Client variables, production runtime configuration groups, and Slack settings.
The documentation examples use shell variables for convenience. These names are client conventions, not required Alfred request headers.
| Variable | Example | Purpose |
|---|---|---|
ALFRED_API_URL | https://alfred.headout.com | Alfred API origin without a trailing slash. |
ALFRED_API_KEY | pk_live_... | Bearer API key stored in a secret manager. |
EXECUTION_ID | exec_... | Execution currently being monitored or controlled. |
SUBSCRIPTION_ID | sub_... | Webhook subscription being managed. |
EVENT_ID | evt_... | Event selected for replay or deduplication. |
When running the repository locally, the API defaults to:
export ALFRED_API_URL="http://localhost:3000"Development authentication without a configured auth store accepts the repository's test-only token. Production uses persisted, peppered API keys and must never use development credentials.
The production docs build uses these exact origins:
| Variable | Production value | Loader behavior |
|---|---|---|
ALFRED_API_URL | https://alfred.headout.com | Required by the docs app in production and used as the generated OpenAPI server. |
ALFRED_DOCS_URL | https://alfred-docs.headout.com | Used for canonical and Open Graph URLs. If omitted, the docs loader accepts RAILWAY_PUBLIC_DOMAIN; without either value it fails in production. |
Both values must be absolute HTTP(S) origins without credentials, paths, query parameters, or fragments.
| Variables | Default or requirement | Purpose |
|---|---|---|
DATABASE_URL, REDIS_URL | Local Postgres and Redis URLs outside configured deployments | Persist executions, auth, audit, commands, outbox, subscriptions, Slack bindings, streams, and replay state. Workflow steps that persist state require DATABASE_URL. |
PORT | 3000 | API listener port. |
NODE_ENV, LOG_LEVEL, RAILWAY_SERVICE_NAME | development, info, and no Railway service label | Select live versus test API-key prefixes and annotate structured logs and database connections. |
API_KEY_PEPPER, API_KEY_PEPPER_VERSION | Development-only pepper and version 1 | Hash persisted API keys. Configure an explicit production pepper. |
PERMISSION_CACHE_TTL_MS | 5000 | Cache persisted RBAC permissions in the API process. |
WORKFLOW_COMMAND_DISPATCH_INTERVAL_MS | 5000 | Poll runnable workflow command lanes. |
WORKFLOW_COMMAND_RECONCILIATION_INTERVAL_MS | 5000, clamped to 1000-30000 | Reconcile active Workflow SDK commands. |
WORKFLOW_COMMAND_RECONCILIATION_LIMIT | 20, clamped to 1-100 | Bound commands inspected per lane and reconciliation pass. |
DISPATCHER_POLL_MS | 1000 | Dispatcher polling interval for streams and webhooks. |
DISPATCHER_METRICS_PORT | 9090 | Dispatcher-only Prometheus listener. |
WEBHOOK_DISPATCH_PER_SUBSCRIPTION_LIMIT | 5 | Bound concurrent pending deliveries selected per subscription. |
| Variable | Default or requirement | Purpose |
|---|---|---|
WORKFLOW_POSTGRES_URL | DATABASE_URL, then the local Postgres URL | Connect Postgres World. |
WORKFLOW_TARGET_WORLD | @workflow/world-postgres | Select the Workflow SDK world. |
WORKFLOW_POSTGRES_JOB_PREFIX | alfred_ | Namespace durable workflow jobs. |
WORKFLOW_POSTGRES_WORKER_CONCURRENCY | 10 | Set Workflow SDK worker concurrency. |
WORKFLOW_POSTGRES_MAX_POOL_SIZE | The larger of 10 or worker concurrency plus 2 | Bound the Postgres World pool. |
| Variables | Behavior |
|---|---|
GITHUB_WEBHOOK_SIGNING_SECRET, GITHUB_WEBHOOK_SIGNING_SECRET_PREVIOUS | Verify current and optional previous GitHub webhook signatures. |
ZENDESK_WEBHOOK_SIGNING_SECRET, ZENDESK_WEBHOOK_SIGNING_SECRET_PREVIOUS | Verify current and optional previous Zendesk webhook signatures. |
WEBHOOK_SECRET_PROVIDER, WEBHOOK_SECRET_KMS_KEY_ID, WEBHOOK_SECRET_ENCRYPTION_KEY | Protect outbound webhook secrets. Provider aws-kms requires the KMS key ID; the local envelope codec uses the encryption key and has only a development fallback. |
WORKFLOW_ADMIN_ORIGIN | Set the complete internal Workflow Admin origin. |
WORKFLOW_ADMIN_PRIVATE_DOMAIN, WORKFLOW_ADMIN_PORT | Build an internal HTTP origin when WORKFLOW_ADMIN_ORIGIN is absent. |
OTEL_TRACES_EXPORTER, OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_SDK_DISABLED | Enable OTLP traces when an endpoint is configured or the exporter is otlp, unless the SDK is disabled or the exporter is none. |
| Group | Variables | Behavior |
|---|---|---|
| AWS client defaults | AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_ENDPOINT_URL, ACM_ENDPOINT_URL, CLOUDFRONT_ENDPOINT_URL, ELBV2_ENDPOINT_URL, ROUTE53_ENDPOINT_URL, LAMBDA_ENDPOINT_URL | Region defaults to us-east-1. Service-specific endpoints override the shared endpoint; Lambda version updates read the Lambda and CloudFront endpoint variables directly. Credentials follow the AWS SDK credential chain. |
| CloudFront origins | CLOUDFRONT_MICROBRAND_ORIGIN, CLOUDFRONT_NGINX_ORIGIN | Required when the add-certificate runtime config loads. |
| Load balancers | ELB_BOOKING_FLOW_LISTENER_ARN, ELB_CLOUDFRONT_LISTENER_ARN, ELB_KIRBY_LISTENER_ARN, ELB_LEGACY_LOAD_BALANCER_ARNS | Booking and CloudFront listener ARNs are required by the runtime loader; the certificate ELB and cleanup stages also require the Kirby listener ARN. Legacy ARNs are an optional comma-separated set. |
| Route53 | ROUTE53_HOSTED_ZONE_ID | Optional hosted-zone override. Normal workflows can resolve the zone from the domain. |
| GoDaddy | GODADDY_API_KEY, GODADDY_API_SECRET, GODADDY_ENDPOINT | Key and secret are required together for domain registration; the endpoint is optional. |
| GitHub platform routing | PLATFORM_GITHUB_TOKEN, PLATFORM_GITHUB_API_URL, PLATFORM_HELM_REPOSITORY, PLATFORM_NGINX_REPOSITORY | API URL and repository names have Headout defaults; the token authorizes commits. |
| ArgoCD | ARGOCD_AUTH_TOKEN, ARGOCD_SERVER, ARGOCD_NAMESPACE, ARGOCD_MYSTIQUE_APPLICATION, ARGOCD_NGINX_APPLICATION | Server, namespace, and application names have Headout defaults; the token authorizes reconciliation checks. |
| Zendesk | ZENDESK_BASE_URL, ZENDESK_SUBDOMAIN, ZENDESK_EMAIL, ZENDESK_API_TOKEN, ZENDESK_TOKEN | Email plus API token selects API-token auth. ZENDESK_TOKEN, or an API token without email, selects legacy basic auth. Base URL takes precedence over subdomain. |
| Google Maps | GOOGLE_MAPS_SERVICE_ACCOUNT_JSON, GOOGLE_MAPS_KIRBY_KEY_RESOURCE_NAME, GOOGLE_MAPS_ZAPDOS_KEY_RESOURCE_NAME | All three values are required together; absent, incomplete, or invalid configuration produces bounded manual assistance. |
Railway wiring is declared in .railway/railway.ts. Provider secrets remain
secret-manager values and must not be copied into documentation, logs, or
workflow requests.
GOOGLE_MAPS_SERVICE_ACCOUNT_JSON is a JSON object containing
client_email, private_key, and project_id. Each Google Maps key resource
variable must contain a full resource name shaped exactly as
projects/{number}/locations/global/keys/{key}, where {number} is a numeric
Google Cloud project number. These resource names are not the AIza...
browser key values. The service-account variable and both resource-name
variables are required together. Incomplete or invalid configuration produces
bounded manual Google Maps assistance without exposing credentials or resource
names in Slack.
| Variable | Purpose |
|---|---|
SLACK_BOT_TOKEN | Slack bot token used by the Chat SDK Slack adapter. |
SLACK_SIGNING_SECRET | Verifies slash-command and interactive requests from Slack. |
ALFRED_SLACK_WORKFLOW_CHANNEL_ID | Channel that owns every canonical workflow tracking thread. |
ALFRED_SLACK_TRACKING_INTERVAL_MS | Optional active-binding recovery interval; defaults to 30 seconds. |
ALFRED_SLACK_OPERATOR_USERGROUP_IDS | Optional comma-separated immutable Slack group IDs used for supplemental workflow-operator permissions; unioned with the singular compatibility variable. |
ALFRED_SLACK_OPERATOR_USERGROUP_ID | Optional legacy single-group compatibility variable. |
ALFRED_SLACK_PLATFORM_ONCALL_USERGROUP_ID | Optional immutable group ID used only for structured Platform assistance mentions. |
ALFRED_SLACK_DHRUV_USER_ID | Optional immutable user ID used only for configured Platform assistance mentions. |
ALFRED_WORKFLOW_DASHBOARD_URL | Optional browser-reachable, credential-free HTTPS Workflow SDK dashboard base URL used for execution links in public Slack tracking cards. |
RAILWAY_ENVIRONMENT_NAME | Environment label shown in workflow review; falls back to NODE_ENV, then local. |
All three required Slack variables must be present to enable /alfred.
Platform assistance mentions are enabled only when both
ALFRED_SLACK_PLATFORM_ONCALL_USERGROUP_ID and
ALFRED_SLACK_DHRUV_USER_ID are present and match Slack's S... and U...
ID formats. Invalid or incomplete assistance configuration does not disable
the bot.
ALFRED_WORKFLOW_DASHBOARD_URL may contain no query parameters or exactly one
non-empty environment parameter. Alfred rejects URLs with other query keys,
duplicate parameters, fragments, embedded username or password credentials, or
a protocol other than HTTPS. An invalid or missing value only omits the
dashboard link; it does not prevent Slack tracking.
Alfred appends the Workflow SDK run identifier to the accepted base URL. The generated Slack link contains no Alfred API key or other credential. Configure authentication and authorization independently on the dashboard or its access proxy.
Approve an add-subdomain replacement plan POST
Requires the workflows:add-subdomain entitlement for the execution and mutates a paused workflow by resuming its approval hook. The execution must be waiting for replacement approval of the submitted current plan hash; an already accepted approval is replayed safely.
LLM Documentation
Machine-readable documentation routes generated from the current Fumadocs site.