Environment Variables & Security

Distinguishing between sensitive server-only variables and public runtime configurations is critical for secure deployment.

Interactive Configuration Generator

Interactive Environment Config Generator

部署模式

Key 管理模式

访问端口 (WEB_PORT)

开启 Live WS 代理 (/api/live)开启第三方兼容反代 (/api/openai)开启 MCP stdio 进程支持

# AMC-WebUI Docker 容器环境变量配置 (.env)
# 端口映射设置
WEB_PORT=8080
PORT=3001

# 密钥与安全配置
# 默认 BYOK 模式：浏览器设置中的 API Key 优先生效，以下服务端 Key 留空作为安全兜底
GEMINI_API_KEY=
SERVER_KEY_PRIORITY=false

# Gemini 上游地址
GEMINI_API_BASE=https://generativelanguage.googleapis.com
RUNTIME_API_PROXY_URL=/api/gemini

# Live API WebSocket 全代理设置
ENABLE_LIVE_WS_PROXY=true
RUNTIME_LIVE_API_BASE_URL=/api/live
LIVE_WS_IDLE_TIMEOUT_MS=300000

# 第三方 OpenAI 兼容端点反代
RUNTIME_THIRD_PARTY_PROXY_URL=/api/openai

Environment Variables Matrix

Variable	Purpose	Scope	Default
`WEB_PORT`	Host exposed port for web container	Host	`8080`
`PORT`	Node API server listening port	Server	`3001`
`GEMINI_API_KEY`	Optional server-managed Gemini key	Server only	empty
`LIVE_GEMINI_API_KEY`	Dedicated server key for Live WS proxy	Server only	empty
`SERVER_KEY_PRIORITY`	`true`=server priority; `false`=browser key first	Server	`false`
`ALLOWED_ORIGINS`	Comma-separated CORS whitelist	Server	empty
`ENABLE_LIVE_WS_PROXY`	Enable `/api/live` WebSocket proxying	Server	`true`
`ENABLE_MCP_STDIO`	Allow running local stdio MCP processes	Server	`false`
`THIRD_PARTY_ROUTES`	Third-party provider routing table JSON	Server only	empty
`RUNTIME_API_PROXY_URL`	Frontend Gemini proxy endpoint	Public runtime	`/api/gemini`
`RUNTIME_LIVE_API_BASE_URL`	Frontend Live WS endpoint	Public runtime	`/api/live`
`RUNTIME_THIRD_PARTY_PROXY_URL`	Third-party proxy endpoint	Public runtime	`/api/openai`

⚠️ Security Boundary Notice

This multi-service setup is tailored for trusted self-hosted environments:

Standard BYOK uses browser keys. This architecture does not provide multi-tenant authentication or billing quotas for open public internet access.
Deploy reverse proxy authentication (Nginx, Traefik, or Cloudflare Access) when exposing endpoints publicly.