1.0.0-rc.1 · Release Candidate1 min read
Environment Variables
Source-verified runtime environment keys grouped by database, application, storage, mail, and provider concerns.
The current API environment schema contains 52 named keys. They are validated before application boot; production additionally requires DATABASE_URL and a non-development JWT_ACCESS_SECRET, and requires a Meilisearch master key when a Meilisearch host is configured.
| Group | Source-verified keys |
|---|---|
| Runtime | NODE_ENV, APP_VERSION, API_PORT, LOG_LEVEL, ENABLE_API_DOCS |
| Data services | DATABASE_URL, REDIS_URL, MEILISEARCH_HOST, MEILISEARCH_MASTER_KEY |
| Auth/session | JWT_ACCESS_SECRET, JWT_ACCESS_TTL, REFRESH_TOKEN_TTL_DAYS, AUTH_COOKIE_NAME, AUTH_COOKIE_SECURE |
| URLs and CORS | NEXT_PUBLIC_APP_URL, NEXT_PUBLIC_API_URL, ADMIN_APP_URL, CORS_ALLOWED_ORIGINS |
| Media and mail | MEDIA_MAX_FILE_SIZE_MB, MEDIA_LOCAL_DIR, RESEND_API_KEY, EMAIL_FROM, EMAIL_REPLY_TO, R2 keys and bucket fields |
| Payment providers | mock, Stripe, iyzico, and PayTR enablement, credential, callback, timeout, and reconciliation fields |
| Operations | SENTRY_DSN and provider return URL |
Secret-valued keys are documented by name and validation rule only. No value, real endpoint, or live provider activation is published.
Verification
Compare a redacted environment inventory with apps/api/src/config/env.validation.ts, run application boot validation, and record the result. A missing required production value is a blocker.
Related articles
Configuration OverviewUnderstand the boundary between installer configuration, runtime environment, installation records, and external services.Database ConfigurationConfigure PostgreSQL through a secret reference and preserve its role as AutoCore transactional authority.Payment ConfigurationConfigure payment provider readiness while preserving the disabled and financially gated Commercial 1.0 boundary.Security Header ConfigurationConfigure the security boundary around URLs, cookies, origins, and reverse-proxy headers.