Environment Variables

Use the EASY_BPM_<APP>_<VARIABLE> naming standard for customer-facing configuration. Infrastructure-specific variables, such as managed database or broker settings, keep the names required by those services.

Backend API

Variable	Default
EASY_BPM_SERVER_PORT	8080
EASY_BPM_SERVER_DATASOURCE_URL	jdbc:postgresql://localhost:5432/easybpm
EASY_BPM_SERVER_DATASOURCE_USERNAME	meu_usuario
EASY_BPM_SERVER_DATASOURCE_PASSWORD	minha_senha
EASY_BPM_SERVER_RABBITMQ_HOST	localhost
EASY_BPM_SERVER_RABBITMQ_PORT	5672
EASY_BPM_SERVER_RABBITMQ_USERNAME	easybpm
EASY_BPM_SERVER_RABBITMQ_PASSWORD	easybpm
EASY_BPM_SERVER_MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE	health,metrics,prometheus
EASY_BPM_SERVER_MANAGEMENT_HEALTH_SHOW_DETAILS	always
EASY_BPM_SERVER_LOGGING_LEVEL_ROOT	INFO
EASY_BPM_SERVER_LOGGING_LEVEL_APP	DEBUG
EASY_BPM_SERVER_LOGGING_LEVEL_HIBERNATE	WARN
EASY_BPM_SERVER_AI_ENCRYPTION_KEY	default-dev-key-change-in-prod-1234
EASY_BPM_SERVER_TEST_DATA_ENABLED	false
EASY_BPM_SERVER_RETENTION_ENABLED	false
EASY_BPM_SERVER_RETENTION_COMPLETED_PROCESS_RETENTION_DAYS	90
EASY_BPM_SERVER_RETENTION_COMPLETED_TASK_RETENTION_DAYS	90
EASY_BPM_SERVER_RETENTION_BATCH_SIZE	500
EASY_BPM_SERVER_RETENTION_CRON	0 0 3 * * *

EASY_BPM_SERVER_TEST_DATA_ENABLED=true seeds demo/test process definitions, instances, tasks, and variables at backend startup. Keep it disabled in production.

Retention defaults seed the first saved maintenance policy record. After the Admin Console saves retention settings, those values become the runtime source for scheduled cleanup until changed again.

Agentic orchestration and AI providers

Agent Process execution can use a credential stored in the Easy BPM credential vault or an environment variable reference. Environment references must include the leading $ in the deployed model, for example:

{
  "provider": {
    "providerId": "gemini",
    "modelName": "gemini-3.5-flash",
    "credentialRef": "$GEMINI_API_KEY"
  }
}

In that example, the backend process must have GEMINI_API_KEY configured in its runtime environment. When credentialRef does not start with $, the backend treats it as a stored credential ID.

Variable	Purpose
OPENAI_API_KEY	OpenAI API key used when an Agent Process or AI task references "$OPENAI_API_KEY".
GEMINI_API_KEY	Google Gemini API key used when an Agent Process or AI task references "$GEMINI_API_KEY".
AZURE_OPENAI_API_KEY	Azure OpenAI API key used when an Agent Process or AI task references "$AZURE_OPENAI_API_KEY".
EASY_BPM_SERVER_AI_ENCRYPTION_KEY	Key used to encrypt credentials stored in the Easy BPM credential vault. Use a unique production value.

Local Ollama testing does not require a credential by default. Use providerId: "ollama" with model llama3.2. When no endpoint is supplied, the backend uses http://localhost:11434/api/generate.

PowerShell local example:

$env:GEMINI_API_KEY="AIza..."
$env:AZURE_OPENAI_API_KEY="azure-openai-key"
$env:EASY_BPM_SERVER_AI_ENCRYPTION_KEY="replace-with-a-production-secret"

For local agentic orchestration testing, keep API keys in your shell environment or an untracked .env file.

Worker

Variable	Default
EASY_BPM_WORKER_PORT	0
EASY_BPM_WORKER_DATASOURCE_URL	jdbc:postgresql://localhost:5432/easybpm
EASY_BPM_WORKER_DATASOURCE_USERNAME	meu_usuario
EASY_BPM_WORKER_DATASOURCE_PASSWORD	minha_senha
EASY_BPM_WORKER_RABBITMQ_HOST	localhost
EASY_BPM_WORKER_RABBITMQ_PORT	5672
EASY_BPM_WORKER_RABBITMQ_USERNAME	easybpm
EASY_BPM_WORKER_RABBITMQ_PASSWORD	easybpm
EASY_BPM_WORKER_LOGGING_LEVEL_APP	INFO

Security bootstrap

Variable	Default
EASY_BPM_SERVER_SECURITY_ENABLED	true
EASY_BPM_SERVER_SECURITY_JWT_SECRET	development-only default
EASY_BPM_SERVER_SECURITY_JWT_EXPIRATION_MS	3600000
EASY_BPM_SERVER_SECURITY_BOOTSTRAP_ADMIN_USERNAME	admin
EASY_BPM_SERVER_SECURITY_BOOTSTRAP_ADMIN_PASSWORD	admin
EASY_BPM_SERVER_SECURITY_BOOTSTRAP_ADMIN_GROUP_CODE	ADMIN
EASY_BPM_SERVER_SECURITY_BOOTSTRAP_ADMIN_GROUP_NAME	Administrators

Keycloak and OIDC

Variable	Purpose
EASYBPM_AUTHENTICATION_PROVIDER	Set to keycloak or oidc to validate external OIDC tokens. Defaults to local.
EASYBPM_OIDC_ISSUER_URI	OIDC issuer URL. Required when OIDC is enabled.
EASYBPM_OIDC_JWK_SET_URI	Optional internal JWK endpoint; useful when the backend reaches Keycloak over a Docker network.
EASYBPM_OIDC_CLIENT_ID	OIDC client ID. Defaults to easybpm.
EASYBPM_OIDC_AUDIENCE	Required audience claim. Leave unset to disable audience validation.
EASYBPM_OIDC_GROUP_CLAIM	Token claim containing groups. Defaults to groups.
EASYBPM_OIDC_USERNAME_CLAIM	Token claim used as the Easy BPM username. Defaults to preferred_username.

Web apps

Variable	Purpose
EASY_BPM_ADMIN_API_BASE_URL	Backend API URL used by the Admin Console.
EASY_BPM_MODELER_API_BASE_URL	Backend API URL used by the Modeler.
EASY_BPM_MODELER_AGENTIC_ORCHESTRATION	Enables the feature-flagged Agent Process resource in the Modeler when set to true, 1, yes, on, or enabled. Defaults to disabled.
EASY_BPM_MODELER_DEFAULT_AI_PROVIDER	Default provider selected by the Agent Process editor.
EASY_BPM_MODELER_DEFAULT_AI_MODEL	Default model selected by the Agent Process editor.
EASY_BPM_MODELER_DEFAULT_AI_CREDENTIAL_REF	Default credential reference selected by the Agent Process editor.
EASY_BPM_TASK_PORTAL_API_BASE_URL	Backend API URL used by the Task Portal.

Run the feature-flagged modeler locally with:

$env:EASY_BPM_MODELER_AGENTIC_ORCHESTRATION="true"
npm run dev