Environment

Required

DATABASE_URL is your PostgreSQL database. BETTER_AUTH_SECRET is at least 32 characters; BETTER_AUTH_URL and NEXT_PUBLIC_APP_URL must match and be site origins. Production uses HTTPS and a CRON_SECRET of at least 32 characters.

pnpm init:site safely creates private local configuration. pnpm check:env --production validates names/syntax without printing values or contacting services. Passing validation is not credential acceptance.

Optional

• PAYMENT_PROVIDER=none disables payments; see Payments.
• Google: configure both AUTH_GOOGLE_ID / AUTH_GOOGLE_SECRET plus actual callbacks/trusted domains.
• AI demos: VOLCANO_ENGINE_API_KEY; email: RESEND_API_KEY and verified sending domain.
• GA/Clarity: configured public IDs; development is disabled by default.
• Sentry: explicit NEXT_PUBLIC_SENTRY_ENABLED=true and DSNs, production only. Keep auth tokens server-only; source-map uploads also need token/org/project. Verification keeps monitoring disabled.
• Storage: configure STORAGE_* only when using R2/S3 mirroring.

Never put merchant/AI secrets into public config or reuse another site's DB/OAuth/payment/cron credentials.

Email Verification

AUTH_REQUIRE_EMAIL_VERIFICATION=false makes signup mail optional. Forced verification or AI_REQUIRE_VERIFIED_EMAIL=true requires Resend; see Email verification.