---
title: Configuration
description: Everything is optional. Where settings live, what .env can override, and the few knobs worth knowing about.
---
# Configuration

Nothing is required. The first-run wizard writes what it needs; everything else has a sensible default.

## Where

- `~/lampson/.lampson/config.json` — provider, model, keys (sealed), preferences. Written by `/setup`, the web ⚙ and the provider pill. Shared by the terminal and the web UI.
- `~/lampson/.env` — optional overrides for the same settings, plus the knobs below. `.env` wins over `config.json`.
- `LAMPSON_HOME` — move `~/lampson` somewhere else.

## Provider

```sh
LAMPSON_PROVIDER=deepseek        # openai | deepseek | kimi | groq | grok | openrouter | ollama | anthropic | minimax
LAMPSON_API_KEY=sk-...           # or LAMPSON_API_KEY_DEEPSEEK=… one per provider
LAMPSON_MODEL=deepseek-chat
LAMPSON_BASE_URL=…               # any compatible endpoint (no trailing slash)
LAMPSON_WIRE=openai              # openai | anthropic, when the preset cannot guess
```

## Behaviour

```sh
LAMPSON_PERMISSION=ask           # ask | yolo | strict (the default mode)
LAMPSON_MAX_STEPS=40             # tool steps per turn
LAMPSON_BUDGET_TOKENS=400000     # cost budget per turn (cached tokens count 10%)
LAMPSON_COMPACT_AT=80000         # compact the context above this estimate
LAMPSON_MAX_TOKENS=8192          # output cap per response (auto-doubles on an empty answer)
LAMPSON_TIMEOUT=180              # seconds per model call
LAMPSON_EXPLORE_CAP=12           # read-only calls in a row before a nudge to act
```

## Shell (Windows)

Commands run through Git's bash by default. To use something else:

```sh
LAMPSON_SHELL=C:\Program Files\Git\bin\bash.exe
LAMPSON_SHELL_FLAG=-c
```

## Unattended runs and approvals

```sh
LAMPSON_TZ=-03:00                # for "daily 09:00" (default: the system's)
LAMPSON_PUBLIC_URL=https://…     # how this Lampson is reached from outside
LAMPSON_WEBHOOK_URL=https://…    # POST for each pending approval
LAMPSON_WEBHOOK_SECRET=…         # HMAC-SHA256 signature of the body
LAMPSON_WEB_TOKEN=…              # let a non-local script call the web API (Bearer)
```

See [Scheduled tasks](/en/docs/schedules).

## Per project

Things you may want to commit, so your team gets them: `.lampson/plugins/` ([plugins](/en/docs/plugins)), `.lampson/mcp.json`, `.lampson/lsp.json`, `skills/`, `AGENTS.md`. Lampson writes nothing else into your project.