Reference

Environment variables

The variables that providersFromEnv() and forgesFromEnv() read.

providersFromEnv() and forgesFromEnv() from forges/env read variables named FORGES_<KIND>_<FIELD>. Add _<SUFFIX> to a name to configure another instance of the same forge. See Configure from the environment.

Kinds

GITHUB, GITLAB, BITBUCKET, FORGEJO, GITEA, GITEE, AZURE_DEVOPS, CURSOR_ORIGIN, TANGLED and PUSHIN.

Fields

FieldDescription
TOKENA token credential
USERNAME, PASSWORDBasic credentials for Bitbucket and Azure DevOps
APP_ID, PRIVATE_KEY, INSTALLATION_IDApp credentials. GitHub and Cursor Origin. Write line breaks in PRIVATE_KEY as \n
IDENTIFIER, PASSWORD, PDSTangled app password credentials, and the PDS to use
ORGANIZATIONAzure DevOps organisation. Required for that forge
BASE_URLThe API base URL of the instance
INSTANCE, INSTANCE_VERSIONThe host to use in refs, and the version of the instance
API_URL, NOTIFICATIONS_URLTangled service URLs
WEBHOOK_SECRETThe secret used to verify deliveries
READ_ONLY1 or true creates the provider with readOnly: true
ENABLED1 or true creates an anonymous provider when no credential is set. 0 or false skips the set
DEMO_REPOA repository as owner/name, for tools that need one to show. GitLab owners can contain slashes. A set with a DEMO_REPO is anonymous when it has no credential

What each forge needs

ForgeCredentials
GitHubTOKEN, or APP_ID and PRIVATE_KEY
GitLab, Forgejo, Gitea, Gitee, pushin.euTOKEN
BitbucketTOKEN, or USERNAME and PASSWORD
Azure DevOpsORGANIZATION, and TOKEN, or USERNAME and PASSWORD
Cursor OriginTOKEN, or APP_ID and PRIVATE_KEY
TangledNone for reads. IDENTIFIER and PASSWORD for writes

Without a credential, a set is skipped unless ENABLED is on. Cursor Origin cannot be anonymous, and Tangled has no skip condition.

Copyright © 2026