The complete reference for every environment variable and feature flag the Skills Marketplace container reads — runtime, authentication, authorization, and email.
The marketplace is configured entirely through environment variables. Nothing
below is required for a throwaway local run except the two unsecured flags;
everything else opts you into more capability or more lock-down.
| Variable | Default | Description |
|---|---|---|
PORT | 3000 | Public HTTP port the app listens on. |
NEXT_PORT | 3001 | Internal Next.js port (used by the in-container relay). |
USER_DATA_DIR | /app/user-data | Persistent storage (catalog, sessions, settings). Mount a volume here. |
NODE_ENV | production | The shipped image runs in production mode. |
LOG_LEVEL | info (prod) | trace | debug | info | warn | error. |
NEXTAUTH_URL | — | Public base URL of the deployment (must match your OAuth redirect URIs). |
AUTH_TRUST_HOST | true | Trust the request host (Auth.js v5). On by default so the container works on localhost and behind a reverse proxy under NODE_ENV=production; set false for strict host checking. |
NEXTAUTH_SECRET | — | Random secret used to sign session JWTs. Required for any non-unsecured deployment. |
MASK_PATTERNS | (empty) | Comma-separated extra patterns to mask in any surfaced terminal/log output. |
| Variable | Default | Description |
|---|---|---|
ENABLE_PKS_AGENT_MARKETPLACE_PLUGINS | true | Seed new workspaces' default marketplace with the bundled Agentics ("pks") plugins. Set false for a clean, empty marketplace you populate with your own plugins only. |
Set AGENTICS_TUNNEL_NAME to expose the container at a stable public HTTPS URL
through the self-hosted agent-tunnel — handy for testing a
local docker run from anywhere (or sharing it) without a reverse proxy. The
container installs the agent-tunnel client at build time and starts it
automatically when the name is set; the resolved public URL is also used as
NEXTAUTH_URL.
| Variable | Default | Description |
|---|---|---|
AGENTICS_TUNNEL_NAME | (unset) | Tunnel name. When set, the container opens https://app--<name>.tunnels.agentics.dk and forwards it to the app. Leave unset to disable. |
AGENTICS_TUNNEL_SERVER | wss://tunnels.agentics.dk:17443 | Tunnel control-plane URL. |
AGENTICS_TUNNEL_OWNER | agentics | Tunnel owner namespace. |
ALLOW_PUBLIC_UNSECURED | false | Required true to open a tunnel while AUTH_PROVIDER=unsecured. Safety backstop — a public URL + unsecured auth auto-signs-in anyone as admin, so the container refuses to start the tunnel otherwise. |
# Expose an unsecured local test container publicly (dev only):
docker run --rm --pull=always -p 3000:3000 \
-e AUTH_PROVIDER=unsecured -e ALLOW_UNSECURED_AUTH=true \
-e AGENTICS_TUNNEL_NAME=my-test -e ALLOW_PUBLIC_UNSECURED=true \
registry.agentics.dk/agentics/pks-agent-marketplace:latest
# → https://app--my-test.tunnels.agentics.dk:8443
The org sidebar ships lean — opt into the management surfaces you actually run. All default off.
| Variable | Default | Description |
|---|---|---|
ENABLE_ORGANIZATION_MANAGEMENT | false | Show the Organization group (org & access, billing, usage, data & privacy, capabilities). |
ENABLE_CUSTOM_ROLES | false | Show People → Custom Roles. |
ENABLE_LIBRARIES_CONNECTIONS | false | Show Libraries → Connectors. |
ENABLE_PERSONAL_SETTINGS | false | Show the Personal group (personal settings). |
People → Members always shows, but the Invite member button only appears
when an email provider is configured (EMAIL_PROVIDER set to smtp, azure, or
mailpit) — invites send mail, so it's hidden until mail can be sent.
Libraries → Skills is always available: a read-only viewer listing every skill across all plugins in the org (a plugin can provide multiple skills).
| Variable | Default | Description |
|---|---|---|
AUTH_PROVIDER | magic-link | unsecured | magic-link | oidc | microsoft-entra. See Authentication & access. |
ALLOW_UNSECURED_AUTH | false | Must be true for AUTH_PROVIDER=unsecured to run under NODE_ENV=production. Safety backstop. |
UNSECURED_AUTH_EMAIL | dev@local | Identity of the auto-login dev user (unsecured mode). |
UNSECURED_AUTH_NAME | Local Dev | Display name of the auto-login dev user. |
EMAIL_PROVIDER | mailpit (dev) | smtp | azure for magic-link. The mailpit default is dev-only — override in production. |
AZURE_AD_CLIENT_ID | — | Entra app registration — Application (client) ID. |
AZURE_AD_CLIENT_SECRET | — | Entra app registration — client secret. |
AZURE_AD_TENANT_ID | — | Entra app registration — Directory (tenant) ID. |
| Variable | Example | Effect |
|---|---|---|
AUTH_ALLOWED_TENANTS | <tenant-guid> | Reject sign-ins whose Entra tid isn't listed. The "only our company" gate. |
AUTH_ALLOWED_EMAIL_DOMAINS | customer.com | Email-domain allowlist. |
AUTH_ACCESS_MODE | open | invite | invite = deny-by-default (only existing/invited/allowlisted users). |
AUTH_ALLOWED_EMAILS | a@x.com,b@x.com | Explicit allowlist for invite mode. |
AUTH_ADMIN_GROUPS | <group-object-id> | Entra group → marketplace global-admin. |
AUTH_ADMIN_ROLES | Marketplace.Admin | Entra app-role → global-admin. |
AUTH_ADMIN_EMAILS | it@customer.com | Email → global-admin. |
Local dev (zero friction):
AUTH_PROVIDER=unsecured
ALLOW_UNSECURED_AUTH=true
Production, tenant-locked Entra, admins by app-role:
AUTH_PROVIDER=microsoft-entra
NEXTAUTH_URL=https://marketplace.yourco.com
NEXTAUTH_SECRET=<random-base64>
AZURE_AD_CLIENT_ID=...
AZURE_AD_CLIENT_SECRET=...
AZURE_AD_TENANT_ID=...
AUTH_ALLOWED_TENANTS=<your-tenant-guid>
AUTH_ADMIN_ROLES=Marketplace.Admin