Environment

Dalfox respects a small set of environment variables for configuration that doesn't belong in a file or on the command line.

Variable	Used by	Purpose
`DALFOX_API_KEY`	`dalfox server`	Value required in the `X-API-KEY` header. Read only when `--api-key` is not given; an empty value is ignored.
`DALFOX_STDIN_WAIT_MS`	`dalfox scan` (auto input)	Milliseconds to wait for piped `stdin` to produce its first byte when targets were also given on the command line. Default `500`; `0` skips the stdin merge entirely. A value that is not a whole number falls back to `500`, and anything above `3600000` (one hour) is clamped to it. Does not apply to `--input-type pipe`/`har`, which always wait.
`NO_COLOR`	all modes	Disables ANSI colour output when set to any value, an empty string included. Equivalent to `--no-color`, and to `no_color = true` in the config file. See the NO_COLOR convention.
`XDG_CONFIG_HOME`	config loader	Base directory for the config file (`$XDG_CONFIG_HOME/dalfox/config.toml`, or `config.json` when there is no TOML file). Falls back to `$HOME/.config` when unset or empty.
`HOME`	config loader	Used when `XDG_CONFIG_HOME` is unset or empty.
`USERPROFILE`	config loader	Windows fallback base directory, used when `HOME` is unset and `XDG_CONFIG_HOME` is unset or empty.

Examples

Keep the API key out of process args

export DALFOX_API_KEY="$(pass dalfox/api-key)"
dalfox server --port 6664

Disable colour globally

export NO_COLOR=1

--no-color does the same for a single run, and no_color = true in the config file does it for every run. Colour is also suppressed automatically whenever stdout is not a TTY, so a piped or redirected scan is plain text without setting anything.

dalfox scan https://target.app --no-color
dalfox scan https://target.app > scan.log   # already plain text

See Colour & TTY behaviour in the output guide.

Use a project-local config

XDG_CONFIG_HOME=./.config dalfox scan https://target.app
# Dalfox reads ./.config/dalfox/config.toml

Not environment variables

A few things that look like they should be environment variables but aren't:

Proxy. Use --proxy or proxy in config. Scan traffic and the interactsh OOB client ignore HTTP_PROXY/HTTPS_PROXY/ALL_PROXY to avoid accidental traffic interception. The one exception is downloading remote lists (--remote-payloads, --remote-wordlists, dalfox payload portswigger|payloadbox): without --proxy, those requests follow the standard proxy variables.
Timeout, workers, format. CLI flag or config only.
Debug. Pass --debug on the command line or set debug = true in config.