Configuration Reference

Every TOML option and environment variable for a ServFlow instance

ServFlow is an agent builder: you define AI agents and the workflows they run, and a Go engine serves them. The instance itself — ports, storage, authentication, tracing — is configured with a single TOML file passed to servflowai start --config.

This page is the complete reference for that file. For installing the binary see Installation; for what an agent is, see Agents.

Every option can also be set with an environment variable. Environment variables take precedence over the TOML file, which makes them convenient for containers and CI.

​

Minimal configuration

Only server.config_folder is required. Everything else has a working default:

[server]
config_folder = "./configs"

Start the instance with:

servflowai start --config config.toml

​

[server]

Controls how the process is hosted. One port serves everything. Agent paths are served from the root, so an agent listening on /ask answers at http://localhost:8080/ask. The dashboard is under /dashboard on the same port.

[server]
port = "8080"
config_folder = "./configs"
env = "production"

Field	Environment variable	Default	Description
port	SERVFLOW_SERVER_PORT	8080	Port serving agents, the API, and (with --dashboard) the dashboard
config_folder	SERVFLOW_SERVER_CONFIG_FOLDER	—	Required. Directory holding workflow configuration files
env	SERVFLOW_SERVER_ENV	production	Environment mode: production or development

​

[sqlite]

Where ServFlow keeps agents, integrations, providers, secrets, workspaces, and user accounts.

[sqlite]
path = "secrets.db"
master_key = ""

Field	Environment variable	Default	Description
path	SERVFLOW_SQLITE_PATH	secrets.db	Path to the database file. A relative path is resolved against the folder that holds the settings file, so the default is ~/.servflow/secrets.db.
master_key	SERVFLOW_SQLITE_MASTER_KEY	empty	The key that encrypts stored credentials. Empty stores them as plain text.

When master_key is set, stored secrets, integration credentials, and provider API keys are encrypted. Set it before you store any credentials.

Never commit master_key to version control. Set it with SERVFLOW_SQLITE_MASTER_KEY in production. Changing it makes previously encrypted values unreadable.

​

[secrets]

Controls where {{ secret "name" }} resolves from at runtime.

[secrets]
disable_env = false

Field	Environment variable	Default	Description
disable_env	SERVFLOW_SECRETS_DISABLE_ENV	false	When true, {{ secret "name" }} reads only stored secrets and never the server process environment

By default, ServFlow checks an environment variable whose name exactly matches the secret name before it checks the stored secret of that name. Set disable_env = true on a shared or hosted instance so workflows and agent tools cannot read the instance’s own environment variables through {{ secret }}.

​

[authentication]

Controls how the dashboard and management API are gated.

[authentication]
mode = "local"
domain = "your-domain.com"

Field	Environment variable	Default	Description
mode	SERVFLOW_AUTH_MODE	local	local gates the dashboard behind username and password accounts. none disables the gate entirely
domain	SERVFLOW_AUTH_DOMAIN	—	Public base URL of this instance, used to build OAuth integration callback URLs

mode defaults to local. A config file that omits this section is still gated — the first time you open the dashboard you are asked to create an account. See First run.

mode = "none" leaves the dashboard and management API open to anyone who can reach the port. Use it only on a trusted local machine.

​

[tracing]

OpenTelemetry tracing for debugging workflow and agent runs.

[tracing]
enabled = false
service_name = "servflowai"
org_id = ""
collector_endpoint = ""

Field	Environment variable	Default	Description
enabled	SERVFLOW_TRACING_ENABLED	false	Enable OpenTelemetry tracing
service_name	SERVFLOW_TRACING_SERVICE_NAME	—	Service name attached to every span
org_id	SERVFLOW_TRACING_ORG_ID	—	Organization ID sent with exported traces
collector_endpoint	SERVFLOW_TRACING_COLLECTOR_ENDPOINT	—	Base URL of the OTLP/HTTP ingest endpoint. The /v1/traces path is appended automatically, so give a full URL including scheme

Tracing can also be configured during first-run setup.

​

Complete example

[server]
port = "8080"
config_folder = "./configs"
env = "production"

[sqlite]
path = "./secrets.db"
master_key = ""

[secrets]
disable_env = false

[authentication]
mode = "local"

[tracing]
enabled = false
service_name = "servflowai"
org_id = ""
collector_endpoint = ""

​

Environment variable overrides

Environment variables always win over the TOML file. This keeps secrets out of configuration files and lets one image serve several environments:

docker run -d \
  -p 8080:8080 \
  -e SERVFLOW_SQLITE_MASTER_KEY=my-secret-key \
  -e SERVFLOW_SQLITE_PATH=/data/servflow.db \
  -e SERVFLOW_AUTH_MODE=local \
  -v $(pwd)/config.toml:/data/config.toml \
  servflow/servflowai start --config /data/config.toml --dashboard

​

Secrets from environment variables

A secret is looked up by name each time it is used. By default, an environment variable whose name is exactly the secret’s name, with no prefix and no change of case, is used before the stored secret of that name. A name that matches neither gives an empty value, not an error. Set [secrets].disable_env = true to skip environment lookup completely.

When disable_env is…	Order	Where the value comes from
false	1	An environment variable with exactly the secret’s name.
false	2	The secret stored under that name.
true	1	The secret stored under that name.

​

Viewing the active configuration

To see the settings an instance actually resolved, including defaults and environment overrides:

servflowai resource settings view --config config.toml

​

Next steps

Installation

Install ServFlow and create your first account.

Secrets

Store a credential once and use it by name.

Agents

Learn the object model your configuration serves.