.env.example
Set these on your host before deploying. Each platform has an “Environment Variables” section in the deploy flow.
NODE_ENV
CAPTATUM_FLAVOR
HOST
PORT
OAUTH_ISSUER
OAuth (hosted) — REQUIRED for the hosted flavor (server fail-fast aborts without these)
OAUTH_RESOURCE
OAUTH_SIGNING_PRIVATE_JWK
OAUTH_CONSENT_SIGNING_SECRET
secret
OAUTH_SIGNING_KEY_ID
secret
OAUTH_REDIRECT_ALLOWLIST
Exact connector origins (scheme://host[:port]) or exact URLs. NEVER "*" (rejected).
CF_ACCESS_ENABLED
Cloudflare Access (hosted) — REQUIRED for the hosted flavor. The OAuth consent login sits behind a Cloudflare Access app (path…
CF_ACCESS_AUDIENCE
CF_ACCESS_ISSUER
CF_ACCESS_CERTS_URL
MCP_ALLOWED_HOSTS
MCP inbound Host/Origin DNS-rebinding protection
MCP_ALLOWED_ORIGINS
CAPTATUM_TRUSTED_PROXY_CIDRS
Reverse-proxy socket peers allowed to supply X-Forwarded-For for OAuth rate limits. IP/CIDR allowlist only; required for hosted boot. Broad…
CAPTATUM_PROXY_AUTH_SECRET
secret
Generate 32 random bytes as unpadded base64url. Configure Cloudflare to SET (overwrite) X-Captatum-Proxy-Auth to this value on the Captatum…
CAPTATUM_SQLITE_PATH
OAuth-state + stored-client stores (hosted). DEFAULT = two SQLite files, no server: CAPTATUM_SQLITE_PATH for mcp-sso state and the derived…
OPENROUTER_API_KEY
secret
Transform (optional). Free models work without a key but rate-limit faster.
brew install flyctl && fly launch --from https://github.com/acartag7/captatumcurl -L https://fly.io/install.sh | sh && fly launch --from https://github.com/acartag7/captatumiwr https://fly.io/install.ps1 -useb | iex; fly launch --from https://github.com/acartag7/captatum