIS_ENABLED	false	Enable Redis fan-out for multi-node.
EF_REALTIME_REDIS_URL	—	Redis connection string.
EF_REALTIME_REDIS_PREFIX	ef	Key prefix for Redis channels.

Observability

Variable	Default	Purpose
EF_OTEL_ENABLED	false	Enable OpenTelemetry tracing.
EF_OTEL_EXPORTER_OTLP_ENDPOINT	—	OTLP collector endpoint.
EF_OTEL_SERVICE_NAME	ef-server	Service name reported in traces.
EF_SENTRY_DSN	—	Sentry DSN for error reporting.
EF_LOG_LEVEL	info	Log level (fatal–trace, or silent).

Lifecycle & webhooks

Variable	Default	Purpose
EF_TRIAL_DAYS	14	Trial length in days.
EF_RETENTION_DAYS	30	Retention window for soft-deleted data.
EF_SUSPENDED_READONLY	true	Suspended tenants become read-only rather than blocked.
EF_WEBHOOK_ALLOW_HTTP	false	Allow plaintext HTTP webhook targets.

Importer

Variable	Default	Purpose
EF_DB_CONNECT_BLOCK_PRIVATE	false	Block connecting the importer to private/loopback hosts.
EF_CONNECTION_ENC_KEY	—	Base64 AES-256 key enabling the remembered-connection vault.

warning

In production, EF_AUTH_SECRET must be set, and an email transport must be configured so that people can sign in.

See Bring your own database and Bring your own identity provider for engine- and auth-specific setup.