---
title: "Configuration"
description: "Other settings, environment variables, and configurations for AnythingLLM"
---

import { Callout } from "nextra/components";

<Callout type="warning" emoji="️⚠️">
  **Warning:**
  If you are not a developer, you should not set environment variables directly. Instead, you should use the in-app interface to manage environment variables.

**Desktop:**
If you are using AnythingLLM Desktop, do not edit the `.env` file. This guide is only for users who are using AnythingLLM Self-hosted or Docker.

</Callout>

# Configuration of AnythingLLM

In general, the majority of configurations you can set are through environment variables and there is typically an associated in-app interface to manage these settings so you don't have to edit them directly.

However, there are a few configurations that are not configurable via the in-app interface and require you to set environment variables directly. These are usually for more niche use cases that most users will not need.

<Callout type="info" emoji="️💡">
  **Tip:** After you set these environment variables, you will need to restart
  the AnythingLLM service or container for the changes to take effect.
</Callout>

## Disable View Chat History

Modification of the `DISABLE_VIEW_CHAT_HISTORY` environment variable allows you to disable the **frontend** ability to view chat history by anyone with an account on the instance as well as the instance administrator.
This blocks any user, including yourself, from viewing chat history from users using the AnythingLLM chat interface **and** via external embed widgets.

- **This does not impact users from seeing their own chat histories in chat or the LLM from being able to use them for continuous conversations.**
- This **does not** impact the ability to use API keys to access chat histories via the associated API endpoints.
- This will impact the ability to export chat histories via the in-app interface as well as the ability to delete chat histories.
- **Chat history is not deleted when this is enabled. It is simply hidden and blocked from being viewed via the frontend admin interfaces.**

### Enable

Set the `DISABLE_VIEW_CHAT_HISTORY` environment variable to **_any value_** to enable.

```bash
# This can be any value, number, boolean, or string and it will have the same effect.
DISABLE_VIEW_CHAT_HISTORY="enable"
```

### Disable

Fully remove or comment out the `DISABLE_VIEW_CHAT_HISTORY` environment variable to return to the default behavior.

## Workspace Deletion Protection

Modification of the `WORKSPACE_DELETION_PROTECTION` environment variable prevents workspaces from being deleted from both the frontend UI and the API.

- This hides the delete workspace button in workspace settings as well as the delete action in the admin workspaces interface.
- This blocks workspace deletion via the developer API endpoint (`DELETE /v1/workspace/:slug`), which will return a `403` error.
- **No workspaces or their data are deleted when this is enabled. Existing workspaces are simply protected from being removed.**

### Enable

Set the `WORKSPACE_DELETION_PROTECTION` environment variable to **_any value_** to enable.

```bash
# This can be any value, number, boolean, or string and it will have the same effect.
WORKSPACE_DELETION_PROTECTION="enable"
```

### Disable

Fully remove or comment out the `WORKSPACE_DELETION_PROTECTION` environment variable to return to the default behavior.

## Simple SSO Passthrough

<Callout type="error" emoji="️🚨">
  **Important:** You should use an independent API key for using this feature so
  you can revoke it if needed. This feature configuration is best used for
  internally facing AnythingLLM instances that are not exposed to the public
  internet for the best security practices.
</Callout>

Modification of the `SIMPLE_SSO_ENABLED` environment variable allows easily enable third party SSO solutions that do not require a full OAuth integration. This environment variable
will enable you to generate a temporary authentication link **per user** that can be visited in browser to automatically login the user.

This feature is most useful for when you have AnythingLLM as a simple sub-service within a much larger system and you want to leverage existing user authentication flows within that system and want to provide a seamless login experience for your users to your AnythingLLM instance.

### Prerequisites

<Callout type="warning" emoji="️⚠️">
  **NOTE:** You should enable these configurations _after_ you have enabled multi-user mode, created at least one `admin` user, and have completed the onboarding flow
  in the AnythingLLM instance.
  <br/>
  Do **not** enabled these configurations before you have done this or else you may find yourself soft-locked out of the instance until you disable these flags.
</Callout>

- **Your instance must be in multi-user mode** to use this feature.
- You should provision an API key for AnythingLLM so you can create new users as well as issue temporary authentication links for users.
- The user must already exist within AnythingLLM before using this feature. You can create a user via the in-app interface or the API.
- You may want to disable the login page for all users in addition to using this feature. See [Disable Login Page](#disable-login-page).

### Enable

Set the `SIMPLE_SSO_ENABLED` environment variable to **_any value_** to enable.

```bash copy
# This can be any value, number, boolean, or string and it will have the same effect.
SIMPLE_SSO_ENABLED="enable"
```

### Integration

Once enabled, you can issue a temporary authentication link for a user leveraging the `/api/v1/users/{id}/issue-auth-token` endpoint via the AnythingLLM API.
You simply need to provide the user ID and the API key you created earlier to generate a temporary authentication token that can be used by the target user to login to AnythingLLM.

```bash copy
curl -X GET "https://your-anythingllm-instance.com/api/v1/users/{id}/issue-auth-token" \
  -H "Authorization: Bearer {api_key}"
# Example Response
# {
#   "token": "1234567890",
#   "loginPath": "/sso/simple?token=1234567890"
# }
```

Now, the user can visit the provided `loginPath` URL in their browser to be automatically logged in to AnythingLLM!

```text copy
https://your-anythingllm-instance.com/sso/simple?token=1234567890
```

All temporary authentication tokens expire after 1 hour and are single-use only. Once logged in, the user sessions will be valid for 30 days.
The user will be redirected to the home page of AnythingLLM after logging in.
You can optionally redirect the user to a different URL after successfully logging in by appending `&redirectTo={path/to/redirect}` to the query string of the login path.

For example:

```text copy
https://your-anythingllm-instance.com/sso/simple?token=1234567890&redirectTo=/workspaces/sample-workspace
```

Will redirect the user to the `/workspaces/sample-workspace` chat page after a successful login. This can be useful if you want to redirect the user to a specific workspace they have access to after logging in.

### Disable Login Page

If you are using the `SIMPLE_SSO_ENABLED` feature, you can disable the login page by setting the `SIMPLE_SSO_NO_LOGIN` environment variable to **_any value_**.

Setting `SIMPLE_SSO_NO_LOGIN` to **_any value_** in addition to `SIMPLE_SSO_ENABLED` & multi-user mode enabled will:
- Disable the traditional login page for any users including the instance administrator
- Prevent creation of new **Invitations** by any user
- Prevent any existing **Invitations** from being used for new users to create an account with.

```bash copy
# This can be any value, number, boolean, or string and it will have the same effect.
SIMPLE_SSO_ENABLED="enable"
SIMPLE_SSO_NO_LOGIN="enable"
```

### Disable

Fully remove or comment out the `SIMPLE_SSO_ENABLED` environment variable to return to the default behavior.

### Automatic Redirect for unauthenticated users

If you are using the `SIMPLE_SSO_ENABLED` feature, you can automatically redirect unauthenticated users to your bespoke login page by setting the `SIMPLE_SSO_NO_LOGIN_REDIRECT` environment variable to **_any valid full URL_**.

Setting `SIMPLE_SSO_NO_LOGIN_REDIRECT` to **_any valid full URL_** in addition to `SIMPLE_SSO_ENABLED` & `SIMPLE_SSO_NO_LOGIN` will:
- Automatically redirect unauthenticated users to the provided URL when they attempt to access the AnythingLLM instance home URL.
- If the user is using a token URL `/sso/simple?token=123...abcd`, they will still see the error page if their token is invalid or expired.

```bash copy
SIMPLE_SSO_ENABLED="enable"
SIMPLE_SSO_NO_LOGIN="enable"
# This must be a valid full URL - invalid or relative URLs will be ignored.
SIMPLE_SSO_NO_LOGIN_REDIRECT="https://your-bespoke-login-page.com"
```

### Disable

Fully remove or comment out the `SIMPLE_SSO_NO_LOGIN_REDIRECT` environment variable to return to the default behavior.

## AnythingLLM Hub Agent Skills

<Callout type="error" emoji="️🚨">
  **Important:** Agent skills can enable running untrusted code from untrusted
  sources. By default, AnythingLLM will not allow downloading agent skills from
  the AnythingLLM Hub.
</Callout>

Modification of the `COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED` environment variable allows you to pull in agent skills from the AnythingLLM Hub.

**By default, this feature is disabled.** The reason for this is that running untrusted code from untrusted sources can be very risky and we want to err on the side of caution for self-hosted instances.

There are two settings you can configure to control how this feature works:

- `COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=1`: This configures enables AnythingLLM to download agent skills from the AnythingLLM Hub but **only if the item is verified or a private item**.
- `COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=allow_all`: This configures enables AnythingLLM to download agent skills - including unverified public items - from the AnythingLLM Hub.

### Enable

Set the `COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED` environment variable to **1** or **allow_all** to enable.

```bash
# This can be any value, number, boolean, or string and it will have the same effect.
COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED="1"
# or to allow all (not recommended)
#COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED="allow_all"
```

### Disable

Fully remove or comment out the `COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED` environment variable to return to the default behavior.

## Local IP Address Scraping

<Callout type="info" emoji="️💡">
  **Note:** Enabling this flag should be done at your own risk since it will enable the collector to scrape or reach services running on local IP addresses.
</Callout>

Modification of the `COLLECTOR_ALLOW_ANY_IP` environment variable allows you to enable scraping of local IP addresses.
By default, the collector does not allow scraping of [local IP addresses](https://github.com/Mintplex-Labs/anything-llm/blob/master/collector/utils/url/index.js#L24).

However, for many reasons you may want to enable this feature - so we've added this configuration option to allow you to do so.

When enabled, you will see a log message in the collector logs indicating that local IP address scraping is enabled when using the web-scraping feature

### Enable

Set the `COLLECTOR_ALLOW_ANY_IP` environment variable to **`"true"`** to enable.
_It must be set to a string value of `"true"` to be effective._

```bash
# Must be set to a string value of "true" to be effective.
COLLECTOR_ALLOW_ANY_IP="true"
```

### Disable

Fully remove or comment out the `COLLECTOR_ALLOW_ANY_IP` environment variable to return to the default behavior.

## Disable Streaming for Generic OpenAI Provider

<Callout type="info" emoji="️💡">
  **Note:** This setting only affects the Generic OpenAI provider and does not impact other LLM providers. Use this when your custom LLM endpoint does not support streaming responses.
</Callout>

Modification of the `GENERIC_OPENAI_STREAMING_DISABLED` environment variable allows you to disable streaming responses when using the Generic OpenAI provider. This is particularly useful when you're using a custom LLM that doesn't support streaming responses.

By default, AnythingLLM attempts to use streaming for a better user experience. However, some custom LLM implementations may not support this feature, resulting in errors or unexpected behavior.

When this setting is enabled, all responses from your Generic OpenAI provider will be returned as complete responses rather than streamed chunks.

### Enable

Set the `GENERIC_OPENAI_STREAMING_DISABLED` environment variable to **`"true"`** to enable.
_It must be set to a string value of `"true"` to be effective._

```bash
# Must be set to a string value of "true" to be effective.
GENERIC_OPENAI_STREAMING_DISABLED="true"
```

### Disable

Fully remove or comment out the `GENERIC_OPENAI_STREAMING_DISABLED` environment variable to return to the default behavior of using streaming responses.

## Custom TTL for Sessions

<Callout type="info" emoji="️💡">
  **Note:** This configuration is only available for _self-hosted instances_.
</Callout>

Modification of the `JWT_EXPIRY` environment variable allows you to set a custom TTL for sessions.

By default, AnythingLLM will use a TTL of **30 days** for sessions.

### Enable

<Callout type="warning" emoji="️⚠️">
  **Notice:** The minimum TTL is 5 minutes.
</Callout>

Set the `JWT_EXPIRY` environment variable to **a valid duration string** to enable.
Valid duration strings can be found [from the Vercel `ms` library](https://github.com/vercel/ms?tab=readme-ov-file#examples).

```bash
# Must be set to a string value of a valid duration string.
JWT_EXPIRY="1d" # 1 day
#JWT_EXPIRY="60d" # 60 days
#JWT_EXPIRY="30m" # 30 minutes
```

### Disable

Fully remove or comment out the `JWT_EXPIRY` environment variable to return to the default behavior.

## Disable Swagger API Documentation

<Callout type="info" emoji="️💡">
  **Note:** It is recommended to disable this endpoint in production deployments for security purposes.
</Callout>

Modification of the `DISABLE_SWAGGER_DOCS` environment variable allows you to disable the Swagger API documentation endpoint at `/api/docs`.

By default, AnythingLLM exposes the Swagger API documentation at the `/api/docs` endpoint. While this can be useful for development and testing, it is recommended to disable this endpoint in production deployments to prevent exposing your API structure and available endpoints.

### Enable

Set the `DISABLE_SWAGGER_DOCS` environment variable to **`"true"`** to enable.
_It must be set to a string value of `"true"` to be effective._

```bash
# Must be set to a string value of "true" to be effective.
DISABLE_SWAGGER_DOCS="true"
```

### Disable

Fully remove or comment out the `DISABLE_SWAGGER_DOCS` environment variable to return to the default behavior and re-enable the Swagger documentation endpoint.

## Native Tool Calling for LLM Providers

<Callout type="info" emoji="️💡">
  **Note:** This setting only applies to local LLM providers. It has no impact on cloud LLMs like OpenAI, Anthropic, or Azure.
</Callout>

Modification of the `PROVIDER_SUPPORTS_NATIVE_TOOL_CALLING` environment variable allows you to enable native tool calling for supported LLM providers that cannot automatically detect tool calling support.

Some providers like Ollama, LM Studio, and the default built-in LLM provider automatically support native tool calling if your model supports it. However, other providers require this environment variable to be set.

Providers that require this flag:
- Generic OpenAI
- Groq
- AWS Bedrock
- Lemonade
- LiteLLM
- Local AI
- OpenRouter

### Enable

Set the `PROVIDER_SUPPORTS_NATIVE_TOOL_CALLING` environment variable to a comma-separated list of provider identifiers you want to enable.

```bash
PROVIDER_SUPPORTS_NATIVE_TOOL_CALLING="bedrock,generic-openai,groq,lemonade,litellm,local-ai,openrouter"
```

### Disable

Fully remove or comment out the `PROVIDER_SUPPORTS_NATIVE_TOOL_CALLING` environment variable to return to the default behavior.


## Automatic Tool Call Approval

Modification of the `AGENT_AUTO_APPROVED_SKILLS` environment variable allows you to automatically approve tool calls for all users.

Not all agent-skills ask for approval. Only skills that can be long-running, computationally expensive, or otherwise risky should ask for approval.

### Enable

Set the `AGENT_AUTO_APPROVED_SKILLS` environment variable to a comma-separated list of agent-skill-ids you want to automatically approve tool calls for. You can find the agent-skill-id by the `name` property in the [AnythingLLM Repository](https://github.com/Mintplex-Labs/anything-llm/tree/master/server/utils/agents/aibitat/plugins).

Optionally, you can just use the special `<all>` keyword to automatically approve tool calls for every agent-skill.

```bash
AGENT_AUTO_APPROVED_SKILLS="<all>" # Automatically approve tool calls for every agent-skill.
AGENT_AUTO_APPROVED_SKILLS="create-pdf-file,create-docx-file" # Automatically approve tool calls for specific agent-skills.
```

### Disable

Fully remove or comment out the `AGENT_AUTO_APPROVED_SKILLS` environment variable to return to the default behavior.

