Configuration

Base URL and environment variables for the Output API server

Base URL

http://localhost:3001

In production, set the OUTPUT_API_PORT environment variable to change the port.

Environment Variables

The API server reads these environment variables:

Variable	Default	Description
NODE_ENV	development	Set to production to enable auth and production behavior
OUTPUT_API_PORT	3000	HTTP port (e.g. output dev often uses 3001)
OUTPUT_API_SERVICE_NAME	output-api	Service name for logging
OUTPUT_API_AUTH_TOKEN	—	Required in production. Basic auth token for all endpoints except /health
OUTPUT_CATALOG_ID	—	Required. Task queue and catalog workflow ID (must match worker)
TEMPORAL_ADDRESS	localhost:7233	Temporal server address
TEMPORAL_NAMESPACE	default	Temporal namespace
TEMPORAL_API_KEY	—	Temporal Cloud API key (optional for local)
TEMPORAL_WORKFLOW_EXECUTION_TIMEOUT	24h	Max workflow execution duration
TEMPORAL_WORKFLOW_EXECUTION_MAX_WAITING	300000	Max wait for workflow result (ms, 5 min)
TEMPORAL_GRPC_MAX_MESSAGE_SIZE_BYTES	33554432 (32 MiB)	Max gRPC message size (send + receive) for the Temporal client. Raise if large workflow results hit RESOURCE_EXHAUSTED.
OUTPUT_TRACE_REMOTE_S3_BUCKET	—	S3 bucket holding remote traces. Required for the API to serve traces from S3
OUTPUT_AWS_REGION	us-west-1	AWS region for the trace bucket
OUTPUT_AWS_ACCESS_KEY_ID	—	AWS access key for reading remote traces
OUTPUT_AWS_SECRET_ACCESS_KEY	—	AWS secret key for reading remote traces

AWS Credential Permissions

The API only reads traces — the worker is what uploads them (see Tracing for the write-side policy). The credentials in OUTPUT_AWS_ACCESS_KEY_ID / OUTPUT_AWS_SECRET_ACCESS_KEY must allow read access to the trace bucket:

Action	Resource	Why
s3:GetObject	arn:aws:s3:::<bucket>/*	Fetch individual trace objects
s3:ListBucket	arn:aws:s3:::<bucket>	List traces for a workflow

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [ "s3:GetObject", "s3:ListBucket" ],
      "Resource": [
        "arn:aws:s3:::my-traces",
        "arn:aws:s3:::my-traces/*"
      ]
    }
  ]
}

If these read permissions are missing, trace fetches fail with a generic download error. A misconfigured bucket policy — granting the worker write access but not granting the API identity s3:GetObject / s3:ListBucket — is the most common cause of output workflow debug and dataset generate --download failing against production runs.