Secrets and workspace backup
Configure shared secrets and optional workspace backup.
Use this page when hosted Team OS needs shared secret sync or workspace file backup.
Shared secrets
| Variable | Required | Example | Notes |
|---|---|---|---|
TEAM_OS_SECRETS_KEYS | for shared secrets | v1:<base64url-32-byte-key> | Encrypts shared secrets and private config backups. |
TEAM_OS_SECRETS_ACTIVE_KEY_ID | for shared secrets | v1 | Required when keys are set, or when more than one key is present. |
Use these variables when you want shared .env sync or private .mcp.json
backup.
Without them, local secrets can still work. Remote secret backup and secret sync are unavailable.
Workspace backup
| Variable | Required | Example | Notes |
|---|---|---|---|
TEAM_OS_GITHUB_BACKUP_REMOTE | optional | https://github.com/org/private-backup.git | Private GitHub repo for files under AGENTIC_OS_DIR. |
TEAM_OS_GITHUB_BACKUP_TOKEN | if remote is set | generated GitHub token | Token with read and write access to the backup repo. |
TEAM_OS_GITHUB_BACKUP_BRANCH | optional | main | Backup branch. Default is main. |
TEAM_OS_GITHUB_BACKUP_USER_NAME | optional | Team OS Backup | Git author name for backup commits. |
TEAM_OS_GITHUB_BACKUP_USER_EMAIL | optional | team-os-backup@example.invalid | Git author email for backup commits. |
TEAM_OS_GITHUB_BACKUP_INTERVAL_SECONDS | optional | 900 | How often the API backs up the workspace. Set 0 to disable it. |
Workspace backup covers server-side files written under AGENTIC_OS_DIR. It
does not replace Postgres backups.
The backup does not include .env, .mcp.json, runtime state, build output,
local transcripts, or backups/.
The API container must have git installed. The published beta image includes
it. If you build a custom image, install git before enabling workspace backup.
Safe examples
It is safe to document variable names in .env.example:
MEMORY_STORE_BACKEND=postgres
MEMORY_DATABASE_URL=
PGSSLMODE=disable
MEMORY_API_PUBLIC_URL=
BETTER_AUTH_URL=
MEMORY_API_BOOTSTRAP_TEAM_SLUG=
MEMORY_API_BOOTSTRAP_OWNER_EMAIL=Do not put real values for these in committed docs or screenshots:
POSTGRES_PASSWORD
MEMORY_DATABASE_URL
MEMORY_API_TOKEN
BETTER_AUTH_SECRET
TEAM_OS_SECRETS_KEYSTreat MEMORY_API_TOKEN as an internal dev fallback token. Normal users should
sign in with email and password.
Next: Docker Compose