Configuration Reference

ServFlow is an agent builder: you define AI agents and the workflows they run, and a Go engine serves them. The instance itself — ports, storage, authentication, tracing — is configured with a single TOML file passed to servflowai start --config. This page is the complete reference for that file. For installing the binary see Installation; for what an agent is, see Agents.

Every option can also be set with an environment variable. Environment variables take precedence over the TOML file, which makes them convenient for containers and CI.

Minimal configuration

Only server.config_folder is required. Everything else has a working default:

[server]
config_folder = "./configs"

Start the instance with:

servflowai start --config config.toml

`[server]`

Controls how the process is hosted. One port serves everything. The workflow engine owns the root path, so a workflow listening on /hello answers at http://localhost:8080/hello. The builder UI is mounted under /dashboard on this same port, so its pages and assets live there rather than at the origin root.

[server]
port = "8080"
config_folder = "./configs"
engine_config_file = "./integrations.yaml"
env = "production"

Field	Environment variable	Default	Description
`port`	`SERVFLOW_SERVER_PORT`	`8080`	Port serving the engine, the API, and (with `--dashboard`) the UI
`config_folder`	`SERVFLOW_SERVER_CONFIG_FOLDER`	—	Required. Directory holding workflow configuration files
`engine_config_file`	`SERVFLOW_SERVER_ENGINE_CONFIG_FILE`	—	Path to the engine integrations YAML file
`env`	`SERVFLOW_SERVER_ENV`	`production`	Environment mode: `production` or `development`

`[sqlite]`

The store. Agents, integrations, providers, secrets, workspaces, and user accounts are rows in one SQLite file.

[sqlite]
path = "secrets.db"
master_key = ""

Field	Environment variable	Default	Description
`path`	`SERVFLOW_SQLITE_PATH`	`secrets.db`	Path to the SQLite file. A relative path is resolved against the folder that holds the settings file, so the default is `~/.servflow/secrets.db`.
`master_key`	`SERVFLOW_SQLITE_MASTER_KEY`	empty	The key that encrypts stored credentials. Empty stores them as plain text.

When master_key is set, these are encrypted in the store:

the value of every secret
the config of every integration
the config of every provider, which holds its API key
the tokens of integrations connected through a sign-in, such as Notion

Rows written before master_key was set stay in plain text.

Never commit master_key to version control. Set it with SERVFLOW_SQLITE_MASTER_KEY in production. Changing it makes previously encrypted values unreadable.

`[secrets]`

Controls where {{ secret "name" }} resolves from at runtime.

[secrets]
disable_env = false

Field	Environment variable	Default	Description
`disable_env`	`SERVFLOW_SECRETS_DISABLE_ENV`	`false`	When `true`, `{{ secret "name" }}` reads only stored secrets and never the server process environment

By default, ServFlow checks an environment variable whose name exactly matches the secret name before it checks the stored secret of that name. Set disable_env = true on a shared or hosted instance so workflows and agent tools cannot read the instance’s own environment variables through {{ secret }}.

`[authentication]`

Controls how the dashboard and management API are gated.

[authentication]
mode = "local"
domain = "your-domain.com"

Field	Environment variable	Default	Description
`mode`	`SERVFLOW_AUTH_MODE`	`local`	`local` gates the dashboard behind username/password accounts stored in SQLite. `none` disables the gate entirely
`domain`	`SERVFLOW_AUTH_DOMAIN`	—	Public base URL of this instance, used to build OAuth integration callback URLs

mode defaults to local. A config file that omits this section is still gated — the first time you open the dashboard you are asked to create an account. See First run.

mode = "none" leaves the dashboard and management API open to anyone who can reach the port. Use it only on a trusted local machine.

Sessions are opaque tokens stored in the database, so they survive restarts and can be revoked by logging out.

`[tracing]`

OpenTelemetry tracing for debugging workflow and agent runs.

[tracing]
enabled = false
service_name = "servflowai"
org_id = ""
collector_endpoint = ""

Field	Environment variable	Default	Description
`enabled`	`SERVFLOW_TRACING_ENABLED`	`false`	Enable OpenTelemetry tracing
`service_name`	`SERVFLOW_TRACING_SERVICE_NAME`	—	Service name attached to every span
`org_id`	`SERVFLOW_TRACING_ORG_ID`	—	Organization ID for multi-tenant collectors
`collector_endpoint`	`SERVFLOW_TRACING_COLLECTOR_ENDPOINT`	—	Base URL of the OTLP/HTTP ingest endpoint. The `/v1/traces` path is appended automatically, so give a full URL including scheme

Tracing can also be configured during first-run setup, which offers a hosted collector, a custom endpoint, or disabling it.

Complete example

[server]
port = "8080"
config_folder = "./configs"
engine_config_file = "./integrations.yaml"
env = "production"

[sqlite]
path = "./secrets.db"
master_key = ""

[secrets]
disable_env = false

[authentication]
mode = "local"

[tracing]
enabled = false
service_name = "servflowai"
org_id = ""
collector_endpoint = ""

Environment variable overrides

Environment variables always win over the TOML file. This keeps secrets out of configuration files and lets one image serve several environments:

docker run -d \
  -p 8080:8080 \
  -e SERVFLOW_SQLITE_MASTER_KEY=my-secret-key \
  -e SERVFLOW_SQLITE_PATH=/data/servflow.db \
  -e SERVFLOW_AUTH_MODE=local \
  -v $(pwd)/config.toml:/data/config.toml \
  servflow/servflowai start --config /data/config.toml --dashboard

Secrets from environment variables

A secret is looked up by name each time it is used. By default, an environment variable whose name is exactly the secret’s name, with no prefix and no change of case, is used before the stored secret of that name. A name that matches neither gives an empty value, not an error. Set [secrets].disable_env = true to skip environment lookup completely.

When `disable_env` is…	Order	Where the value comes from
`false`	1	An environment variable with exactly the secret’s name.
`false`	2	The secret stored under that name.
`true`	1	The secret stored under that name.

Viewing the active configuration

To see the settings an instance actually resolved, including defaults and environment overrides:

servflowai resource settings view --config config.toml

Next steps

Installation

Install ServFlow and create your first account.

Secrets

Store a credential once and use it by name.

Agents

Learn the object model your configuration serves.

Getting started

Guides

Concepts

References

Minimal configuration

`[server]`

`[sqlite]`

`[secrets]`

`[authentication]`

`[tracing]`

Complete example

Environment variable overrides

Secrets from environment variables

Viewing the active configuration

Next steps

Installation

Secrets

Agents

​Minimal configuration

​[server]

​[sqlite]

​[secrets]

​[authentication]

​[tracing]

​Complete example

​Environment variable overrides

​Secrets from environment variables

​Viewing the active configuration

​Next steps

Installation

Secrets

Agents

Minimal configuration

`[server]`

`[sqlite]`

`[secrets]`

`[authentication]`

`[tracing]`

Complete example

Environment variable overrides

Secrets from environment variables

Viewing the active configuration

Next steps