mirror of
https://github.com/Significant-Gravitas/AutoGPT.git
synced 2026-04-08 03:00:28 -04:00
57b17dc8e1
### Why / What / How **Why:** We need a third credential type: **system-provided but unique per user** (managed credentials). Currently we have system credentials (same for all users) and user credentials (user provides their own keys). Managed credentials bridge the gap — the platform provisions them automatically, one per user, for integrations like AgentMail where each user needs their own pod-scoped API key. **What:** - Generic **managed credential provider registry** — any integration can register a provider that auto-provisions per-user credentials - **AgentMail** is the first consumer: creates a pod + pod-scoped API key using the org-level API key - Managed credentials appear in the credential dropdown like normal API keys but with `autogpt_managed=True` — users **cannot update or delete** them - **Auto-provisioning** on `GET /credentials` — lazily creates managed credentials when users browse their credential list - **Account deletion cleanup** utility — revokes external resources (pods, API keys) before user deletion - **Frontend UX** — hides the delete button for managed credentials on the integrations page **How:** ### Backend **New files:** - `backend/integrations/managed_credentials.py` — `ManagedCredentialProvider` ABC, global registry, `ensure_managed_credentials()` (with per-user asyncio lock + `asyncio.gather` for concurrency), `cleanup_managed_credentials()` - `backend/integrations/managed_providers/__init__.py` — `register_all()` called at startup - `backend/integrations/managed_providers/agentmail.py` — `AgentMailManagedProvider` with `provision()` (creates pod + API key via agentmail SDK) and `deprovision()` (deletes pod) **Modified files:** - `credentials_store.py` — `autogpt_managed` guards on update/delete, `has_managed_credential()` / `add_managed_credential()` helpers - `model.py` — `autogpt_managed: bool` + `metadata: dict` on `_BaseCredentials` - `router.py` — calls `ensure_managed_credentials()` in list endpoints, removed explicit `/agentmail/connect` endpoint - `user.py` — `cleanup_user_managed_credentials()` for account deletion - `rest_api.py` — registers managed providers at startup - `settings.py` — `agentmail_api_key` setting ### Frontend - Added `autogpt_managed` to `CredentialsMetaResponse` type - Conditionally hides delete button on integrations page for managed credentials ### Key design decisions - **Auto-provision in API layer, not data layer** — keeps `get_all_creds()` side-effect-free - **Race-safe** — per-(user, provider) asyncio lock with double-check pattern prevents duplicate pods - **Idempotent** — AgentMail SDK `client_id` ensures pod creation is idempotent; `add_managed_credential()` uses upsert under Redis lock - **Error-resilient** — provisioning failures are logged but never block credential listing ### Changes 🏗️ | File | Action | Description | |------|--------|-------------| | `backend/integrations/managed_credentials.py` | NEW | ABC, registry, ensure/cleanup | | `backend/integrations/managed_providers/__init__.py` | NEW | Registers all providers at startup | | `backend/integrations/managed_providers/agentmail.py` | NEW | AgentMail provisioning/deprovisioning | | `backend/integrations/credentials_store.py` | MODIFY | Guards + managed credential helpers | | `backend/data/model.py` | MODIFY | `autogpt_managed` + `metadata` fields | | `backend/api/features/integrations/router.py` | MODIFY | Auto-provision on list, removed `/agentmail/connect` | | `backend/data/user.py` | MODIFY | Account deletion cleanup | | `backend/api/rest_api.py` | MODIFY | Provider registration at startup | | `backend/util/settings.py` | MODIFY | `agentmail_api_key` setting | | `frontend/.../integrations/page.tsx` | MODIFY | Hide delete for managed creds | | `frontend/.../types.ts` | MODIFY | `autogpt_managed` field | ### Checklist 📋 #### For code changes: - [x] I have clearly listed my changes in the PR description - [x] I have made a test plan - [x] I have tested my changes according to the test plan: - [x] 23 tests pass in `router_test.py` (9 new tests for ensure/cleanup/auto-provisioning) - [x] `poetry run format && poetry run lint` — clean - [x] OpenAPI schema regenerated - [x] Manual: verify managed credential appears in AgentMail block dropdown - [x] Manual: verify delete button hidden for managed credentials - [x] Manual: verify managed credential cannot be deleted via API (403) #### For configuration changes: - [x] `.env.default` is updated with `AGENTMAIL_API_KEY=` --------- Co-authored-by: Zamil Majdy <zamil.majdy@agpt.co>
199 lines
6.3 KiB
Plaintext
199 lines
6.3 KiB
Plaintext
# Backend Configuration
|
|
# This file contains environment variables that MUST be set for the AutoGPT platform
|
|
# Variables with working defaults in settings.py are not included here
|
|
|
|
## ===== REQUIRED DATABASE CONFIGURATION ===== ##
|
|
# PostgreSQL Database Connection
|
|
DB_USER=postgres
|
|
DB_PASS=your-super-secret-and-long-postgres-password
|
|
DB_NAME=postgres
|
|
DB_PORT=5432
|
|
DB_HOST=localhost
|
|
DB_CONNECTION_LIMIT=12
|
|
DB_CONNECT_TIMEOUT=60
|
|
DB_POOL_TIMEOUT=300
|
|
DB_SCHEMA=platform
|
|
DATABASE_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
|
|
DIRECT_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
|
|
PRISMA_SCHEMA="postgres/schema.prisma"
|
|
|
|
## ===== REQUIRED SERVICE CREDENTIALS ===== ##
|
|
# Redis Configuration
|
|
REDIS_HOST=localhost
|
|
REDIS_PORT=6379
|
|
# REDIS_PASSWORD=
|
|
|
|
# RabbitMQ Credentials
|
|
RABBITMQ_DEFAULT_USER=rabbitmq_user_default
|
|
RABBITMQ_DEFAULT_PASS=k0VMxyIJF9S35f3x2uaw5IWAl6Y536O7
|
|
|
|
# Supabase Authentication
|
|
SUPABASE_URL=http://localhost:8000
|
|
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
|
|
JWT_VERIFY_KEY=your-super-secret-jwt-token-with-at-least-32-characters-long
|
|
|
|
## ===== REQUIRED SECURITY KEYS ===== ##
|
|
# Generate using: from cryptography.fernet import Fernet;Fernet.generate_key().decode()
|
|
ENCRYPTION_KEY=dvziYgz0KSK8FENhju0ZYi8-fRTfAdlz6YLhdB_jhNw=
|
|
UNSUBSCRIBE_SECRET_KEY=HlP8ivStJjmbf6NKi78m_3FnOogut0t5ckzjsIqeaio=
|
|
|
|
## ===== IMPORTANT OPTIONAL CONFIGURATION ===== ##
|
|
# Platform URLs (set these for webhooks and OAuth to work)
|
|
PLATFORM_BASE_URL=http://localhost:8000
|
|
FRONTEND_BASE_URL=http://localhost:3000
|
|
|
|
# Media Storage (required for marketplace and library functionality)
|
|
MEDIA_GCS_BUCKET_NAME=
|
|
|
|
## ===== API KEYS AND OAUTH CREDENTIALS ===== ##
|
|
# All API keys below are optional - only add what you need
|
|
|
|
# AI/LLM Services
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
GROQ_API_KEY=
|
|
LLAMA_API_KEY=
|
|
AIML_API_KEY=
|
|
V0_API_KEY=
|
|
OPEN_ROUTER_API_KEY=
|
|
NVIDIA_API_KEY=
|
|
|
|
# Langfuse Prompt Management
|
|
# Used for managing the CoPilot system prompt externally
|
|
# Get credentials from https://cloud.langfuse.com or your self-hosted instance
|
|
LANGFUSE_PUBLIC_KEY=
|
|
LANGFUSE_SECRET_KEY=
|
|
LANGFUSE_HOST=https://cloud.langfuse.com
|
|
|
|
# OAuth Credentials
|
|
# For the OAuth callback URL, use <your_frontend_url>/auth/integrations/oauth_callback,
|
|
# e.g. http://localhost:3000/auth/integrations/oauth_callback
|
|
|
|
# GitHub OAuth App server credentials - https://github.com/settings/developers
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
|
|
# Notion OAuth App server credentials - https://developers.notion.com/docs/authorization
|
|
# Configure a public integration
|
|
NOTION_CLIENT_ID=
|
|
NOTION_CLIENT_SECRET=
|
|
|
|
# Google OAuth App server credentials - https://console.cloud.google.com/apis/credentials, and enable gmail api and set scopes
|
|
# https://console.cloud.google.com/apis/credentials/consent ?project=<your_project_id>
|
|
# You'll need to add/enable the following scopes (minimum):
|
|
# https://console.developers.google.com/apis/api/gmail.googleapis.com/overview ?project=<your_project_id>
|
|
# https://console.cloud.google.com/apis/library/sheets.googleapis.com/ ?project=<your_project_id>
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# Twitter (X) OAuth 2.0 with PKCE Configuration
|
|
# 1. Create a Twitter Developer Account:
|
|
# - Visit https://developer.x.com/en and sign up
|
|
# 2. Set up your application:
|
|
# - Navigate to Developer Portal > Projects > Create Project
|
|
# - Add a new app to your project
|
|
# 3. Configure app settings:
|
|
# - App Permissions: Read + Write + Direct Messages
|
|
# - App Type: Web App, Automated App or Bot
|
|
# - OAuth 2.0 Callback URL: http://localhost:3000/auth/integrations/oauth_callback
|
|
# - Save your Client ID and Client Secret below
|
|
TWITTER_CLIENT_ID=
|
|
TWITTER_CLIENT_SECRET=
|
|
|
|
# Linear App
|
|
# Make a new workspace for your OAuth APP -- trust me
|
|
# https://linear.app/settings/api/applications/new
|
|
# Callback URL: http://localhost:3000/auth/integrations/oauth_callback
|
|
LINEAR_API_KEY=
|
|
# Linear project and team IDs for the feature request tracker.
|
|
# Find these in your Linear workspace URL: linear.app/<workspace>/project/<project-id>
|
|
# and in team settings. Used by the chat copilot to file and search feature requests.
|
|
LINEAR_FEATURE_REQUEST_PROJECT_ID=
|
|
LINEAR_FEATURE_REQUEST_TEAM_ID=
|
|
LINEAR_CLIENT_ID=
|
|
LINEAR_CLIENT_SECRET=
|
|
|
|
# To obtain Todoist API credentials:
|
|
# 1. Create a Todoist account at todoist.com
|
|
# 2. Visit the Developer Console: https://developer.todoist.com/appconsole.html
|
|
# 3. Click "Create new app"
|
|
# 4. Once created, copy your Client ID and Client Secret below
|
|
TODOIST_CLIENT_ID=
|
|
TODOIST_CLIENT_SECRET=
|
|
|
|
NOTION_CLIENT_ID=
|
|
NOTION_CLIENT_SECRET=
|
|
|
|
# Discord OAuth App credentials
|
|
# 1. Go to https://discord.com/developers/applications
|
|
# 2. Create a new application
|
|
# 3. Go to OAuth2 section and add redirect URI: http://localhost:3000/auth/integrations/oauth_callback
|
|
# 4. Copy Client ID and Client Secret below
|
|
DISCORD_CLIENT_ID=
|
|
DISCORD_CLIENT_SECRET=
|
|
|
|
REDDIT_CLIENT_ID=
|
|
REDDIT_CLIENT_SECRET=
|
|
|
|
# Payment Processing
|
|
STRIPE_API_KEY=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
|
|
# Email Service (for sending notifications and confirmations)
|
|
POSTMARK_SERVER_API_TOKEN=
|
|
POSTMARK_SENDER_EMAIL=invalid@invalid.com
|
|
POSTMARK_WEBHOOK_TOKEN=
|
|
|
|
# Error Tracking
|
|
SENTRY_DSN=
|
|
|
|
# Feature Flags
|
|
LAUNCH_DARKLY_SDK_KEY=
|
|
|
|
# Content Generation & Media
|
|
DID_API_KEY=
|
|
FAL_API_KEY=
|
|
IDEOGRAM_API_KEY=
|
|
REPLICATE_API_KEY=
|
|
REVID_API_KEY=
|
|
SCREENSHOTONE_API_KEY=
|
|
UNREAL_SPEECH_API_KEY=
|
|
ELEVENLABS_API_KEY=
|
|
|
|
# Data & Search Services
|
|
E2B_API_KEY=
|
|
EXA_API_KEY=
|
|
JINA_API_KEY=
|
|
MEM0_API_KEY=
|
|
OPENWEATHERMAP_API_KEY=
|
|
GOOGLE_MAPS_API_KEY=
|
|
|
|
# Communication Services
|
|
DISCORD_BOT_TOKEN=
|
|
MEDIUM_API_KEY=
|
|
MEDIUM_AUTHOR_ID=
|
|
SMTP_SERVER=
|
|
SMTP_PORT=
|
|
SMTP_USERNAME=
|
|
SMTP_PASSWORD=
|
|
|
|
# Business & Marketing Tools
|
|
AGENTMAIL_API_KEY=
|
|
APOLLO_API_KEY=
|
|
ENRICHLAYER_API_KEY=
|
|
AYRSHARE_API_KEY=
|
|
AYRSHARE_JWT_KEY=
|
|
SMARTLEAD_API_KEY=
|
|
ZEROBOUNCE_API_KEY=
|
|
|
|
# PostHog Analytics
|
|
# Get API key from https://posthog.com - Project Settings > Project API Key
|
|
POSTHOG_API_KEY=
|
|
POSTHOG_HOST=https://eu.i.posthog.com
|
|
|
|
# Tally Form Integration (pre-populate business understanding on signup)
|
|
TALLY_API_KEY=
|
|
|
|
# Other Services
|
|
AUTOMOD_API_KEY=
|