> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heylua.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment variables

> Every LUA_* variable the CLI reads, what it changes, and its default

The CLI reads these variables from the shell environment. At startup it also loads the `.env` file in the current directory into that environment, so any of them can be set there; a variable already set in the shell wins. None of them is sent to the platform. `lua status --json` reports the credential and URL variables under `environment.envOverrides`.

*Verified against lua-cli 3.33.0.*

## Credentials and URLs

| Variable          | Effect                                                                                                                                 | Default                     |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| `LUA_API_KEY`     | The [API key](/concepts/credentials) every command uses. Takes precedence over a saved user session and over `~/.lua-cli/credentials`. | unset                       |
| `LUA_API_URL`     | Base URL of the platform API, including chat.                                                                                          | `https://api.heylua.ai`     |
| `LUA_AUTH_URL`    | Base URL of the authentication service that `lua auth` talks to.                                                                       | `https://auth.heylua.ai`    |
| `LUA_WEBHOOK_URL` | Base URL webhooks are served from. Defined, but no command reads it in 3.33.0.                                                         | `https://webhook.heylua.ai` |

A user session is stored per `LUA_API_URL` and `LUA_AUTH_URL` pair. Pointing the CLI at another environment means signing in again there. Two more variables, `LUA_FIREBASE_WEB_API_KEY` and `LUA_POSTHOG_KEY`, point the CLI at Lua's own test environments and have no use outside them.

## Output and diagnostics

| Variable           | Effect                                                                                                                                                                  | Default                          |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
| `LUA_DEBUG`        | `1`, `true`, or `yes` prints the stack trace under an error's typed line. Same as `--debug`.                                                                            | off                              |
| `LUA_NO_HINTS`     | `1`, `true`, or `yes` suppresses `✨ Tip:` lines after a command and `💡 Diagnose:` follow-ups under an error. The hint that explains the error itself is still printed. | off                              |
| `LUA_NO_BANNER`    | Any value hides the `lua-cli v3.33.0` banner that bare `lua` and `--help` print.                                                                                        | off                              |
| `LUA_FORCE_BANNER` | Any value prints the banner even when stdout is not a terminal.                                                                                                         | off                              |
| `NO_COLOR`         | Any value prints the banner as plain text without ANSI styling.                                                                                                         | off                              |
| `LUA_TELEMETRY`    | `false`, `0`, `off`, or `no` disables usage telemetry and overrides the choice saved by `lua telemetry on` or `lua telemetry off`; any other value enables it.          | saved choice, enabled at install |
| `CI`               | Recorded as a property on telemetry events only; it changes no behaviour. Use the `--ci` flag for that.                                                                 | unset                            |

## Workflow push

| Variable                | Effect                                                                                                                                                                             | Default |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| `LUA_PUSH_ENV_CHECK`    | `error` turns the `env-key-missing` warning of `lua push workflow`, printed when the workflow reads `env()` keys that have no value in the target environment, into a failed push. | warn    |
| `LUA_PUSH_SHOW_OVERLAY` | `1` prints the names of the `env.template()` keys resolved for the pushed workflow and the overlay hash. Values are never printed.                                                 | off     |

## Local sandbox for lua test

`lua test` runs your code in a local sandbox with the same module and network policy as the deployed runtime. These variables are read from the CLI's own environment, not from the variables handed to your code, so a tool cannot widen the allowlist from inside the sandbox.

| Variable                       | Effect                                                                                                  | Default |
| ------------------------------ | ------------------------------------------------------------------------------------------------------- | ------- |
| `LUA_SANDBOX_REQUIRE_MODE`     | `enforce` refuses `require()` calls the sandbox policy disallows; in `log` mode they are only reported. | `log`   |
| `LUA_SANDBOX_EGRESS_FILTER`    | `log` reports outbound connections outside the allowlist; `enforce` blocks them.                        | `off`   |
| `LUA_ALLOWED_EGRESS_CIDRS`     | Comma-separated CIDR ranges added to the egress allowlist.                                              | none    |
| `LUA_ALLOWED_EGRESS_HOSTNAMES` | Comma-separated hostnames added to the egress allowlist.                                                | none    |

Sandbox policy events print to stderr as `[sandbox] {…}` JSON lines.

## See also

* [CLI overview](/reference/cli/overview) — credential precedence and local files
* [`lua env`](/reference/cli/env) — the agent's own sandbox and production variables, which `env()` reads in your code
* [Automate releases in CI](/ship/ci-and-automation)