Environment Variables

​

Domains and Ports

• APP_ORIGIN - default http://localhost:3000
• API_HOST - default http://localhost:3100

growthbook:
  ...
  environment:
    - APP_ORIGIN=http://<my ip>:3000
    - API_HOST=http://<my ip>:3100

growthbook:
  ports:
    - "4000:3000" # example: use 4000 instead of 3000 for the app
    - "4100:3100" # example: use 4100 instead of 3100 for the api
  ...
  environment:
    - APP_ORIGIN=http://<my ip or url>:4000
    - API_HOST=http://<my ip or url>:4100

​

Production Settings

• NODE_ENV - Set to “production” to turn on additional optimizations and API request logging
• MONGODB_URI - The full MongoDB connection string. Alternatively you can specify the following environment variables from which we will compose the full connection string like so mongodb://${MONGODB_USERNAME}:${MONGODB_PASSWORD}@${MONGODB_HOSTNAME}:${MONGODB_PORT}/${MONGODB_DBNAME}${MONGODB_EXTRA_ARGS}:
  • MONGODB_USERNAME - Username for MongoDB
  • MONGODB_PASSWORD - Password for MongoDB
  • MONGODB_HOST - Host name of MongoDB excluding port, e.g. some.host.com
  • MONGODB_PORT - Port to use for MongoDB (defaults to 27017)
  • MONGODB_DBNAME - Database name of growthbook database (defaults to growthbook)
  • MONGODB_EXTRA_ARGS - Optional set of extra arguments for MongoDB connection string (defaults to ?authSource=admin)
• JWT_SECRET - Auth signing key (use a long random string)
• ENCRYPTION_KEY - Data source credential encryption key (use a long random string)

# If you didn't have an ENCRYPTION_KEY before, leave OLD_KEY blank below
docker compose run --workdir /usr/local/src/app/packages/back-end \
  growthbook node dist/scripts/migrate-encryption-key.js OLD_KEY

​

Loading Secrets from Files

services:
  growthbook:
    environment:
      - SECRETS_DIR=/run/secrets
    secrets:
      - JWT_SECRET
      - MONGODB_PASSWORD
secrets:
  JWT_SECRET:
    file: ./secrets/jwt_secret.txt
  MONGODB_PASSWORD:
    file: ./secrets/mongodb_password.txt

​

Email SMTP Settings

• EMAIL_ENABLED (“true” or “false”)
• EMAIL_HOST
• EMAIL_PORT
• EMAIL_HOST_USER
• EMAIL_HOST_PASSWORD
• EMAIL_FROM

​

Google OAuth Settings

• GOOGLE_OAUTH_CLIENT_ID
• GOOGLE_OAUTH_CLIENT_SECRET

​

File Uploads

​

local

​

s3

• S3_BUCKET
• S3_REGION (defaults to us-east-1)
• S3_DOMAIN (defaults to https://${S3_BUCKET}.s3.amazonaws.com/)
• AWS_ACCESS_KEY_ID (not required when deployed to AWS with an instance role)
• AWS_SECRET_ACCESS_KEY (not required when deployed to AWS with an instance role)
• AWS_ASSUME_ROLE (optional role to assume, that has s3:PutObject and s3:GetObject to the bucket)
• S3_ENDPOINT (optional endpoint for an S3-compatible store such as MinIO or Cloudflare R2, which GrowthBook reaches with path-style URLs. Set S3_DOMAIN to the store’s public URL too. Leave unset for AWS S3)

​

google-cloud

• GCS_BUCKET_NAME
• GCS_DOMAIN (defaults to https://storage.googleapis.com/${GCS_BUCKET_NAME}/)
• GOOGLE_APPLICATION_CREDENTIALS (not required when deployed to GCP with an instance service account)

​

AI Provider API Keys

• OPENAI_API_KEY - OpenAI API key for GPT models
• ANTHROPIC_API_KEY - Anthropic API key for Claude models
• XAI_API_KEY - xAI API key for Grok models
• MISTRAL_API_KEY - Mistral AI API key
• GOOGLE_AI_API_KEY - Google AI API key for Gemini models

​

AI Assistant Skills

• AGENT_SKILLS_DIR - Path to a directory of custom skills. Each skill is a folder containing a SKILL.md file, with optional workflow files in a references/ subfolder and any other files the skill needs:
  skills/
    release-checklist/
      SKILL.md
      references/
        prepare.md
      examples/
        payload.json
    feature-flags/          # same name as a built-in, so it replaces it
      SKILL.md
  

volumes:
  - ./skills:/usr/local/src/app/skills
environment:
  - AGENT_SKILLS_DIR=/usr/local/src/app/skills

​

Outbound Request Proxy

• WEBHOOK_PROXY - URL of an HTTP proxy, such as http://smokescreen.internal:4750, for outbound requests to URLs that users configure in GrowthBook. Unset by default, so these requests connect directly.

• Event webhooks, including the test requests sent while setting one up
• SDK webhooks
• Slack notifications
• Update notifications and health checks to a GrowthBook Proxy
• fetch calls made by Custom Hooks
• SSO requests to your identity provider, except those to the standard Auth0, Okta, Microsoft Entra ID and Google domains

​

Enterprise Settings

​

License Keys

1. Navigate to Settings → General and look for the License section of the page. There you can input or edit your license key string. (Recommended)
2. Alternately, set the environment variable LICENSE_KEY to your license key string. If using Docker, go to docker-compose.yml and add the variable to the growthbook → environment section.

• A hash of each user’s email - this is used to deduplicate users across multiple installations (dev, prod, etc.) in order to figure out how many seats are being used.
• The git sha and date of the installation - this is used to determine when GrowthBook can delete deprecated features, determine who to send upgrade notices to, provides helpful information for debugging, etc.
• A list of which data source types are being used, a list of which event trackers are being used, and a list of SDK languages being used - these help GrowthBook know how much usage the various data sources, event trackers, and sdk languages are getting so we can prioritize work.

​

Enterprise SSO

​

Multi-org

• IS_MULTI_ORG - This defaults to false. Set this to true if you want to enable multiple organizations.
• ALLOW_SELF_ORG_CREATION - This defaults to false. Set this to true to allow any users to create new organizations.
• SHOW_MULTI_ORG_SELF_SELECTOR - This defaults to true. It allows all users to see a list of all organizations they can join. Upon selecting an organization, users will either automatically join it (if using SSO and self-join is enabled for that organization) or require an admin’s approval.

​

Logging

• LOG_LEVEL - The API server’s log level: fatal, error, warn, info (default), debug or trace.

​

Observability (OpenTelemetry)

​

OAuth Authorization Server (MCP)

• OAUTH_AS_ENABLED - Set to 1 or true to expose the Authorization Server endpoints. Default off.
• OAUTH_ISSUER - Optional. Issuer identifier advertised to clients (RFC 8414). Defaults to API_HOST when unset. Must be a stable absolute URL.
• OAUTH_ACCESS_TOKEN_TTL_SECONDS - Access token lifetime in seconds (default 3600).
• OAUTH_REFRESH_TOKEN_TTL_SECONDS - Refresh token lifetime in seconds (default 2592000 / 30 days).

​

REST API Rate Limits

• API_RATE_LIMIT_MAX - Requests per minute for each API key (default 60).
• API_RATE_LIMIT_MAX_BY_KEY - Limits for specific API keys, higher or lower than API_RATE_LIMIT_MAX, as comma-separated keyId:limit pairs, such as key_abc123:600, key_def456:20. Find a key’s id in the Internal ID column under Settings → API Keys. A copied or replacement key has a new id and needs its own entry. OAuth access tokens get a new id each time they’re issued, so they always use API_RATE_LIMIT_MAX.
• API_RATE_LIMIT_SEPARATE_WRITES - Set to true to count each key’s writes (POST, PUT, PATCH and DELETE requests) apart from its reads, at the same limit, so reads can’t use up its writes. A key can then make up to twice its limit in total. A few read-only POST endpoints, such as searches and SQL queries, count as writes.
• API_RATE_LIMIT_SEPARATE_REQUESTERS - Set to true to give each member named in a key’s X-GrowthBook-Requested-By header their own count, at that key’s limits. Requests that name nobody keep the key’s count. The header doesn’t prove who sent a request, so anyone holding the key can name different members to get more requests.

growthbook:
  ...
  environment:
    - API_RATE_LIMIT_MAX=120
    - API_RATE_LIMIT_MAX_BY_KEY=key_abc123:600,key_def456:20
    - API_RATE_LIMIT_SEPARATE_WRITES=true
    - API_RATE_LIMIT_SEPARATE_REQUESTERS=true

​

Other Settings

• EXPERIMENT_REFRESH_FREQUENCY - Default update schedule for experiment results. Update when stale for X hours (default 6).
• QUERY_CACHE_TTL_MINS - How long (in minutes) to cache and re-use SQL query results (default 60)
• DEFAULT_CONVERSION_WINDOW_HOURS - How many hours after being put into an experiment does a user have to convert. Can be overridden on a per-metric basis. (default 72)
• DISABLE_TELEMETRY - We collect usage telemetry to help us improve GrowthBook. This includes a hashed org/user identifier, IP address, and user agent. Set to “true” to disable.
• STORE_SEGMENTS_IN_MONGO - If using the config.yml file, set to true if you want to store segments in Mongo. This is also useful if you have existing segments stored in Mongo that you need to access. When set, GrowthBook will ignore segments in the config.yml file and only use Segments stored in Mongo.
• CDN_HOST - When set, this will update the implementation instructions within GrowthBook to override the API_HOST in cases where a CDN is used.
• EXPRESS_TRUST_PROXY_OPTS - Express’ trust proxy setting value. Supports boolean (true/false), string values, and integer values for trusting the n^th hop from the front-facing proxy server as the client. Leave empty or specify false to use Express’ default behavior. If you are running GrowthBook behind a proxy or load balancer, this is required to track the correct user IP for audit log events.
• SDK_PAYLOAD_CACHE - Where SDK Connection payloads are kept between feature changes. mongo (default) caches each payload in MongoDB and rebuilds it when features change. none builds the payload on every request instead, which costs more per request but removes the payload size limit set by MongoDB’s maximum document size.
• API_ALLOW_SKIP_PAGINATION - Set to true to let REST requests pass skipPagination=true when listing a Saved Group’s revisions, returning every revision in one response. Off by default, so those requests are refused.
• MAX_WEBHOOK_TIMEOUT_SECONDS - Upper bound (in seconds) for the per-webhook request timeout that users can configure on SDK webhooks and event webhooks (default 120). Webhooks without a configured timeout wait 30 seconds.
• KEEP_ALIVE_TIMEOUT_MS - How long (in milliseconds) the API server holds an idle keep-alive connection open before closing it (default 3605000, just over an hour). This must be longer than the idle timeout of any load balancer or reverse proxy in front of GrowthBook. If it is shorter, the proxy can reuse a connection GrowthBook has already closed, and the request fails with a 502 that never reaches your application logs.
• ROBOTS_TXT_PATH - Define an absolute path to a robots.txt file that will be served on the /robots.txt path of your backend domain. If this env var is not defined, the app will look for a robots.txt file in the parent folder of the built server.js (which should be the packages/back-end directory in the default configuration)
• DISABLE_API_ROOT_PATH - We include a default path in the API server to expose certain settings. Set to “true” to withhold that information. The AI Visual Editor however relies on the information in this path, so disabling it will prevent some of its features from working correctly.