Configuration
Every environment variable.
| Variable | Default | Purpose |
|---|---|---|
CLI2API_PORT | 51222 | HTTP listen port |
CLI2API_API_KEYS | (empty) | Comma-separated inbound API key allow-list; empty = no auth |
CLI2API_JOBSTORE_DSN | (empty = memory) | libsql DSN (file:... / libsql://...?authToken=...) |
CLI2API_JOB_RETENTION | 168h | Job row retention; 0s = never expire (reaper skips sweeps) |
CLI2API_REAPER_INTERVAL | 1h | Reaper sweep period; 0s = disabled |
CLI2API_JOB_HARD_CAP_MULT | 3.0 | Hard-cap multiplier for in-flight jobs (force-delete past expires_at + retention × N). Range 1.0–1000.0 |
CLI2API_IMAGE_TIMEOUT | 5m | Max wait for sync image/speech generation |
CLI2API_POLL_INTERVAL | 2s | Initial upstream poll cadence |
CLI2API_POLL_MAX_INTERVAL | 10s | Poll backoff ceiling |
CLI2API_USAGE_DSN | (empty = memory) | libsql DSN for per-call usage records — see Usage endpoint. |
CLI2API_USAGE_RETENTION | 720h (30d) | Records older than this are reaped. 0s = never expire. |
CLI2API_USAGE_BUFFER | 1024 | Async writer channel size. |
CLI2API_LOG_LEVEL | info | debug / info / warn / error |
MULERUN_TOKEN | (reads cache file then ~/.mulerun/) | Upstream MuleRun token (muk- or JWT) |
MULERUN_API_BASE_URL | https://api.mulerun.com | Upstream gateway base URL |
CLI2API_TOKEN_CACHE | (~/.config/mulerun/oauth_cache.json) | OAuth cache path. Set to a writable file for production containers / dedicated-user systemd setups. cli2api refreshes JWTs and caches the exchanged muk- here. |
CLI2API_OAUTH_TIMEOUT | 10s | Per-call deadline for the JWT exchange + token refresh round-trips. Bounds cold-start work under k8s/PaaS readiness probes. |
MULERUN_OAUTH_BASE_URL | https://mulerun.com | OAuth/platform host (cli-token + oauth2/token endpoints). Distinct from the inference gateway above. |
See .env.example in the repo for a copy-paste template.
Credential discovery order
MULERUN_TOKENenv varmuk-...→ used as-iseyJ...(JWT) → exchanged at startup; not cached to disk (see caveat)
CLI2API_TOKEN_CACHEif set, else~/.config/mulerun/oauth_cache.json(mulerun-cli ≥0.1.0)cli2api_muk_keyfield → fast-path, no HTTP- else
access_token+refresh_token→ refresh if expired, exchange to muk-, persist muk- back for the next startup
~/.mulerun/{auth,credentials,token}.json(older versions)
The startup log's token_source field shows which source was used.
Env-JWT caveat: a JWT passed via MULERUN_TOKEN is re-exchanged on every
restart (we don't write back to env). To benefit from disk caching, put your
JWT in a file at CLI2API_TOKEN_CACHE instead.
Reaper retention semantics
- Terminal jobs (
completed/failed): deleted onceexpires_atpasses - In-flight jobs (
queued/in_progress): kept untilexpires_at + retention × CLI2API_JOB_HARD_CAP_MULT(default 3×) — gives a client time to keep polling CLI2API_JOB_RETENTION=0disables the sweep entirely — nothing is auto-deleted