---
title: "Environment variables"
description: "The variables that providersFromEnv() and forgesFromEnv() read."
canonical_url: "https://forges.link/reference/environment-variables"
---
# Environment variables

> The variables that providersFromEnv() and forgesFromEnv() read.

This page lists every variable that `providersFromEnv()` and `forgesFromEnv()` from `forges/env` read. Their names follow the pattern `FORGES_<KIND>_<FIELD>`. If you add `_<SUFFIX>` to a name, the variable belongs to another instance of the same forge. To learn how to use them, read [Configure from the environment](https://forges.link/guides/environment).

## Kinds

`<KIND>` is one of `GITHUB`, `GITLAB`, `BITBUCKET`, `FORGEJO`, `GITEA`, `GITEE`, `AZURE_DEVOPS`, `CURSOR_ORIGIN`, `TANGLED`, `PUSHIN` and `CLOUDFLARE_ARTIFACTS`.

## Fields

`<FIELD>` is one of the following. Some of them only apply to certain forges, as the descriptions say.

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        TOKEN
      </code>
    </td>
    
    <td>
      A token credential
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        USERNAME
      </code>
      
      , <code>
        PASSWORD
      </code>
    </td>
    
    <td>
      Basic credentials for Bitbucket and Azure DevOps
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        APP_ID
      </code>
      
      , <code>
        PRIVATE_KEY
      </code>
      
      , <code>
        INSTALLATION_ID
      </code>
    </td>
    
    <td>
      App credentials. GitHub and Cursor Origin. Write line breaks in <code>
        PRIVATE_KEY
      </code>
      
       as <code>
        \n
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        IDENTIFIER
      </code>
      
      , <code>
        PASSWORD
      </code>
      
      , <code>
        PDS
      </code>
    </td>
    
    <td>
      Tangled app password credentials, and the PDS to use
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ORGANIZATION
      </code>
    </td>
    
    <td>
      Azure DevOps organisation. Required for that forge
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ACCOUNT_ID
      </code>
    </td>
    
    <td>
      Cloudflare account that holds the Artifacts namespaces. Required for that forge
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        BASE_URL
      </code>
    </td>
    
    <td>
      The API base URL of the instance
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        INSTANCE
      </code>
      
      , <code>
        INSTANCE_VERSION
      </code>
    </td>
    
    <td>
      The host to use in refs, and the version of the instance
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        API_URL
      </code>
      
      , <code>
        NOTIFICATIONS_URL
      </code>
    </td>
    
    <td>
      Tangled service URLs
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        WEBHOOK_SECRET
      </code>
    </td>
    
    <td>
      The secret used to verify deliveries
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        READ_ONLY
      </code>
    </td>
    
    <td>
      <code>
        1
      </code>
      
       or <code>
        true
      </code>
      
       creates the provider with <code>
        readOnly: true
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ENABLED
      </code>
    </td>
    
    <td>
      <code>
        1
      </code>
      
       or <code>
        true
      </code>
      
       creates an anonymous provider when no credential is set. <code>
        0
      </code>
      
       or <code>
        false
      </code>
      
       skips the set
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        DEMO_REPO
      </code>
    </td>
    
    <td>
      A repository as <code>
        owner/name
      </code>
      
      , for tools that need one to show. GitLab owners can contain slashes. A set with a <code>
        DEMO_REPO
      </code>
      
       is anonymous when it has no credential
    </td>
  </tr>
</tbody>
</table>

## What each forge needs

A set of variables creates a provider when it contains one of the credentials that its forge accepts. Without a credential, a set can still create an anonymous provider if it has `ENABLED` or `DEMO_REPO`, except for forges that don't allow anonymous access. The optional fields take effect together with a credential. The following table shows what each forge needs and what happens without one.

<forge-requirements>
<table>
<thead>
  <tr>
    <th>
      Forge
    </th>
    
    <th>
      Credentials
    </th>
    
    <th>
      Optional
    </th>
    
    <th>
      Without a credential
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      GitHub
    </td>
    
    <td>
      <code>
        TOKEN
      </code>
      
      , or <code>
        APP_ID
      </code>
      
       and <code>
        PRIVATE_KEY
      </code>
    </td>
    
    <td>
      <code>
        INSTALLATION_ID
      </code>
      
       with <code>
        APP_ID
      </code>
      
       and <code>
        PRIVATE_KEY
      </code>
    </td>
    
    <td>
      Anonymous reads with <code>
        ENABLED
      </code>
      
       or <code>
        DEMO_REPO
      </code>
      
      . Skipped otherwise
    </td>
  </tr>
  
  <tr>
    <td>
      GitLab, Forgejo, Gitea, Gitee, Pushin.eu
    </td>
    
    <td>
      <code>
        TOKEN
      </code>
    </td>
    
    <td>
      None
    </td>
    
    <td>
      Anonymous reads with <code>
        ENABLED
      </code>
      
       or <code>
        DEMO_REPO
      </code>
      
      . Skipped otherwise
    </td>
  </tr>
  
  <tr>
    <td>
      Bitbucket
    </td>
    
    <td>
      <code>
        TOKEN
      </code>
      
      , or <code>
        USERNAME
      </code>
      
       and <code>
        PASSWORD
      </code>
    </td>
    
    <td>
      None
    </td>
    
    <td>
      Anonymous reads with <code>
        ENABLED
      </code>
      
       or <code>
        DEMO_REPO
      </code>
      
      . Skipped otherwise
    </td>
  </tr>
  
  <tr>
    <td>
      Azure DevOps
    </td>
    
    <td>
      <code>
        ORGANIZATION
      </code>
      
      , and <code>
        TOKEN
      </code>
      
      , or <code>
        USERNAME
      </code>
      
       and <code>
        PASSWORD
      </code>
    </td>
    
    <td>
      None
    </td>
    
    <td>
      Anonymous reads with <code>
        ENABLED
      </code>
      
       or <code>
        DEMO_REPO
      </code>
      
      . Skipped otherwise
    </td>
  </tr>
  
  <tr>
    <td>
      Cursor Origin
    </td>
    
    <td>
      <code>
        TOKEN
      </code>
      
      , or <code>
        APP_ID
      </code>
      
       and <code>
        PRIVATE_KEY
      </code>
    </td>
    
    <td>
      <code>
        INSTALLATION_ID
      </code>
      
       with <code>
        APP_ID
      </code>
      
       and <code>
        PRIVATE_KEY
      </code>
    </td>
    
    <td>
      Webhooks only with <code>
        ENABLED
      </code>
      
      . Skipped otherwise
    </td>
  </tr>
  
  <tr>
    <td>
      Tangled
    </td>
    
    <td>
      <code>
        IDENTIFIER
      </code>
      
       and <code>
        PASSWORD
      </code>
    </td>
    
    <td>
      <code>
        PDS
      </code>
      
      , <code>
        API_URL
      </code>
      
       and <code>
        NOTIFICATIONS_URL
      </code>
    </td>
    
    <td>
      Anonymous reads
    </td>
  </tr>
  
  <tr>
    <td>
      Cloudflare Artifacts
    </td>
    
    <td>
      <code>
        ACCOUNT_ID
      </code>
      
      , and <code>
        TOKEN
      </code>
    </td>
    
    <td>
      None
    </td>
    
    <td>
      Skipped, even with <code>
        ENABLED
      </code>
    </td>
  </tr>
</tbody>
</table>
</forge-requirements>

If you aren't sure which variables or token scopes you need for a task, the [credentials picker](https://forges.link/guides/environment#pick-the-variables-for-a-task) works it out for you.


## Sitemap

See the full [sitemap](https://forges.link/sitemap.md) for all pages.