.env.example

# LangMonitor configuration
# Database connection string. Default uses SQLite + aiosqlite.
# For Postgres: postgresql+asyncpg://user:pass@host:5432/dbname
DATABASE_URL=sqlite+aiosqlite:///./langmonitor.db

# Server
SERVER_HOST=0.0.0.0
SERVER_PORT=8000
LOG_LEVEL=INFO

# Security
# Shared secret required in the X-API-Key header (REST) or the api_key
# query/header (WebSocket). LEAVE EMPTY ONLY FOR LOCAL DEV — when empty the
# server is fully open and logs a warning at startup. Set a long random value
# (e.g. `openssl rand -hex 32`) before exposing LangMonitor beyond localhost,
# and pass the same value to the SDK via monitor(api_key=...) or the
# LANGMONITOR_API_KEY env var.
API_KEY=
# Send Access-Control-Allow-Credentials. Auth is header-based, so leave False
# unless a browser client genuinely needs credentialed requests. Force-disabled
# whenever CORS_ORIGINS contains "*".
CORS_ALLOW_CREDENTIALS=false
# Expose interactive OpenAPI docs (/docs, /redoc, /openapi.json). Set false in
# production so the schema isn't a free attack map.
ENABLE_DOCS=true

# Behavior
CHECKPOINT_AUTO_SAVE=true
GUARDRAIL_EVAL_ENABLED=true

# Resource / DoS limits
MAX_WS_CONNECTIONS_PER_RUN=50
MAX_WS_CONNECTIONS_GLOBAL=200
MAX_ACTIVE_GUARDRAIL_RULES=500
MAX_REQUEST_BYTES=1048576
MAX_STATE_PATCH_BYTES=262144
MAX_STATE_PATCH_DEPTH=32
MAX_AB_PROMPT_CHARS=20000

# CORS — comma-separated origins, JSON list, or a single origin.
# Do NOT use "*" together with CORS_ALLOW_CREDENTIALS=true.
CORS_ORIGINS=["http://localhost:3000"]

# LangGraph checkpointer SQLite path (used by CheckpointEngine)
LANGGRAPH_CHECKPOINT_DB=./langgraph_checkpoints.db