oms.toml reference

oms.toml holds only what the OMS needs before it can reach its database — the connection, the secrets, the listen address. Everything else (brokers, accounts, portfolios, credentials, risk limits) lives in Postgres and is managed from the cockpit or the admin API.

oms init writes the file for you. Every key is optional: a missing one falls through to its environment variable or default. An unknown key, or a file that does not parse, stops the OMS at startup rather than being ignored.

Precedence

For each setting: flag → environment variable → oms.toml → built-in default. The first one set wins. Environment variables can also come from a .env file — see Config file locations.

[database]

The Postgres the OMS stores everything in.

Key	Flag	Environment	Default
host	--host	POSTGRES_HOST	localhost
port	--port	POSTGRES_PORT	5432
username	--username	POSTGRES_USERNAME	postgres
database	--database	POSTGRES_DATABASE	ods
(superuser password)	--password	POSTGRES_PASSWORD	postgres

username is the superuser that oms init, oms database migrate and oms database drop connect as. Its password is never stored in oms.toml — that credential can drop the database — so those commands prompt for it or take it from --password / POSTGRES_PASSWORD. The running server never uses the superuser.

[oms]

Key	Flag	Environment	Default
password	--oms-password (oms database init only)	OMS_PASSWORD	openoms-dev
master_key	—	OMS_MASTER_KEY	(none)

• password — the oms role the server connects to Postgres as. oms init generates one. The built-in default is accepted only when the database host is loopback; against any other host the server refuses to start with it.
• master_key — base64: followed by 32 bytes, generated by oms init. It encrypts every broker and feed credential stored in the database. Without it no credential can be read; with a wrong one, every credential fails to decrypt. See Master key and backups.

[server]

Key	Environment	Default
bind_addr	OMS_BIND_ADDR	localhost:3001
admin_password	OMS_ADMIN_PASSWORD	openoms-dev (loopback only)

• bind_addr — set by oms init’s “Listen on” question; where the HTTP server listens: the cockpit, the trading API and the admin API, all on one port. The default only accepts connections from the same machine. To serve other machines, bind to an address they can reach (0.0.0.0:3001) — and read the rules below first.
• admin_password — the cockpit login, also accepted as a bearer token on /admin. oms init asks for one (or generates one when you press Enter). With none configured, the server uses openoms-dev on a loopback bind and refuses to start on any other.

OMS_ADMIN_AUTH_ENABLED=false turns the cockpit login off entirely. Only do that when something in front of the OMS already restricts who can reach it.

[auth.oidc]

Trader login through an identity provider, for the /trade/ app. Off unless this block is present and complete. See Login (OIDC).

Key	Default
issuer	(required)
client_id	(required)
public_base_url	(required)
scopes	["openid", "profile", "email"]
required_claim	(none)
required_claim_value	(none)
idle_ttl_minutes	30
absolute_ttl_hours	12

The client secret is never in oms.toml: set OMS_OIDC_CLIENT_SECRET in the environment.

Other environment variables

These have no oms.toml key.

Variable	Effect
OMS_CONFIG	Path to the config file; overrides the search.
OMS_NO_INIT	1 stops the installer from offering to run oms init.
OMS_SYNC_ON_BOOT	never stops the automatic instrument load at startup — otherwise each broker connection with credentials whose instruments were never loaded gets one, as a background job.
ALPACA_ENV, BINANCE_ENV	PAPER (default) or LIVE: which of the broker’s connections the OMS routes to.
BINANCE_PAPER_TRANSPORT, BINANCE_LIVE_TRANSPORT	rest (default) or fix: how Binance orders are sent.
OPENFIGI_API_KEY	Raises the OpenFIGI rate limit used when enriching the catalog.
KAFKA_BROKER, KAFKA_TOPIC	Publish order events to Kafka. Optional; without them publishing is off.
RUST_LOG	Log filter, e.g. RUST_LOG=debug. Default info. Logs go to stderr.

Broker and feed API keys are not environment variables — they are stored encrypted in the database. Enter them in the cockpit; oms config import-env imports them once from the old variable names. See the Integrations pages.