# Configuration When running Memgraph Lab with Docker or Docker Compose, you can configure it using the environment variables. > **Info** > > Passing environment variables is **not supported** for Memgraph Lab desktop > application. To customize Memgraph Lab, run it with Docker. ## Changing configuration When running Memgraph Lab with **Docker**, configure the environment variables using the `docker run` command: ```bash docker run -d -p 3000:3000 --name lab -e QUERY_MAX_LEN=10000 -e MODULE_NAME_MAX_LEN=2500 memgraph/lab ``` For **Docker Compose**, define the same environment variables within the `environment` section of your service configuration in the `docker-compose.yml` file: ```yaml environment: - QUERY_MAX_LEN=10000 - MODULE_NAME_MAX_LEN=2500 ``` ### Adding Memgraph Enterprise license Some Memgraph Lab features require a [valid Memgraph Enterprise license](https://memgraph.com/docs/database-management/enabling-memgraph-enterprise) **configured on the Lab side**. Ensure that you configure the following environment variables when running Lab with Docker: | Variable | Description | Type | |-------------------------------|--------------------------------------|------------| | `ENTERPRISE_LICENSE_ORG_NAME` | Enterprise license organization name | `string` | | `ENTERPRISE_LICENSE_KEY` | Enterprise license key | `string` | For example: ``` docker run \ -p 3000:3000 \ -e ENTERPRISE_LICENSE_ORG_NAME="My company" \ -e ENTERPRISE_LICENSE_KEY="key..." \ memgraph/lab ``` Once you've added the enterprise license key and organization name, and if everything is configured correctly, you should see the following log message from Memgraph Lab: ```bash INFO: Enterprise license applied successfully. Enjoy the premium features. ``` > **Info** > > Since Memgraph Lab is only configurable via Docker, features that require a > valid Memgraph Enterprise license are available only in a Docker environment. ## List of environment variables | Variable | Description | Type | Default | |------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|-----------------------------------| | `AUTH_NATIVE_IS_DISABLED` | Enable or disable native authentication (username, password) | `boolean` | `false` | | `AUTH_SSO_STATE_SECRET` | Secret key used to encrypt shared state during the SSO flow; if not set, Lab generates a random one at startup | `string` | | | `AUTH_SSO_STATE_EXPIRY_SEC` | Duration (in seconds) for which the SSO state remains valid | `number` | `300` | | `AUTH_OIDC_ENTRA_ID_IS_ENABLED` | Enable or disable Entra ID SSO authentication via OIDC | `boolean` | `false` | | `AUTH_OIDC_ENTRA_ID_DISPLAY_NAME` | Entra ID OIDC display name "Sign in with ``" | `string` | `"Entra ID"` | | `AUTH_OIDC_ENTRA_ID_AUTHORIZATION_URL` | Entra ID OIDC authorization URL | `string` | | | `AUTH_OIDC_ENTRA_ID_TOKEN_URL` | Entra ID OIDC token URL | `string` | | | `AUTH_OIDC_ENTRA_ID_USER_INFO_URL` | Entra ID OIDC user info URL | `string` | | | `AUTH_OIDC_ENTRA_ID_CLIENT_ID` | Entra ID OIDC client ID | `string` | | | `AUTH_OIDC_ENTRA_ID_CLIENT_SECRET` | Entra ID OIDC client secret | `string` | | | `AUTH_OIDC_ENTRA_ID_CALLBACK_URL` | Entra ID OIDC callback URL | `string` | | | `AUTH_OIDC_ENTRA_ID_SCOPE` | Entra ID OIDC scope | `string` | `"openid profile offline_access"` | | `AUTH_OIDC_ENTRA_ID_PKCE_IS_ENABLED` | Enables PKCE flow for Entra ID OIDC integration | `boolean` | `false` | | `AUTH_OIDC_OKTA_IS_ENABLED` | Enable or disable Okta SSO authentication via OIDC | `boolean` | `false` | | `AUTH_OIDC_OKTA_DISPLAY_NAME` | Okta OIDC display name "Sign in with ``" | `string` | `"Okta"` | | `AUTH_OIDC_OKTA_AUTHORIZATION_URL` | Okta OIDC authorization URL | `string` | | | `AUTH_OIDC_OKTA_TOKEN_URL` | Okta OIDC token URL | `string` | | | `AUTH_OIDC_OKTA_USER_INFO_URL` | Okta OIDC user info URL | `string` | | | `AUTH_OIDC_OKTA_CLIENT_ID` | Okta OIDC client ID | `string` | | | `AUTH_OIDC_OKTA_CLIENT_SECRET` | Okta OIDC client secret | `string` | | | `AUTH_OIDC_OKTA_CALLBACK_URL` | Okta OIDC callback URL | `string` | | | `AUTH_OIDC_OKTA_SCOPE` | Okta OIDC scope | `string` | `"openid profile offline_access"` | | `AUTH_OIDC_OKTA_PKCE_IS_ENABLED` | Enables PKCE flow for Okta OIDC integration | `boolean` | `false` | | `AUTH_OIDC_CUSTOM_IS_ENABLED` | Enable or disable custom SSO authentication via OIDC | `boolean` | `false` | | `AUTH_OIDC_CUSTOM_DISPLAY_NAME` | Custom OIDC display name "Sign in with ``" | `string` | `"SSO"` | | `AUTH_OIDC_CUSTOM_AUTHORIZATION_URL` | Custom OIDC authorization URL | `string` | | | `AUTH_OIDC_CUSTOM_TOKEN_URL` | Custom OIDC token URL | `string` | | | `AUTH_OIDC_CUSTOM_USER_INFO_URL` | Custom OIDC user info URL | `string` | | | `AUTH_OIDC_CUSTOM_CLIENT_ID` | Custom OIDC client ID | `string` | | | `AUTH_OIDC_CUSTOM_CLIENT_SECRET` | Custom OIDC client secret | `string` | | | `AUTH_OIDC_CUSTOM_CALLBACK_URL` | Custom OIDC callback URL | `string` | | | `AUTH_OIDC_CUSTOM_SCOPE` | Custom OIDC scope | `string` | `"openid profile offline_access"` | | `AUTH_OIDC_CUSTOM_PKCE_IS_ENABLED` | Enables PKCE flow for custom OIDC integration | `boolean` | `false` | | `AUTH_SAML_ENTRA_ID_IS_ENABLED` | Enable or disable Entra ID SSO authentication via SAML | `boolean` | `false` | | `AUTH_SAML_ENTRA_ID_DISPLAY_NAME` | Entra ID SAML display name "Sign in with ``" | `string` | `"Entra ID"` | | `AUTH_SAML_ENTRA_ID_ENTRY_POINT` | Entra ID SAML entry point | `string` | | | `AUTH_SAML_ENTRA_ID_CALLBACK_URL` | Entra ID SAML callback URL | `string` | | | `AUTH_SAML_ENTRA_ID_APP_ID` | Entra ID SAML application ID | `string` | | | `AUTH_SAML_ENTRA_ID_SIGNATURE_ALGORITHM` | Entra ID SAML signature algorithm | `string` | `"sha256"` | | `AUTH_SAML_OKTA_IS_ENABLED` | Enable or disable Okta SSO authentication via SAML | `boolean` | `false` | | `AUTH_SAML_OKTA_DISPLAY_NAME` | Okta SAML display name "Sign in with ``" | `string` | `"Okta"` | | `AUTH_SAML_OKTA_ENTRY_POINT` | Okta SAML entry point | `string` | | | `AUTH_SAML_OKTA_CALLBACK_URL` | Okta SAML callback URL | `string` | | | `AUTH_SAML_OKTA_ISSUER` | Okta SAML issuer | `string` | | | `AUTH_SAML_OKTA_SIGNATURE_ALGORITHM` | Okta SAML signature algorithm | `string` | `"sha256"` | | `AUTH_SAML_CUSTOM_IS_ENABLED` | Enable or disable Okta SSO authentication via SAML | `boolean` | `false` | | `AUTH_SAML_CUSTOM_DISPLAY_NAME` | Custom SAML display name "Sign in with ``" | `string` | `"SSO"` | | `AUTH_SAML_CUSTOM_ENTRY_POINT` | Custom SAML entry point | `string` | | | `AUTH_SAML_CUSTOM_CALLBACK_URL` | Custom SAML callback URL | `string` | | | `AUTH_SAML_CUSTOM_ISSUER` | Custom SAML issuer | `string` | | | `AUTH_SAML_CUSTOM_SIGNATURE_ALGORITHM` | Custom SAML signature algorithm | `string` | `"sha256"` | | `BASE_PATH` | Set a custom base path for the Lab application (especially beneficial when using a reverse proxy) | `string` | `/` | | `CONFIG_URI` | Defines the location of the custom configuration file. | `string` | | | `ENTERPRISE_LICENSE_ORG_NAME` | Enterprise license organization name. Refer to [documentation](https://memgraph.com/docs/database-management/enabling-memgraph-enterprise) for details on obtaining and configuring the license | `string` | | | `ENTERPRISE_LICENSE_KEY` | Enterprise license key. Refer to [documentation](https://memgraph.com/docs/database-management/enabling-memgraph-enterprise) for details on obtaining and configuring the license | `string` | | | `KEEP_ALIVE_TIMEOUT_MS` | Max time in milliseconds during which Lab will hold the connection | `integer` | `65000` | | `LOG_LEVEL` | Set the log level: `debug`, `info`, `warn`, `error`. | `string` | `"info"` | | `LOG_IS_ENABLED` | Enable or disable logging | `boolean` | `true` | | `LOG_IS_PRETTY_PRINT` | Pretty print logs and error stacktraces in multi-line JSON format | `boolean` | `true` | | `LOG_CONTEXT_IS_ENABLED` | Enable or disable logging of context information (e.g., identifiers, input data, output data) | `boolean` | `false` | | `LOG_STACKTRACE_IS_ENABLED` | Enable or disable error stacktraces in the logs | `boolean` | `false` | | `MODULE_CONTENT_MAX_LEN` | Max length of a query module content | `integer` | `50000` | | `MODULE_NAME_MAX_LEN` | Max length of the query module name | `integer` | `1000` | | `MODULE_VALIDATION_IS_ENABLED` | State of module validation | `boolean` | `false` | | `NODE_LABEL_MAX_LEN` | Max length of the node label | `integer` | `1000` | | `NODE_LABEL_VALIDATION_IS_ENABLED` | State of node label validation | `boolean` | `false` | | `NODE_PROPERTY_MAX_LEN` | Max length of the node property | `integer` | `1000` | | `NODE_PROPERTY_VALIDATION_IS_ENABLED` | State of node property validation | `boolean` | `false` | | `QUERY_MAX_LEN` | Max length of a Cypher query | `integer` | `5000` | | `QUERY_VALIDATION_IS_ENABLED` | State of query validation | `boolean` | `false` | | `QUICK_CONNECT_IS_DISABLED` | State of quick connect feature | `boolean` | `false` | | `QUICK_CONNECT_MG_HOST` | Host address for quick connect | `string` | `"127.0.0.1"` | | `QUICK_CONNECT_MG_PORT` | Port for quick connect | `integer` | `7687` | | `QUICK_CONNECT_MG_IS_ENCRYPTED` | Turn SSL on/off for quick connect | `boolean` | `false` | | `PORT` | Lab app default listening port | `integer` | `3000` | | `REQUEST_BODY_LIMIT_MB` | Limit for request body size in MB | `integer` | `20` | | `SESSION_MAX_AGE_SEC` | Maximum lifetime of a session, regardless of user activity. | `integer` | `86400` | | `SESSION_MAX_IDLE_TIMEOUT_SEC` | Maximum idle time before the user is logged out. Disabled by default. Minimum allowed value is 60 seconds. | `integer` | | | `SSL_IS_ENABLED` | Enable or disable SSL | `boolean` | `false` | | `SSL_CERT_PATH` | Path to SSL certificate to be used | `string` | `./ssl/cert.pem` | | `SSL_KEY_PATH` | Path to SSL key to be used | `string` | `./ssl/key.pem` | | `SSL_PASSPHRASE` | Passphrase for the SSL key, required if the private key was generated with encryption (without the `-nodes` flag) | `string` | | | `STORAGE_MG_HOST` | `(Enterprise only)` Memgraph host for the Lab remote storage | `string` | | | `STORAGE_MG_PORT` | `(Enterprise only)` Memgraph port for the Lab remote storage | `number` | | | `STORAGE_MG_IS_ENCRYPTED` | `(Enterprise only)` Memgraph SSL on/off for the Lab remote storage | `boolean` | | | `STORAGE_MG_DATABASE_NAME` | `(Enterprise only)` Memgraph database name for the Lab remote storage | `string` | | | `STORAGE_MG_USERNAME` | `(Enterprise only)` Memgraph username for the Lab remote storage | `string` | | | `STORAGE_MG_PASSWORD` | `(Enterprise only)` Memgraph password for the Lab remote storage | `string` | | | `STORAGE_MG_CONNECT_TIMEOUT_MS` | `(Enterprise only)` Connection timeout in milliseconds for remote storage | `integer` | `10000` | | `STORAGE_MG_CONNECT_RETRY_MAX_COUNT` | `(Enterprise only)` The maximum number of retries allowed for a successful connection during Lab startup | `integer` | `5` | | `STREAM_NAME_MAX_LEN` | Max length of the stream name | `integer` | `500` | | `STREAM_VALIDATION_IS_ENABLED` | State of stream validation | `boolean` | `false` |