Environment Variables¶
Immich-Go GUI passes server URLs and API keys to immich-go through environment variables rather than command-line arguments. This prevents secrets from appearing in process listings and shell history.
GUI Configuration Override¶
| Variable | Purpose |
|---|---|
IMMICH_GO_GUI_CONFIG |
Absolute path to a specific config.toml file, overriding the default config location |
immich-go Secret Variables¶
Mapped in core/cli_schema.py (ENV_KEY_MAP). Each tab uses a distinct prefix to avoid collisions when multiple credential sets are needed.
Upload Tabs (folder, gp, icloud, picasa)¶
| State key | Environment variable |
|---|---|
server |
IMMICH_GO_UPLOAD_SERVER |
api_key |
IMMICH_GO_UPLOAD_API_KEY |
admin_api_key |
IMMICH_GO_UPLOAD_ADMIN_API_KEY |
Applies to: upload-folder, upload-gp, upload-icloud, upload-picasa
Upload from Immich¶
Uses upload destination vars plus source ("from") vars:
| State key | Environment variable |
|---|---|
server |
IMMICH_GO_UPLOAD_SERVER |
api_key |
IMMICH_GO_UPLOAD_API_KEY |
admin_api_key |
IMMICH_GO_UPLOAD_ADMIN_API_KEY |
from_server |
IMMICH_GO_UPLOAD_FROM_IMMICH_FROM_SERVER |
from_api_key |
IMMICH_GO_UPLOAD_FROM_IMMICH_FROM_API_KEY |
from_admin_api_key |
IMMICH_GO_UPLOAD_FROM_IMMICH_FROM_ADMIN_API_KEY |
Archive from Immich¶
Source-only credentials (no destination server env vars):
| State key | Environment variable |
|---|---|
from_server |
IMMICH_GO_ARCHIVE_FROM_IMMICH_FROM_SERVER |
from_api_key |
IMMICH_GO_ARCHIVE_FROM_IMMICH_FROM_API_KEY |
from_admin_api_key |
IMMICH_GO_ARCHIVE_FROM_IMMICH_FROM_ADMIN_API_KEY |
Stack¶
| State key | Environment variable |
|---|---|
server |
IMMICH_GO_STACK_SERVER |
api_key |
IMMICH_GO_STACK_API_KEY |
admin_api_key |
IMMICH_GO_STACK_ADMIN_API_KEY |
Serverless Archive Tabs¶
No environment variables for server credentials. These tabs do not use ENV_KEY_MAP entries:
archive-folderarchive-gparchive-icloudarchive-picasa
Secret Delivery Rules¶
- Secrets are injected into the subprocess environment dict at launch time
- Secrets are never written to disk shell scripts (
.bat,.sh) - Command preview masks all secret values as
*** - Secret CLI flags (
--api-key,--from-api-key, etc.) are excluded from argv when env delivery is used
Masked Preview Flags¶
These flag names are always redacted in the command preview (SECRET_FLAGS):
--api-key--admin-api-key--from-api-key--from-admin-api-key
Related¶
- Configuration
- Architecture — Security model
- CLI Command Mapping