Admin Console Configuration

Use the Replicated Admin Console to configure an OpenHands Enterprise deployment installed with Replicated Embedded Cluster.

​

Open the Configuration Screen

1. Open https://<your-base-domain>:30000.
2. Log in with the Admin Console password created during installation.
3. Select Config.

For initial installation instructions, see Quick Start.

​

Apply a Configuration Change

1. Update the required fields.
2. Select Save config.
3. Review the pending configuration change.
4. Deploy the new sequence.
5. On Dashboard, wait for the application status to return to Ready.

Some changes restart one or more OpenHands components. Make changes during a maintenance window when required by your operating policies.

​

Domain Configuration

​

Recommended: Derive Hostnames From One Domain

Use the default Derive hostnames from domain (recommended) mode unless your organization requires a custom hostname for each service.

1. Leave Hostname Configuration Mode set to Derive hostnames from domain (recommended).
2. Enter your Base Domain, such as openhands.example.com.
3. Create DNS records and TLS coverage for the derived hostnames.

For a base domain of openhands.example.com, OpenHands uses:

Customize every hostname

Select Enter all hostnames manually only when your DNS or network requirements do not allow the derived layout.

Field	Description
Application Hostname	Hostname for the OpenHands application.
Analytics Hostname	Hostname for the analytics service.
Authentication Hostname	Hostname for Keycloak.
LLM Proxy Hostname	Hostname for the bundled LiteLLM proxy.
Runtime API Hostname	Hostname for the Runtime API.
Runtime Base Hostname	Base hostname used to create sandbox routes.

You must create DNS records, issue certificates, and configure external OAuth and webhook callbacks for the complete custom hostname set.

​

Additional CORS Origins

Additional Permitted CORS Origins is optional in either hostname mode. Enter a comma-separated list of browser origins, including the scheme and host with no path or trailing slash. The OpenHands application origin is always allowed automatically.

​

Certificate Configuration

​

LLM Configuration

Select the administrator-managed LLM provider. The Admin Console shows only the fields required by the selected provider.

​

Provider Notes

• For Azure, deployment names must exist at the configured endpoint and API version.
• For AWS Bedrock, use an EC2 instance profile where possible. Pods must be able to reach the instance metadata service, and the role needs model invocation permissions.
• For custom OpenAI-compatible endpoints, prefix model names with openai/.
• Model lists accept one model per line.

​

Bring Your Own Key

Enable Allow users to configure their own LLM providers (BYOK) to let users add provider credentials and custom models in their OpenHands settings. Leave it disabled to restrict users to administrator-managed models.

​

LiteLLM Admin Console

LiteLLM Admin Password sets the password for the LiteLLM UI at https://<llm-proxy-hostname>/ui. The username is admin. Changing this password restarts LiteLLM. Models added in LiteLLM appear in the OpenHands model selector after a short delay. Leave the LiteLLM Team field blank to make a model available to all users, and do not reuse a model name already configured in the Replicated LLM section.

​

Default OpenHands Organization

These settings are additive. Disabling them does not delete organizations, remove members, or demote users.

​

Authentication and Integrations

The following groups appear independently and reveal additional required fields when enabled.

​

Bitbucket Data Center Authentication

Configure the server domain, OAuth application credentials, and bot identity used for repository operations. See Bitbucket Data Center.

​

Azure DevOps Authentication

Configure the Microsoft Entra tenant, Azure DevOps organization, client ID, and client secret. See Azure DevOps.

​

Jira Data Center Integration

Configure the Jira base URL, account-linking method, and either OAuth or service-account credentials. See Jira Data Center.

​

GitHub Authentication

Enable the GitHub App used for sign-in and repository access, then provide:

• GitHub App Client ID
• GitHub App Client Secret
• GitHub App ID
• GitHub App Slug
• GitHub App Webhook Secret
• GitHub App Private Key

Use a GitHub App, not a GitHub OAuth App.

​

GitLab Authentication

Provide the GitLab host and OAuth client credentials. Leave the host at gitlab.com for GitLab SaaS, or enter the hostname of your self-managed GitLab instance.

​

Slack

Provide the Slack client ID, client secret, and signing secret. After deployment, complete the OpenHands-side installation and account-linking flow. See Slack.

​

SMTP Email Delivery

Enable SMTP to send budget alerts and administrator notifications. Match the SSL and STARTTLS options to the behavior required by your mail server.

​

Database Configuration

Choose the bundled PostgreSQL database or an external PostgreSQL service. For an external database, configure:

• Host and port
• SSL mode
• Username and password
• Whether OpenHands should create databases automatically
• Database names for OpenHands, Keycloak, LiteLLM, Runtime API, and Automations

See External PostgreSQL for version, encoding, privilege, and database requirements.

​

Sandbox Configuration

Resource requests are scheduling reservations. Multiply per-sandbox requests by the expected concurrent sandbox count and leave capacity for the platform services.

​

Custom Sandbox Image

Enable Use a Custom Sandbox Image to configure an image repository, tag, and optional private-registry credentials. See Custom Sandbox Images.

​

Proxy Configuration

Enable the HTTP proxy when outbound traffic must pass through a corporate proxy. Prefer adding the proxy CA under Additional Trusted CA Certificates instead of disabling TLS verification.

​

Troubleshooting

Log Level defaults to INFO. Use DEBUG only while investigating a problem because it produces significantly more log output. Return to INFO after collecting the necessary diagnostics.

​

Experimental

Enable Plugin Directory deploys the experimental plugin marketplace at /plugins. When enabled, configure a marketplace source beginning with github://, https://, or http://. See Plugin Marketplace for setup and limitations.

​

Analytics Configuration

Enable analytics to deploy the bundled Laminar observability services. Optionally provide a Laminar project API key; an ingest-only key is recommended. See Analytics for the complete setup and verification flow.

​

Automations

Enable Automations deploys the Automations UI and backend. If you use external PostgreSQL, create and grant access to the Automations database before enabling this option.

​

Advanced Options

Change advanced options only when the corresponding integration or deployment requirement is understood.

​

Installer-Managed Secrets

Replicated generates internal PostgreSQL, Redis, JWT, Keycloak, LiteLLM, sandbox, plugin-directory, and Automations secrets during installation. These values are intentionally hidden from the configuration screen.

​

Related Guides