> ## Documentation Index
> Fetch the complete documentation index at: https://schedy.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Tune Schedy with the --port flag and a handful of environment variables.

The port is set with the `--port` flag (default `8080`). Behavior is tuned with environment variables:

| Variable                           | Default | Description                                                                                                                                                                                                                               |
| ---------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `SCHEDY_API_KEY`                   | *unset* | If set, all endpoints require the `X-API-Key` header.                                                                                                                                                                                     |
| `SCHEDY_CORS_ORIGIN`               | *unset* | Comma-separated origins allowed to call the API from a browser (e.g. `https://app.example.com`), or `*` for any. Unset disables CORS.                                                                                                     |
| `SCHEDY_DATA_DIR`                  | `data`  | Directory where BadgerDB persists tasks. Used by both the server and `schedy restore`, so set it the same way for both.                                                                                                                   |
| `SCHEDY_HISTORY_TTL`               | `72h`   | How long terminal tasks are retained before purge (Go duration, e.g. `24h`, `168h`).                                                                                                                                                      |
| `SCHEDY_ALLOW_PRIVATE_TARGETS`     | *unset* | If set, allow task URLs that resolve to private/loopback/link-local addresses. Off by default: such targets are rejected at dial time to prevent SSRF into the host's network. See [Delivery](/concepts/delivery#blocked-targets).        |
| `SCHEDY_ON_FAILURE_URL`            | *unset* | If set, a task that exhausts its retries POSTs `{id, status, attempts, last_error, status_code}` here once, best-effort. A task can override this with its own `on_failure_url` field. See [Retries](/concepts/retries#failure-callback). |
| `SCHEDY_SIGNING_SECRET`            | *unset* | If set, every outgoing request is signed with an `X-Schedy-Signature` HMAC so receivers can authenticate it. See [Delivery](/concepts/delivery#signed-requests).                                                                          |
| `SCHEDY_MAX_CONCURRENT_DELIVERIES` | `50`    | How many deliveries may be in flight at once. Bounds the burst a backlog can aim at your endpoints. See [Catch-up](/concepts/catch-up).                                                                                                   |
| `SCHEDY_MAX_STALENESS`             | *unset* | If set (Go duration, e.g. `1h`), a task that comes due more than this late is skipped instead of delivered. Unset means catch everything up. See [Catch-up](/concepts/catch-up).                                                          |
| `SCHEDY_LOG_FORMAT`                | `text`  | Log output format: `text` (human-readable) or `json` (one object per line, for log shippers).                                                                                                                                             |
| `SCHEDY_LOG_LEVEL`                 | `info`  | Minimum log level: `debug`, `info`, `warn`, or `error`. Unrecognized values fall back to `info`.                                                                                                                                          |

Example:

```bash theme={null}
SCHEDY_API_KEY=your-secret SCHEDY_HISTORY_TTL=168h ./schedy --port 8080
```

<Warning>
  Leave `SCHEDY_ALLOW_PRIVATE_TARGETS` unset in any environment reachable from untrusted clients. Enabling it lets task URLs reach private, loopback, and cloud-metadata addresses on the host's network.
</Warning>