Environment variables

Variables are read from the process environment when you run scan or config. Unless noted, omitting a variable leaves that setting to the config file or built-in defaults.

For CLI flags that mirror these settings, see Scan arguments. For the YAML rules behind detection and classification, see Scan patterns. For the resulting dataflow.json and how to consume it, see Output and results.

Scan and detection (`DATAPARADE_*`)

DATAPARADE_EXCLUDES — Comma-separated list of glob-like path patterns to exclude from ingest (same role as repeated --exclude flags). Merged with built-in excludes (tests, Storybook, .env / .env.*, etc.).
DATAPARADE_MIN_CONFIDENCE — Floating-point number in 0–1; minimum confidence for keeping detections (same role as --minimum-confidence).

Security defaults

Project .env files under the scan root (.env, .env.local, …) are not ingested by default and are never sent in AI provider prompts. Scanning a single .env file path is also skipped with a security warning.
This is separate from cli/.env (below), which only supplies CLI process environment defaults when you run the binary locally.

Workspace CLI key (upload + platform AI + quota)

DATAPARADE_WORKSPACE_API_KEY — Workspace API key from Workspace → Access keys. Same role as --workspace-api-key on scan and upload. Used for:
- Upload / auto-upload — POST /api/scans/cli/upload after scan (default) or via the upload command. Does not consume scan quota.
- Platform AI — when inference is on (default): quota preflight, platform infer tasks (POST /api/scans/cli/ai/infer/tasks), and complete reporting. With inference off (SCAN_AI_INFERENCE=false / --no-ai-inference), the key is still used for upload when auto-upload is enabled; it is not used for quota on structural-only scans. Legacy alias DATAPARADE_API_KEY logs a deprecation warning.
DATAPARADE_API_BASE_URL — DataParade API origin for upload, workspace quota, and platform LLM (no trailing slash). Published npm installs do not need this. Set to http://localhost:3000 only for monorepo/local backend dev. Legacy alias: DATAPARADE_API_URL.
DATAPARADE_APP_URL — Web app origin for dashboard preview links after upload (no trailing slash). Published npm installs default to production. Set to http://localhost:3001 for monorepo/local frontend dev. See Upload to dashboard.
DATAPARADE_SKIP_AUTO_UPLOAD — When true, 1, yes, or on, skips the post-scan upload step. Same role as --skip-auto-upload. Upload via upload still works when this is set.

LLM inference (`SCAN_AI_*`)

SCAN_AI_INFERENCE — Opt out of LLM inference with false, 0, no, or off (default is on). Truthy values (1, true, yes, on) keep inference enabled. Same role as --ai-inference / --no-ai-inference. Legacy: DATAPARADE_AI_INFERENCE.
SCAN_AI_HTTP_TIMEOUT_MS — Provider HTTP timeout in ms (default 120000). Legacy: DATAPARADE_AI_HTTP_TIMEOUT_MS.
SCAN_AI_ENDPOINT, SCAN_AI_TEMPERATURE, SCAN_AI_MAX_TOKENS, SCAN_AI_MAX_CALLS, SCAN_AI_BUDGET_TOKENS, SCAN_AI_PROVIDER_CONCURRENCY, SCAN_AI_MAX_CANDIDATES_PER_AGENT, SCAN_AI_INFERENCE_SCOPE, SCAN_AI_TOOL_LOOP_*, SCAN_AI_THIRD_PARTY_DATA_FLOW — Same roles as the matching CLI flags / config keys.

When inference is on (the default), you must supply either:

BYOK (your provider): SCAN_BYOK_PROVIDER, SCAN_BYOK_MODEL, SCAN_BYOK_API_KEY, or
Platform (DataParade billing): DATAPARADE_WORKSPACE_API_KEY after a successful quota preflight, or
Anonymous platform AI (no workspace key): session created automatically; IP-capped; tokens debit on claim.

BYOK and workspace key together are rejected. With inference on and neither credential nor anonymous session, the CLI exits with code 2.

Structural heuristics (flow patches, local third-party enrichment) run when inference is off and are not counted in metadata.aiInference token totals.

There is no env var for --ai-verbose; use the flag or aiVerbose in config.

dataparade config [path] redacts SCAN_BYOK_API_KEY and DATAPARADE_WORKSPACE_API_KEY as <redacted> in printed JSON.

BYOK provider (`SCAN_BYOK_*`)

SCAN_BYOK_PROVIDER — openai, anthropic, gemini, openrouter, local, mock. Aliases: --byok-provider, --ai-provider.
SCAN_BYOK_MODEL — Model name. Aliases: --byok-model, --ai-model.
SCAN_BYOK_API_KEY — Provider API key (env only).

Backend worker (hosted scans only)

SCAN_WORKER_LLM_API_KEY — Platform LLM secret injected into hosted scan workers.
SCAN_WORKER_LLM_PROVIDER, SCAN_WORKER_LLM_MODEL — Provider and model for hosted scans.

For how inference uses these settings (tool loop, data-flow insights, agentic trace), see AI inference.

Provider debug logging (optional)

SCAN_AI_DEBUG — When 1, true, yes, or on, logs extra provider HTTP and normalization detail to the console (all providers). Legacy: DATAPARADE_AI_DEBUG (one-time deprecation warning).

OpenAI-specific options (optional)

Read directly by the OpenAI adapter; not merged through the generic scan config loader.

DATAPARADE_AI_OPENAI_JSON_SCHEMA — Set to 0, false, or no to prefer json_object response shaping instead of json_schema for chat completions.
DATAPARADE_AI_OPENAI_JSON_SCHEMA_STRICT — When 1, true, or yes, enables strict JSON-schema mode where the OpenAI integration supports it.

LangSmith tracing (optional)

Used by the bundled LangSmith integration for scan and AI spans. See LangSmith docs . Trace payloads are summary-only (counts and ids, not file contents or full scan output). Upload failures are logged and do not fail the scan.

LANGSMITH_API_KEY or LANGCHAIN_API_KEY — API key; tracing stays off if neither is set or empty.
LANGCHAIN_TRACING_V2 — Set to true to turn tracing on (together with a key above).
LANGSMITH_TRACING — Alternative to LANGCHAIN_TRACING_V2: set to true with a key to enable tracing.
LANGSMITH_PROJECT or LANGCHAIN_PROJECT — Optional project name for organizing runs.

Local `.env` in the CLI package

When not running under NODE_ENV=test, the CLI loads cli/.env from the @dataparade/cli package root (if the file exists) via dotenv with override: false: variables already set in your shell or process keep their values, and the file only fills in missing keys. Those entries then behave like the environment variables above for resolution order against dataparade.config.json and CLI flags.