Environment configuration

View Markdown

This page lists every environment variable that configures a Temporal Client, along with its TOML configuration key and the equivalent Temporal CLI flag. The Temporal CLI is a Temporal Client, so its variables are included here.

For how to use these variables and configuration files together, refer to Environment configuration.

Environment variables always take precedence over values in a TOML configuration file. An explicitly passed CLI flag takes precedence over the matching environment variable.

Client settings

Every SDK and the Temporal CLI read the variables below.

Variable	Description
TEMPORAL_CONFIG_FILE	Path to the TOML configuration file. Defaults to temporal.toml in a platform-specific directory. No TOML key; CLI flag --config-file.
TEMPORAL_PROFILE	Name of the configuration profile to load. Defaults to default. No TOML key; CLI flag --profile.
TEMPORAL_ADDRESS	Host and port of the Temporal Frontend Service, such as localhost:7233. TOML key profile.<name>.address; CLI flag --address.
TEMPORAL_NAMESPACE	Temporal Namespace to connect to. TOML key profile.<name>.namespace; CLI flag --namespace.
TEMPORAL_API_KEY	API key for authentication. When set, TLS is enabled by default. TOML key profile.<name>.api_key; CLI flag --api-key.
TEMPORAL_TLS	Set to true to enable TLS, false to disable it. TOML key profile.<name>.tls.disabled, which inverts the value: disabled = true turns TLS off. CLI flag --tls.
TEMPORAL_TLS_CLIENT_CERT_PATH	Filesystem path to the client's public TLS certificate. Cannot be combined with TEMPORAL_TLS_CLIENT_CERT_DATA. TOML key profile.<name>.tls.client_cert_path; CLI flag --tls-cert-path.
TEMPORAL_TLS_CLIENT_CERT_DATA	Raw PEM data for the client's public TLS certificate. Cannot be combined with TEMPORAL_TLS_CLIENT_CERT_PATH. TOML key profile.<name>.tls.client_cert_data; CLI flag --tls-cert-data.
TEMPORAL_TLS_CLIENT_KEY_PATH	Filesystem path to the client's private TLS key. Cannot be combined with TEMPORAL_TLS_CLIENT_KEY_DATA. TOML key profile.<name>.tls.client_key_path; CLI flag --tls-key-path.
TEMPORAL_TLS_CLIENT_KEY_DATA	Raw PEM data for the client's private TLS key. Cannot be combined with TEMPORAL_TLS_CLIENT_KEY_PATH. TOML key profile.<name>.tls.client_key_data; CLI flag --tls-key-data.
TEMPORAL_TLS_SERVER_CA_CERT_PATH	Filesystem path to the Certificate Authority certificate used to verify the server. Cannot be combined with TEMPORAL_TLS_SERVER_CA_CERT_DATA. TOML key profile.<name>.tls.server_ca_cert_path; CLI flag --tls-ca-path.
TEMPORAL_TLS_SERVER_CA_CERT_DATA	Raw PEM data for the Certificate Authority certificate used to verify the server. Cannot be combined with TEMPORAL_TLS_SERVER_CA_CERT_PATH. TOML key profile.<name>.tls.server_ca_cert_data; CLI flag --tls-ca-data.
TEMPORAL_TLS_SERVER_NAME	Overrides the server name used for Server Name Indication (SNI) in the TLS handshake. TOML key profile.<name>.tls.server_name; CLI flag --tls-server-name.
TEMPORAL_TLS_DISABLE_HOST_VERIFICATION	Disables server hostname verification. Use with caution. Not every SDK applies this setting. TOML key profile.<name>.tls.disable_host_verification; CLI flag --tls-disable-host-verification.
TEMPORAL_GRPC_META_*	Sets gRPC headers. The part after _META_ becomes the header key, so TEMPORAL_GRPC_META_SOME_KEY sets some-key. TOML key profile.<name>.grpc_meta; CLI flag --grpc-meta.

Client settings not read by every client

The variables below belong to the same client configuration, but support for them varies. Each one lists the clients that read it.

TEMPORAL_CODEC_ENDPOINT

Endpoint for a remote Codec Server. SDKs that read this variable do not apply the codec by default, so it is intended mostly for CLI use.

• TOML key: profile.<name>.codec.endpoint
• CLI flag: --codec-endpoint
• Read by: every client except Java

TEMPORAL_CODEC_AUTH

Authorization header value sent to the remote Codec Server.

• TOML key: profile.<name>.codec.auth
• CLI flag: --codec-auth
• Read by: every client except Java

TEMPORAL_CLIENT_AUTHORITY

Overrides the :authority gRPC header. This is a Go SDK extension with no equivalent in other clients and no CLI flag of its own.

• TOML key: profile.<name>.authority
• CLI flag: none
• Read by: Go

Temporal CLI settings

The Temporal CLI reads the variables below in addition to the client settings above. No other client reads them.

temporal env preset variables

The CLI supports a second configuration mechanism alongside TOML configuration files. temporal env stores named key-value presets in temporal.yaml, and the variables below select which preset the CLI reads.

Both mechanisms work. The temporal config command that manages TOML configuration files is currently experimental, while temporal env is not.

Variable	Description
TEMPORAL_ENV	Name of the active temporal env preset. Defaults to default. CLI flag --env.
TEMPORAL_ENV_FILE	Path to the preset file. Defaults to temporal.yaml in the CLI configuration directory. CLI flag --env-file.

Legacy TLS variables

The CLI reads an older set of TLS variable names for compatibility. When any of them is set, it overrides the corresponding value from the configuration file and from the preferred variable. These names have no CLI flag and no TOML key of their own.

Variable	Description
TEMPORAL_TLS_CERT	Superseded by TEMPORAL_TLS_CLIENT_CERT_PATH.
TEMPORAL_TLS_CERT_DATA	Superseded by TEMPORAL_TLS_CLIENT_CERT_DATA.
TEMPORAL_TLS_KEY	Superseded by TEMPORAL_TLS_CLIENT_KEY_PATH.
TEMPORAL_TLS_KEY_DATA	Superseded by TEMPORAL_TLS_CLIENT_KEY_DATA.
TEMPORAL_TLS_CA	Superseded by TEMPORAL_TLS_SERVER_CA_CERT_PATH.
TEMPORAL_TLS_CA_DATA	Superseded by TEMPORAL_TLS_SERVER_CA_CERT_DATA.