Environment Variables

DAIV provides a large number of environment variables to configure its behavior. This page lists all supported variables.

Variables marked with:

• are sensitive (such as API keys, passwords, and tokens) and should be declared using Docker secrets or a secure credential manager.
• are required and should be declared.

Configuration UI

Many settings listed under Automation: Tools and Automation: Agents can also be managed through the Configuration UI at /dashboard/configuration/. These settings use a three-tier priority chain: environment variable (highest) > database value (set via UI) > hardcoded default (lowest). When a setting is overridden by an environment variable, the corresponding field in the UI is shown as locked. Settings marked env-only are not available in the UI.

Automation: LLM Providers behaves differently: the provider API key variables are read only once to seed the provider records on first run — they do not participate in the runtime override chain (see the note in that section).

---

Core

General

Variable	Description	Default	Example
DJANGO_DEBUG	Toggle Django debug mode	False	True
DJANGO_SECRET_KEY	Secret key for Django	(none)	super-secret-key
DJANGO_ALLOWED_HOSTS	Comma-separated list of allowed hosts	*	example.com,localhost

Danger

Do not turn on DJANGO_DEBUG in production. It will expose sensitive information and break the security of the application.

Info

The DJANGO_ALLOWED_HOSTS variable is used to specify the hosts that are allowed to access the application. Make sure to include the host where the application is running to increase security.

Uvicorn

Variable	Description	Default	Example
UVICORN_HOST	Host to bind the Uvicorn server	0.0.0.0	0.0.0.0
UVICORN_PORT	Port to bind the Uvicorn server	8000	8000

Database

Variable	Description	Default	Example
DB_NAME	Database name	(none)	daiv
DB_USER	Database user	(none)	daiv_admin
DB_PASSWORD	Database password	(none)
DB_HOST	Database host	localhost	db
DB_PORT	Database port	5432	5432
DB_SSLMODE	PostgreSQL SSL mode	require	prefer
DB_POOL_MAX_SIZE	Maximum size of a connection pool	15	30

Redis

Variable	Description	Default	Example
DJANGO_REDIS_URL	Redis connection URL for cache (DB 0)	(none)	redis://redis:6379/0
DJANGO_REDIS_SESSION_URL	Redis connection URL for sessions (DB 1)	Value of DJANGO_REDIS_URL	redis://redis:6379/1
DJANGO_REDIS_CHECKPOINT_URL	Redis connection URL for LangGraph checkpoints (DB 2)	Value of DJANGO_REDIS_URL	redis://redis:6379/2
DJANGO_REDIS_CHECKPOINT_TTL_MINUTES	TTL in minutes for LangGraph checkpoint data	10080 (7 days)	1440

Sentry

Variable	Description	Default	Example
SENTRY_DSN	Sentry DSN	(none)
SENTRY_DEBUG	Enable Sentry debug mode	False	True
SENTRY_ENABLE_LOGS	Enable Sentry logs	False	True
SENTRY_TRACES_SAMPLE_RATE	Sentry traces sample rate	0.0	1.0
SENTRY_PROFILES_SAMPLE_RATE	Sentry profiles sample rate	0.0	1.0
SENTRY_SEND_DEFAULT_PII	Enable Sentry default PII	False	True
NODE_HOSTNAME	Node hostname for Sentry	(none)
SERVICE_NAME	Service name for Sentry	(none)

Note

NODE_HOSTNAME and SERVICE_NAME are used to identify the node and service that is reporting the error.

Logging

Variable	Description	Default	Example
DJANGO_LOGGING_LEVEL	Django logging level	WARNING	DEBUG

Monitoring (LangSmith)

Variable	Description	Default	Example
LANGSMITH_TRACING	Enable LangSmith tracing	false	true
LANGSMITH_PROJECT	LangSmith project name	default	daiv-production
LANGSMITH_API_KEY	LangSmith API key	(none)	lsv2_pt_...
LANGSMITH_ENDPOINT	LangSmith API endpoint	https://api.smith.langchain.com	https://eu.api.smith.langchain.com

Note

LangSmith variables can also use LANGCHAIN_ prefix (e.g., LANGCHAIN_TRACING_V2, LANGCHAIN_API_KEY). The LANGSMITH_API_KEY supports Docker secrets via the _FILE suffix. For setup details, see Monitoring.

Sandbox (client-side)

Variable	Description	Default	Example
DAIV_SANDBOX_URL	URL of the sandbox service	http://sandbox:8000	http://sandbox:8000
DAIV_SANDBOX_TIMEOUT	Timeout for sandbox requests in seconds	600	600
DAIV_SANDBOX_API_KEY	API key for sandbox requests	(none)	random-api-key
DAIV_SANDBOX_COMMAND_POLICY_DISALLOW	Space-separated list of additional bash command prefixes to block globally (e.g. curl wget)	"" (none)	"curl wget npm publish"
DAIV_SANDBOX_COMMAND_POLICY_ALLOW	Space-separated list of bash command prefixes to globally permit, overriding the default policy	"" (none)	"my-safe-tool"

Info

Check the daiv-sandbox repository for server-side configuration of the sandbox service.

Global policy vs. repository policy

DAIV_SANDBOX_COMMAND_POLICY_DISALLOW and DAIV_SANDBOX_COMMAND_POLICY_ALLOW set global defaults. Per-repository overrides are defined in the .daiv.yml sandbox.command_policy section and are merged at evaluation time. Built-in safety rules (blocking git commit, git push, etc.) cannot be overridden by either mechanism.

Authentication

DAIV uses django-allauth for web authentication. Users are created by admins and sign in via social providers (GitHub, GitLab) or passwordless login-by-code. Social signup is restricted to pre-existing accounts — users must be created by an admin first via the user management interface at /accounts/users/. On a fresh install, the first social login bootstraps the initial admin account, or you can use python manage.py bootstrap_admin <email> to create one via login-by-code (see Deployment).

OAuth credentials can be configured via environment variables (shown below) or through the Configuration page at /dashboard/configuration/ under the Authentication section. The UI also provides an enable OAuth login toggle to turn social login on or off without removing credentials.

Variable	Description	Default	Example
DAIV_AUTH_LOGIN_ENABLED	Enable OAuth login (social provider buttons on login page)	false	true
DAIV_AUTH_SIGNUP_OPEN	Allow anyone authenticating via the configured Git platform to self-create an account. When off, only admin-pre-created users can sign in	false	true
ALLAUTH_CLIENT_ID	OAuth client ID for the configured Git platform	(none)	Iv1.abc123
ALLAUTH_CLIENT_SECRET	OAuth client secret for the configured Git platform	(none)
ALLAUTH_GITLAB_URL	GitLab instance URL (for OAuth redirects to the user's browser)	https://gitlab.com	https://gitlab.example.com
ALLAUTH_GITLAB_SERVER_URL	GitLab server URL (for server-to-server API calls, if different from ALLAUTH_GITLAB_URL)	(none)	http://gitlab:8929
EMAIL_BACKEND	Django email backend for login-by-code emails	django.core.mail.backends.smtp.EmailBackend	django.core.mail.backends.console.EmailBackend
EMAIL_HOST	SMTP server hostname	localhost	smtp.example.com
EMAIL_PORT	SMTP server port	25	587
EMAIL_HOST_USER	SMTP authentication username	(empty)	user@example.com
EMAIL_HOST_PASSWORD	SMTP authentication password	(empty)
EMAIL_USE_TLS	Use TLS for SMTP connection	False	True
DEFAULT_FROM_EMAIL	Sender address for login-by-code emails	noreply@daiv.dev	noreply@example.com

Setting up social providers

GitHub: Create an OAuth App at github.com/settings/developers. Set the callback URL to https://<your-domain>/accounts/github/login/callback/.

GitLab: Create an Application in your GitLab instance under Admin Area → Applications or User Settings → Applications. Set the redirect URI to https://<your-domain>/accounts/gitlab/login/callback/ with the read_user scope.

Note

OAuth login requires all three of: the enable OAuth login toggle turned on, a client ID, and a client secret. If only one credential is set, a warning is logged and the provider button is not shown on the login page. The active provider is determined by the CODEBASE_CLIENT setting (GitHub or GitLab).

Rocket Chat

When enabled, Rocket Chat becomes available as a notification channel that users can opt into for their in-app and run notifications.

Variable	Description	Default	Example
DAIV_ROCKETCHAT_ENABLED	Offer Rocket Chat as a notification channel for users	false	true
DAIV_ROCKETCHAT_URL	Base URL of your Rocket Chat instance	(none)	https://rc.example.com
DAIV_ROCKETCHAT_USER_ID	The bot user's _id, sent as the X-User-Id header	(none)	abc123userid
DAIV_ROCKETCHAT_AUTH_TOKEN	The bot user's auth token, sent as the X-Auth-Token header	(none)

Other

Variable	Description	Default	Example
DAIV_EXTERNAL_URL	External URL of the application.	https://app:8000	https://daiv.example.com
DAIV_ENCRYPTION_KEY	Fernet encryption key for secrets stored in the database. If not set, a key is derived from DJANGO_SECRET_KEY via HKDF.	(derived)

Note

The DAIV_EXTERNAL_URL variable is used to define webhooks on Git platform and as the site domain for authentication emails. Make sure that the URL is accessible from the Git platform.

Note

DAIV_ENCRYPTION_KEY protects API keys and other secrets stored in the configuration database. If you provide a raw Fernet key it is used directly; otherwise the value is treated as a passphrase and a key is derived via HKDF-SHA256. When omitted, the key is derived from DJANGO_SECRET_KEY — changing the Django secret key in that case will make existing encrypted values unreadable.

---

Codebase

General

Variable	Description	Default	Example
CODEBASE_CLIENT	Client to use for codebase operations	gitlab	gitlab, github, or swe
CODEBASE_WEBHOOK_SETUP_CRON	Cron expression for periodic webhook setup (GitLab only)	*/5 * * * *	*/10 * * * *
CODEBASE_REPO_ACCESS_SYNC_CRON	Cron expression for the periodic repository access sync	*/15 * * * *	*/10 * * * *
CODEBASE_REPO_ACCESS_HARD_TTL_HOURS	Hours a repository's synced access data stays trusted before it is denied (fails closed); tracked per repository	24	12

Note

Set CODEBASE_CLIENT to either gitlab, github, or swe depending on which platform you want to use. Only one platform can be active at a time.

The swe client type is designed for SWE-bench style evaluations and clones public OSS repositories to temporary directories without requiring credentials. It uses ephemeral temporary clones per run and does not cache repositories across runs. Repository identifiers should be in the format owner/name (e.g., psf/requests).

Repository access sync

CODEBASE_REPO_ACCESS_SYNC_CRON controls how often DAIV mirrors per-user repository membership from the connected Git platform into the database (one member-list call per repository). Admins are exempt from repository authorization and always have full access. Freshness is tracked per repository: if a repository's sync stops succeeding — e.g. the platform token loses access to it — its access data keeps working on the last known-good data until CODEBASE_REPO_ACCESS_HARD_TTL_HOURS elapses, after which that repository fails closed while others keep syncing normally. See Accounts & Roles for the access model this enforces.

GitLab Integration

Variable	Description	Default	Example
CODEBASE_GITLAB_URL	URL of the GitLab instance	(none)	https://gitlab.com
CODEBASE_GITLAB_AUTH_TOKEN	Authentication token for GitLab	(none)	glpat-xyz
CODEBASE_GITLAB_WEBHOOK_SECRET	Secret token for GitLab webhook validation	(none)	random-webhook-secret

Note

The CODEBASE_GITLAB_AUTH_TOKEN is used to authenticate with the GitLab instance using a personal access token with the api scope.

For git clone/push, DAIV does not embed this PAT in the repository workspace. Instead, it mints a short-lived project access token per repository (write_repository scope, Developer access level, ~48–72h lifetime), limiting what the credential inside the workspace can reach. This requires the PAT user to have at least the Maintainer role on each project and, on GitLab.com, the Premium or Ultimate tier (any tier works on self-managed instances). Each token appears as a daiv-clone bot member on the project — with daily minting and ~3-day lifetimes, expect a few of them at a time; GitLab removes expired bots automatically (on GitLab 17.9+ they are retained for ~30 days first). When a token cannot be created, DAIV logs a warning and falls back to embedding the PAT. The token pushes at Developer level: if branch protection rules match the branches DAIV pushes to (e.g. a wildcard pattern restricting pushes to Maintainers), allow Developers to push on that pattern — otherwise pushes fail. A sandbox session resumed a day or more after it was created may hold an expired clone token — pushes from such a session fail until a fresh session re-clones the repository. Avoid revoking daiv-clone tokens early: DAIV caches the active token for up to 24 hours, so clones keep using the revoked credential (failing with auth errors) until the cache entry (codebase:gitlab:clone-token:<project-id>) expires or is cleared.

GitHub Integration

Variable	Description	Default	Example
CODEBASE_GITHUB_URL	URL of the GitHub instance	(none)	https://github.com
CODEBASE_GITHUB_APP_ID	GitHub App ID	(none)	123456
CODEBASE_GITHUB_INSTALLATION_ID	GitHub App Installation ID	(none)	789012
CODEBASE_GITHUB_PRIVATE_KEY	GitHub App private key (PEM format)	(none)
CODEBASE_GITHUB_WEBHOOK_SECRET	Secret token for GitHub webhook validation	(none)	random-webhook-secret

Note

GitHub uses GitHub App authentication. You must create a GitHub App in your account or organization settings. The private key is a multi-line PEM file that should be stored securely using Docker secrets.

Info

For GitHub Enterprise Server, set CODEBASE_GITHUB_URL to your GitHub Enterprise URL (e.g., https://github.your-company.com). For GitHub.com, this variable can be omitted.

---

Automation: LLM Providers

This section documents the environment variables for each LLM provider.

Note

At least one of the supported providers should be configured to use the automation features.

Provider keys are seed-only

Unlike the rest of the configurable settings on this page, these provider API key variables are not part of the env > database > default override chain. They are read only once — on first run / upgrade — to seed the provider records, after which the authoritative, runtime-editable key and base URL live on the Providers section of the Configuration UI at /dashboard/configuration/. Changing a *_API_KEY environment variable after the provider record exists has no effect; edit the provider in the UI instead. The OpenRouter base URL is likewise a per-provider Base URL field in that section (it defaults to https://openrouter.ai/api/v1).

OpenRouter (default)

Variable	Description	Default	Example
OPENROUTER_API_KEY	OpenRouter API key (seeds the OpenRouter provider record on first run)	(none)

Anthropic

Variable	Description	Default	Example
ANTHROPIC_API_KEY	Anthropic API key (seeds the Anthropic provider record on first run)	(none)

OpenAI

Variable	Description	Default	Example
OPENAI_API_KEY	OpenAI API key (seeds the OpenAI provider record on first run)	(none)

Google

Variable	Description	Default	Example
GOOGLE_API_KEY	Google API key (seeds the Google provider record on first run)	(none)

Automation: Tools

This section documents the environment variables for each tool configuration used by AI agents.

Context File Suggestion

Variable	Description	Default	Example
DAIV_SUGGEST_CONTEXT_FILE_ENABLED	Enable/disable suggesting an AGENTS.md file on new merge requests	true	false

Web Search

Variable	Description	Default	Example
DAIV_WEB_SEARCH_ENABLED	Enable/disable the web_search tool	true	false
DAIV_WEB_SEARCH_MAX_RESULTS	Maximum number of results to return from web search	5
DAIV_WEB_SEARCH_ENGINE	Web search engine to use (duckduckgo, tavily)	duckduckgo	tavily
DAIV_WEB_SEARCH_API_KEY	Web search API key (required if engine is tavily)	(none)

Web Fetch

The native web_fetch tool fetches a URL, converts HTML to markdown, then uses a small/fast model to answer a prompt about the page content.

Variable	Description	Default	Example
DAIV_WEB_FETCH_ENABLED	Enable/disable the native web_fetch tool	true	false
DAIV_WEB_FETCH_MODEL_NAME	Model used by web_fetch to process page content with the prompt	claude-haiku-4.5	openrouter:openai/gpt-4.1-mini
DAIV_WEB_FETCH_CACHE_TTL_SECONDS	Cache TTL (seconds) for repeated fetches	900	1800
DAIV_WEB_FETCH_TIMEOUT_SECONDS	HTTP timeout for fetching (seconds)	15	30
AUTOMATION_WEB_FETCH_PROXY_URL	Optional proxy URL for web fetch HTTP requests (env-only)	(none)	http://proxy:8080
DAIV_WEB_FETCH_MAX_CONTENT_CHARS	Max page content size (characters) to analyze in one pass	50000	80000
DAIV_WEB_FETCH_AUTH_HEADERS	Domain-to-headers mapping for authenticated fetches (JSON, env-only)	{}	{"example.com": {"X-API-Key": "sk-abc"}}

MCP Tools

MCP (Model Context Protocol) tools extend agent capabilities by providing access to external services and specialized functionality. MCP servers are configured as database rows at /dashboard/mcp-servers/ and connected to directly by the DAIV app — no sidecar containers are required.

Variable	Description	Default	Example
MCP_TOOL_LOAD_TIMEOUT	Max seconds to wait for a single MCP server to return its tools before skipping it (keeps a broken/slow server from freezing chats and runs)	30	10

Info

For detailed MCP server configuration including user-defined servers, see MCP Tools.

Deferred Tools (Tool Search)

When enabled, tools outside the always-loaded set are deferred behind a tool_search tool instead of being bound to the model eagerly, keeping the active tool surface small. Most operators do not need to tune these.

Variable	Description	Default	Example
DEFERRED_TOOLS_ENABLED	Defer non-essential tools behind tool_search instead of binding them eagerly	true	false
DEFERRED_TOOLS_TOP_K_DEFAULT	Default number of results returned by a tool_search call	3	5
DEFERRED_TOOLS_TOP_K_MAX	Maximum number of results tool_search will return per call	10	20
DEFERRED_TOOLS_FROZEN_TOOLS_MODELS	Prefix-matched model names whose bound tools array is kept frozen (loaded schemas reach them via tool_search results only), preserving the provider prompt cache. Empty list disables freezing.	claude-,anthropic/claude-,qwen/qwen3.8-max	claude-
DEFERRED_TOOLS_EMBED_SCHEMAS_IN_RESULTS	Embed each loaded tool's full schema in the tool_search result. Emergency valve: when false, results carry summaries only and freezing is forced off (a frozen model has no other way to receive schemas), so every model falls back to the array-append + summary pre-change behaviour.	true	false

---

Automation: Agents

These variables control the models and behavior of DAIV's agents. You can also override models per repository via .daiv.yml — see Repository Config.

DAIV Agent

The main agent used for issue addressing, pull request assistance, and all interactive tasks. Variables use the DAIV_AGENT_ prefix.

Variable	Description	Default
DAIV_AGENT_RECURSION_LIMIT	Maximum recursion depth for agent execution	500
DAIV_AGENT_MODEL_NAME	Primary model for agent tasks	claude-sonnet-4-6
DAIV_AGENT_FALLBACK_MODEL_NAME	Fallback model if the primary model fails	gpt-5-3-codex
DAIV_AGENT_THINKING_LEVEL	Extended thinking level (minimal, low, medium, high, xhigh, or empty to disable)	medium
DAIV_AGENT_FALLBACK_THINKING_LEVEL	Thinking level applied when the primary model fails over to the fallback model (independent of DAIV_AGENT_THINKING_LEVEL)	medium
DAIV_AGENT_MAX_MODEL_NAME	Model used when the daiv-max label is present	claude-opus-4-6
DAIV_AGENT_MAX_THINKING_LEVEL	Thinking level for daiv-max tasks	high
DAIV_AGENT_EXPLORE_MODEL_NAME	Model for the explore subagent (fast, read-only)	claude-haiku-4-5
DAIV_AGENT_EXPLORE_FALLBACK_MODEL_NAME	Fallback model if the explore model fails	gpt-5-4-mini
DAIV_AGENT_CUSTOM_SKILLS_PATH	Path to custom global skills directory. Set to None to disable.	~/data/skills

Jobs API

The Jobs API allows programmatic agent execution.

Variable	Description	Default
DAIV_JOBS_THROTTLE_RATE	Rate limit for job submissions per authenticated user. Format: N/sec, N/min, N/hour, or N/day	20/hour

Diff to Metadata

Generates pull request titles, descriptions, and commit messages from diffs.

Variable	Description	Default
DAIV_DIFF_TO_METADATA_MODEL_NAME	Primary model for diff-to-metadata generation	gpt-5.4-mini
DAIV_DIFF_TO_METADATA_FALLBACK_MODEL_NAME	Fallback model if the primary model fails	claude-haiku-4.5

Titling

Generates short titles for sessions and runs from the user's initial prompt.

Variable	Description	Default
DAIV_TITLING_MODEL_NAME	Primary model for title generation	gpt-5.4-mini
DAIV_TITLING_FALLBACK_MODEL_NAME	Fallback model if the primary model fails	claude-haiku-4.5