Environment variables
All runtime configuration of the server comes from environment variables.
Storage and serving
| Variable | Default | Purpose |
|---|---|---|
PORT | 8787 (8080 in the Docker image) | HTTP port. Railway injects its own |
AI_COST_DATA_DIR | working directory | Directory for the SQLite file and price cache. The Dockerfile sets /data |
AI_COST_DB | <data dir>/ai-cost.db | Explicit path of the SQLite database |
AI_COST_PRICE_CACHE | <data dir>/.litellm-prices-cache.json | Cached LiteLLM price table |
AI_COST_LOCAL_PRICES | unset | 1 uses only the bundled price table, no download |
COSTPILOT_STATIC_DIR | unset | Directory of the built dashboard to serve. The Dockerfile sets it |
CORS_ORIGINS | * | Comma-separated origins allowed to call /api/*. Explicit origins also allow the session cookie. Only needed for split hosting |
DEMO_MODE | unset | 1 seeds the demo dataset into an empty database, wipes and reseeds the whole database on the first request of each UTC day, flags demo in /api/meta, turns accounts off, hides the Admin Area and makes branding read-only |
NODE_ENV | unset (production in the Docker image) | production enables Secure cookies when COSTPILOT_PUBLIC_URL is unset and rate-limits sign-in |
Accounts and access
| Variable | Default | Purpose |
|---|---|---|
COSTPILOT_PUBLIC_URL | unset | Public dashboard URL, e.g. https://costpilot.example.com. Recommended: pins the trusted origin and cookie security. Needed when serving over plain HTTP on a non-localhost host, otherwise the browser drops the Secure cookie |
COSTPILOT_AUTH_SECRET | generated | Cookie signing secret (32+ random chars). Unset = generated once and stored in the database |
COSTPILOT_ADMIN_EMAIL / COSTPILOT_ADMIN_PASSWORD | unset | Creates the first admin on startup while no account exists |
COSTPILOT_AUTH | on | off disables accounts, e.g. behind a reverse proxy that authenticates already. DEMO_MODE=1 implies it |
COSTPILOT_INGEST_TOKEN | unset | Bearer token required on /v1/* (telemetry, session-map, agent-config) |
COSTPILOT_BASIC_AUTH from earlier versions is gone; see
Secure your instance.
Debugging
| Variable | Default | Purpose |
|---|---|---|
COSTPILOT_OTLP_DUMP | unset | File path. Every /v1/logs and /v1/metrics request is appended as received, one JSON line per request, before any normalization. See Capture raw telemetry |
Dashboard build (split hosting only)
| Variable | Purpose |
|---|---|
VITE_API_URL | API origin the separately hosted dashboard calls |