Environment Variables

Complete reference for configuring Mission Control via environment variables

Mission Control is configured entirely through environment variables. Copy .env.example to .env.local (development) or .env (production) and customize as needed.

Authentication

AUTH_USER · string · default: "admin" · required

Admin username seeded on first run (only if no users exist in the database).

AUTH_PASS · string · required

Admin password for the initial user.

If your password contains #, you must either:

• Quote the value: AUTH_PASS="my#password"
• Use base64 encoding via AUTH_PASS_B64 instead

AUTH_PASS_B64 · string

Base64-encoded admin password. Overrides AUTH_PASS if set.

Generate with:

echo -n 'my#password' | base64

API_KEY · string · required

API key for headless/external access. Send via x-api-key header for programmatic access.

Generate a secure random key:

openssl rand -hex 32

AUTH_SECRET · string · default: "random-secret-for-legacy-cookies"

Secret for legacy cookie authentication (backward compatibility).

Session & Cookie Security

MC_COOKIE_SECURE · boolean

Enable secure cookies (HTTPS-only). Defaults to true in production unless overridden.

Always enable this in production when serving over HTTPS.

MC_COOKIE_SAMESITE · string · default: "strict"

SameSite cookie attribute. Valid values: strict, lax, none.

Network Access Control

Mission Control implements host-based access control to prevent unauthorized access.

MC_ALLOW_ANY_HOST · boolean · default: "false"

Bypass host restrictions and allow any host to access the application.

Production: Access is blocked by default unless the host is explicitly allowed via MC_ALLOWED_HOSTS.

Development: All hosts are allowed by default (NODE_ENV !== 'production').

MC_ALLOWED_HOSTS · string · default: "localhost,127.0.0.1"

Comma-separated list of allowed hostnames or patterns.

Supported patterns:

• Exact hosts: app.example.com
• Subdomains: *.example.com (matches a.example.com but not bare example.com)
• Prefix wildcard: 100.* (useful for Tailscale IPs like 100.64.0.1)

Example:

MC_ALLOWED_HOSTS=localhost,127.0.0.1,app.example.com,*.internal.example.com,100.*

Google OAuth Integration

GOOGLE_CLIENT_ID · string

Server-side Google OAuth client ID for Sign-In approval workflow.

Create in Google Cloud Console as a Web application and configure authorized origins/redirect URIs.

NEXT_PUBLIC_GOOGLE_CLIENT_ID · string

Client-side Google OAuth client ID (exposed to browser).

OpenClaw Gateway

OPENCLAW_HOME · string

Path to .openclaw home directory. Required for memory browser, gateway config, and logs.

Example: /home/user/.openclaw

OPENCLAW_CONFIG_PATH · string

Explicitly point to openclaw.json instead of deriving from OPENCLAW_HOME.

OPENCLAW_GATEWAY_HOST · string · default: "127.0.0.1"

Gateway host for server-side connections.

OPENCLAW_GATEWAY_PORT · number · default: "18789"

Gateway port for server-side connections.

OPENCLAW_GATEWAY_TOKEN · string

Authentication token for server-side gateway calls (optional).

Frontend Gateway Configuration

These variables are prefixed with NEXT_PUBLIC_ and are exposed to the browser.

NEXT_PUBLIC_GATEWAY_HOST · string

Gateway hostname for browser WebSocket connections.

NEXT_PUBLIC_GATEWAY_PORT · number · default: "18789"

Gateway port for browser WebSocket connections.

NEXT_PUBLIC_GATEWAY_PROTOCOL · string

WebSocket protocol: ws or wss. Defaults based on page protocol.

NEXT_PUBLIC_GATEWAY_URL · string

Complete gateway WebSocket URL. Overrides individual host/port/protocol settings.

NEXT_PUBLIC_GATEWAY_TOKEN · string

Client-side gateway authentication token (if required by gateway).

Coordinator Identity

MC_COORDINATOR_AGENT · string · default: "coordinator"

Server-side coordinator agent identifier for chat status replies.

NEXT_PUBLIC_COORDINATOR_AGENT · string · default: "coordinator"

Client-side coordinator agent identifier for UI.

Gateway Defaults

MC_DEFAULT_GATEWAY_NAME · string · default: "primary"

Default gateway name used for /api/gateways seeding if database is empty.

Data Paths

All paths default to .data/ in the project root if not specified.

MISSION_CONTROL_DATA_DIR · string · default: ".data"

Root directory for all Mission Control data files.

MISSION_CONTROL_DB_PATH · string · default: ".data/mission-control.db"

SQLite database file path.

MISSION_CONTROL_TOKENS_PATH · string · default: ".data/mission-control-tokens.json"

Token storage file path.

OpenClaw Paths

These paths are derived from OPENCLAW_HOME if not explicitly set.

OPENCLAW_LOG_DIR · string

Directory containing OpenClaw logs.

Default: {OPENCLAW_HOME}/logs

OPENCLAW_MEMORY_DIR · string

Directory containing agent memory files.

OpenClaw does NOT store agent memory markdown files under OPENCLAW_HOME/memory/ by default.

Agent memory lives in each agent’s workspace (e.g., ~/clawd-agents/{agent}/memory/).

Point this at your agents root to make the Memory Browser useful:

OPENCLAW_MEMORY_DIR=/home/you/clawd-agents

OPENCLAW_SOUL_TEMPLATES_DIR · string

Directory containing soul templates.

Default: {OPENCLAW_HOME}/templates/souls

OPENCLAW_BIN · string · default: "openclaw"

OpenClaw CLI binary name or path.

1Password Integration

OP_VAULT_NAME · string · default: "default"

Vault name for 1Password CLI pulls (used by Integrations panel).

Super Admin / Provisioning

These variables are only required if using super-admin provisioning helpers.

MISSION_CONTROL_REPO_ROOT · string

Path to the Mission Control repository root.

MC_SUPER_TEMPLATE_OPENCLAW_JSON · string

Path to template openclaw.json used to seed new tenant state (required for tenant bootstrap).

MC_TENANT_HOME_ROOT · string · default: "/home"

Base path for provisioned Linux user homes.

MC_TENANT_WORKSPACE_DIRNAME · string · default: "workspace"

Workspace directory name under each tenant user home.

Data Retention

All retention periods are in days. Set to 0 to keep data forever.

MC_RETAIN_ACTIVITIES_DAYS · number · default: "90"

Activity log retention period.

MC_RETAIN_AUDIT_DAYS · number · default: "365"

Audit log retention period.

MC_RETAIN_LOGS_DAYS · number · default: "30"

Application log retention period.

MC_RETAIN_NOTIFICATIONS_DAYS · number · default: "60"

Notification retention period.

MC_RETAIN_PIPELINE_RUNS_DAYS · number · default: "90"

Pipeline run history retention period.

MC_RETAIN_TOKEN_USAGE_DAYS · number · default: "90"

Token usage statistics retention period.

Server Configuration

PORT · number · default: "3005 (direct) / 3000 (Docker)"

HTTP server port.

Example:

PORT=8080 pnpm start

HOSTNAME · string · default: "0.0.0.0"

Bind address for the HTTP server. Set in Dockerfile for containerized deployments.

NODE_ENV · string · default: "development"

Node.js environment. Set to production for production deployments.

Production mode enables:

• Default-deny host access control
• Secure cookies by default
• Security headers (X-Frame-Options, CSP, etc.)