# Environment variables

## Read by wb

| Variable                   | Effect                                                                                                                              |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `WORKBENCH_HOME`           | The data directory. Defaults to `~/.workbench`. Must be on a local disk.                                                            |
| `NO_COLOR`                 | Disable color in human output.                                                                                                      |
| `FORCE_COLOR`              | Force color in human output.                                                                                                        |
| `DO_NOT_TRACK`             | Any non-empty value other than `0` disables anonymous save and run counts and their notice.                                         |
| `E2B_API_KEY`              | The E2B key. Overrides the key saved by `wb connect --runtime e2b` for one process. Never enters a sandbox.                         |
| `DAYTONA_API_KEY`          | The Daytona key. Overrides the saved key for one process. Never enters a sandbox.                                                   |
| `DAYTONA_API_URL`          | A Daytona API endpoint other than the public one.                                                                                   |
| `GH_TOKEN`, `GITHUB_TOKEN` | GitHub access for private sources and `--repo` runs, in that order, falling back to `gh auth login`.                                |
| Provider keys              | Such as `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `OPENROUTER_API_KEY`. See [Provider variables](/docs/cli/models#provider-variables). |
| `CLAUDE_CODE_OAUTH_TOKEN`  | A `claude setup-token` subscription token for Claude Code on Docker and E2B.                                                        |
| Declared variables         | Names the Workbench declares under `env`, bound into the run.                                                                       |

## Read by the installer

| Variable                | Effect                                                |
| ----------------------- | ----------------------------------------------------- |
| `XDG_BIN_HOME`          | Where to install, when set. Otherwise `~/.local/bin`. |
| `WORKBENCH_INSTALL_DIR` | Install somewhere else, the same as `--bin-dir`.      |

## Set inside a run

| Variable                     | Value                                                                     |
| ---------------------------- | ------------------------------------------------------------------------- |
| `WORKBENCH_OUTPUT_DIR`       | The run's outbox. Files written here are returned as artifacts.           |
| `WORKBENCH_WORKSPACE_<NAME>` | The path of each bound named workspace, with hyphens as underscores.      |
| `GH_TOKEN`                   | For `--repo` runs, the GitHub credential the runner's `git` and `gh` use. |

Only manifest-declared values, credential variables for the selected provider, and the selected runner's private credential store reach a run. Runtime keys stay on the host.

## Files in WORKBENCH_HOME

| Path                                | Contents                                                                                                                 |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `catalog.json`, `packages/`         | Saved aliases and content-addressed package snapshots.                                                                   |
| `wb.db`, `files/`                   | Sessions, runs, events, and projects in one SQLite database, and the runner state, checkouts, and scratch they refer to. |
| `outcomes/`, `blobs/`               | Retained results.                                                                                                        |
| `connections.json`                  | `wb connect` defaults. No secrets.                                                                                       |
| `metadata/models/`                  | The cached model catalog, refreshed every 6 hours.                                                                       |
| `studio/`                           | The running Studio's owner-only state and its one-time open pages.                                                       |
| `credentials.json`                  | Registry organization keys, mode `0600`.                                                                                 |
| `runtime.secrets.json`              | E2B and Daytona keys, mode `0600`.                                                                                       |
| `runtime-credentials/e2b/<runner>/` | Runner credentials synced into E2B sandboxes.                                                                            |
| `worker/`                           | A worker's own engine home, key, and member directories.                                                                 |

Never open the credential files. Check them with `wb whoami` and `wb connect --runtime <name> --status`.