Environment Variables

Required

openssl rand -hex 32 prints 64 hex characters. ENCRYPTION_KEY and API_ENCRYPTION_KEY must be exactly that — a value of any other shape throws the first time Sim encrypts or decrypts, not at startup. The rest are secrets of no fixed shape and only need 32 characters or more. The Sim app never checks — it runs its env schema with validation skipped — but the realtime service validates BETTER_AUTH_SECRET and INTERNAL_API_SECRET at boot and refuses to start if either is shorter.

Strongly recommended

AI Providers

Catalog visibility

AWS Bedrock

Azure OpenAI

Azure Anthropic

Document OCR

Self-hosted OpenAI-compatible endpoints

Login Providers

Google, GitHub, and Microsoft sign-in, their callback URLs, and the DISABLE_*_AUTH switches are documented in Authentication.

Integration Credentials

Access Control

Who may sign up and sign in — the allowlists, blocklists, DISABLE_REGISTRATION, DISABLE_INVITATIONS, DISABLE_PUBLIC_API, and DISABLE_AUTH — is documented in Authentication.

Code Execution

Without a remote provider, user code runs in an in-process V8 isolate inside the app container. See Sandboxes for the base-image build and Security for the isolation comparison.

Networking & Limits

A malformed entry in either allowlist stops the app at startup with a message naming the setting. See the SSRF boundary for the accepted syntax and for what the allowlist does and does not reach.

Your reverse proxy's body-size limit must be at least as large as the app limits above. See Networking.

Observability

See Observability.

Knowledge Bases

Both variables apply at creation time and are recorded on the knowledge base, so changing either affects new knowledge bases only. Existing ones keep the model and width they were built with, and knowledge bases with different settings cannot be searched together.

Matching the width to the model is yours to get right for a hosted provider: Sim knows only the widths each one documents, so a width that model cannot emit falls back to 1536 with a warning. For Ollama it is checked — leave EMBEDDING_OUTPUT_DIMS unset and Sim reads the model's width from your server, refusing to create the knowledge base if it cannot; set it explicitly and a mismatch surfaces as a failed document instead. Common pairings:

On a Compose install or source checkout, sim-setup add knowledge-embeddings walks through all of this — pick OpenAI, Azure OpenAI, OpenRouter, Gemini, or Ollama and it writes the variables that family needs. The three OpenAI-family transports share the same model and width prompts. sim-setup config then reports the one family your KB_EMBEDDING_MODEL actually selects, rather than every provider you happen to hold a key for. Helm releases set these values through your own chart values instead, and an Ollama server is yours to run either way — sim-setup configures Sim to reach one, never installs it.

The Embeddings block reads the same OLLAMA_URL. It lists the models on that server that report an embedding capability, with the width each one emits where Ollama reports it, so a workflow can embed locally without an API key. Ollama only began reporting capabilities in 0.5 — against an older server nothing can be filtered, so the list includes chat models and labels none of them with a width. Check what you pick there, or upgrade Ollama.

Chat & PII

Enterprise Features

Enterprise features are unlocked by configuration rather than billing on self-hosted deployments. One switch turns on the full set; per-feature flags below it override the switch either way.

Most enterprise features read their settings from the organization that owns a workspace, so enabling the flags alone is not enough — the deployment also needs an organization model. See the self-hosted enterprise guide for the per-feature flags, both organization patterns, and the Admin API.

File Storage

By default Sim writes uploads to local disk. For production, point it at AWS S3, Azure Blob, or Google Cloud Storage. See Object Storage for the full setup, bucket layout, and IAM policy.

Email Providers

Configure at least one. Every configured provider stays active and is tried in order — Resend → AWS SES → SMTP → Azure Communication Services → Gmail — falling through only on failure. With none configured, mail is silently not sent. The variables for each provider, plus setup, verification, and troubleshooting, are in Email.

Limits

Self-hosted deployments (billing disabled) run without plan limits: no rate limits, no execution timeouts, no table or storage caps, and no retention-based data deletion. Each limit can be opted back in individually by explicitly setting its variable.

Removing a limit you already inherited

If a limit is still enforced after upgrading — most often a FREE_TABLES_LIMIT or FREE_TABLE_ROWS_LIMIT carried forward from a chart older than 1.5.0, or copied into your own values file — the variable is still reaching the pod. On Helm, remove it by overriding it with null:

app:
  envDefaults:
    FREE_TABLES_LIMIT: null
    FREE_TABLE_ROWS_LIMIT: null

Setting the variable to an empty string does not remove it: the chart reads an empty value as "not specified", so the inherited value still applies.

Null the variable in every layer that sets it. If it appears in both app.env and app.envDefaults, nulling only the app.env entry lets the envDefaults value apply again and the limit stays in force. With External Secrets, also drop the key from externalSecrets.remoteRefs.app, which keeps syncing it independently. Confirm what the pod will actually receive before rolling out:

helm template sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 -f values.yaml | grep -A1 FREE_TABLE   # expect no output

null deletion has no effect under helm upgrade --reuse-values — pass your full values with -f, or use --reset-then-reuse-values (Helm 3.14+). If you deploy with Argo CD, put the null in valueFiles or the values string rather than valuesObject, which strips nulls. On Docker Compose, delete the line from your .env file.

Example .env

# Core
DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio
NEXT_PUBLIC_APP_URL=https://sim.yourdomain.com
BETTER_AUTH_URL=https://sim.yourdomain.com

# Secrets — generate each with `openssl rand -hex 32`
BETTER_AUTH_SECRET=<openssl rand -hex 32>
ENCRYPTION_KEY=<openssl rand -hex 32>
INTERNAL_API_SECRET=<openssl rand -hex 32>
API_ENCRYPTION_KEY=<openssl rand -hex 32>
CRON_SECRET=<openssl rand -hex 32>

# Coordination (required past one replica)
REDIS_URL=redis://redis:6379

# Models — OPENAI_API_KEY also powers knowledge base embeddings
OPENAI_API_KEY=sk-...

# Email
RESEND_API_KEY=re_...
FROM_EMAIL_ADDRESS="Sim <noreply@yourdomain.com>"

# Access control
ALLOWED_LOGIN_DOMAINS=yourdomain.com

See apps/sim/.env.example for all options.