Computer configuration reference
Map the local Agent Approve configuration to installer and iOS settings.
The installer stores computer configuration in ~/.agentapprove/env. It also stores hook files, pairing material, and optional debug logs under ~/.agentapprove/.
Use npx agentapprove install to change configuration. Do not copy this directory to another computer.
| Entry | Accepted value | User-facing meaning |
|---|---|---|
AGENTAPPROVE_API | HTTPS service URL | The Agent Approve service used by hooks. |
AGENTAPPROVE_TOKEN | Private token | Identifies and authorizes this installation. |
AGENTAPPROVE_PRIVACY | minimal, summary, or full | Privacy Level for event history. |
AGENTAPPROVE_RETENTION_DAYS | 1, 7, 30, 90, or 365 | Data Retention for your event history. |
AGENTAPPROVE_CONFIG_SET_AT | Installer-managed timestamp | Helps configuration sync resolve which copy is newer. |
AGENTAPPROVE_DEBUG_LOG | true or false | Writes the optional local hook debug log when enabled. |
AGENTAPPROVE_E2E_MODE | approval or observe | Approval Mode or Observe Mode. |
AGENTAPPROVE_E2E_ENABLED | true or false | Whether supported event content uses end-to-end encryption. |
AGENTAPPROVE_FAIL_BEHAVIOR | ask, deny, or allow | What hooks do when they cannot get a usable Agent Approve response. |
Account-owned values and configuration sync
Supported hooks and plugins can refresh Privacy Level, offline fallback, end-to-end encryption, and the local values needed by Mobile Q&A after receiving newer account configuration. Plugin integrations refresh rotation configuration separately.
Agent Completion, Voice Follow-up, the active policy, and policy lists remain service-side. They are not copied into this file.
Configuration updates ride on normal agent traffic. The next supported event or approval response from a computer can carry newer account settings back to that computer. A computer that has not sent an event will keep showing its older local values until it communicates again.
Both the installer and the iOS app timestamp configuration changes. When the local file and account disagree, the newer change wins. Avoid editing managed entries by hand because a newer account update can replace them.
Change user-facing settings in the iOS app and use the installer for computer-specific choices.
The exception is temporary hook diagnostics. You can set AGENTAPPROVE_DEBUG_LOG=true to enable the local debug log, then return it to false when the test is complete. See Trace a request with the hook debug log.
Sensitive files
The token, pairing artifacts, and encryption keys are private. npx agentapprove status is safer to share than the raw configuration, but you should still review and redact machine names, paths, and profile names before sending its output.
If a token expires, use npx agentapprove refresh. If encryption pairing is wrong, use npx agentapprove pair. Editing a token or key by hand can create a mismatch that is harder to diagnose.