Every environment variable, grouped by feature. Secrets live here — never in config files or version control.

Copy .env.example to .env.local and fill in what you need. Only the variables for the features you enable are required; analytics and monitoring stay off until their keys are present.

Core

Variable	Required	Description
`DATABASE_URL`	Yes	Postgres connection string
`BETTER_AUTH_SECRET`	Yes	Auth signing secret (`openssl rand -base64 32`)
`BETTER_AUTH_URL`	Yes	Web app origin serving auth routes
`WEB_URL`	Yes	Public web app URL
`API_URL`	Yes	Public API origin
`NEXT_PUBLIC_API_URL`	Yes	API URL exposed to the browser
`PLUGIN_SLUG`	Yes	Plugin identifier (matches the Admin Module)

Auth

Variable	Description
`AUTH_MAGIC_LINK` / `AUTH_PASSKEYS` / `AUTH_TWO_FACTOR`	Feature toggles (default on)
`AUTH_REQUIRE_EMAIL_VERIFICATION`	Require verified email before access
`GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET`	Google social login
`GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`	GitHub social login

Billing

Pick one gateway with BILLING_PROVIDER (lemonsqueezy | polar | dodo); only the selected provider's vars are required. LemonSqueezy is the default.

Variable	Description
`BILLING_PROVIDER`	`lemonsqueezy` (default) / `polar` / `dodo`
`LEMONSQUEEZY_API_KEY` / `LEMONSQUEEZY_STORE_ID` / `LEMONSQUEEZY_WEBHOOK_SECRET`	LemonSqueezy
`POLAR_ACCESS_TOKEN` / `POLAR_WEBHOOK_SECRET` / `POLAR_ENVIRONMENT`	Polar (`production` / `sandbox`)
`DODO_PAYMENTS_API_KEY` / `DODO_PAYMENTS_WEBHOOK_SECRET` / `DODO_PAYMENTS_ENVIRONMENT`	Dodo Payments (`test` / `live`)

Webhook URL to register: POST {API_URL}/webhooks/billing.

The chain is resend → plunk → loops → brevo → mailtrap → postmark → sendgrid. Resend is primary; the rest are free-tier fallbacks and kick in automatically when the one before hits its limit (HTTP 429 / quota) or fails. Configure the providers you want; with none set, emails log to the console in dev.

Variable	Provider
`EMAIL_FROM`	Default sender (all providers)
`RESEND_API_KEY`	Resend (primary)
`PLUNK_API_KEY`	Plunk
`LOOPS_API_KEY` / `LOOPS_TRANSACTIONAL_ID`	Loops
`BREVO_API_KEY`	Brevo
`MAILTRAP_API_TOKEN` / `MAILTRAP_BASE_URL`	Mailtrap
`POSTMARK_SERVER_TOKEN` / `POSTMARK_MESSAGE_STREAM`	Postmark
`SENDGRID_API_KEY`	Twilio SendGrid
`EMAIL_RETRY_ATTEMPTS` / `EMAIL_RETRY_BASE_MS`	Per-provider retry/backoff

Storage (S3-compatible)

Off until STORAGE_ACCESS_KEY_ID + STORAGE_BUCKET are set.

Variable	Description
`STORAGE_PROVIDER`	`r2` / `s3` / `minio` (informational)
`STORAGE_BUCKET`	Bucket name
`STORAGE_ACCESS_KEY_ID` / `STORAGE_SECRET_ACCESS_KEY`	Credentials
`STORAGE_REGION`	`auto` for R2; a region for S3
`STORAGE_ENDPOINT`	Custom endpoint (R2/MinIO)
`STORAGE_PUBLIC_URL`	Public base URL for objects
`STORAGE_MAX_UPLOAD_BYTES` / `STORAGE_PRESIGN_TTL`	Upload guards

Analytics (PostHog)

PostHog is the only analytics provider. Off unless a project key is set. Privacy-first and consent-aware (stays opted-out until the visitor accepts).

Variable	Description
`NEXT_PUBLIC_POSTHOG_KEY`	PostHog project key (`phc_…`)
`NEXT_PUBLIC_POSTHOG_HOST`	API host (default `https://us.i.posthog.com`)
`NEXT_PUBLIC_ANALYTICS_ENABLED`	Master switch (default on when key present)
`NEXT_PUBLIC_ANALYTICS_REQUIRE_CONSENT`	Require cookie consent (default true)

Monitoring (Sentry)

Off unless a DSN is set.

Variable	Description
`SENTRY_DSN`	Server DSN
`NEXT_PUBLIC_SENTRY_DSN`	Browser DSN
`SENTRY_ENABLED`	Master switch (default on when DSN present)
`SENTRY_TRACES_SAMPLE_RATE`	Performance sampling (0.0–1.0)
`SENTRY_AUTH_TOKEN` / `SENTRY_ORG` / `SENTRY_PROJECT`	Source-map upload (optional)

Background jobs

Variable	Description
`QSTASH_TOKEN`	QStash publish token
`QSTASH_CURRENT_SIGNING_KEY` / `QSTASH_NEXT_SIGNING_KEY`	Inbound signature verification
`TRIGGER_SECRET_KEY`	Trigger.dev (optional runner)

Admin connector

Variable	Description
`CONNECTOR_SECRET`	Shared service token (`openssl rand -base64 48`)
`ADMIN_CONNECTOR_URL`	Admin Module connector endpoint

Plugin public surface

Variable	Description
`PLUGIN_PUBLIC_API_KEY`	Publishable key shipped inside the plugin
`PUBLIC_RATE_LIMIT_WINDOW_MS` / `PUBLIC_RATE_LIMIT_MAX`	Public surface rate limits

Keep every secret in the environment — never commit .env.local or hardcode values in packages/config.

Environment Variables