Skip to main content

Environment variables

:::info Reconciled reference Ko-Lab had three disagreeing sources of truth: turbo.json declared 46 variables, .env.example covered 23 (four of which turbo.json omits), and the old README documented 13. This page reconciles all three against the source. Where a variable is redundant or dead, it says so. :::

Legend — Required: the app will not boot or the feature is broken · Optional: feature-gated · Deprecated: prefer an alternative

Core​

VariableStatusNotes
DATABASE_URLRequiredPostgreSQL connection string
NODE_ENVAutoSet by the framework
NEXT_PUBLIC_APP_URLRequiredPublic base URL; used in emails and invite links
ALLOWED_ORIGINSOptionalCORS allowlist for API routes

Authentication​

VariableStatusNotes
NEXTAUTH_URLRequiredMust match the deployed origin exactly
NEXTAUTH_SECRETRequiredSession signing; also the WS_AUTH_SECRET fallback
JWT_SECRETOptionalLegacy; NEXTAUTH_SECRET covers current flows
GITHUB_IDRequiredOAuth client ID
GITHUB_SECRETRequiredOAuth client secret
GOOGLE_CLIENT_IDOptionalGoogle sign-in
GOOGLE_CLIENT_SECRETOptionalGoogle sign-in
ENCRYPTION_KEYRequired64 hex chars. Has an insecure fallback

WebSocket & git service​

VariableStatusNotes
NEXT_PUBLIC_WEB_SOCKET_URLRequiredBrowser-facing, e.g. ws://localhost:8080/ws
NEXT_PUBLIC_WS_URLDeprecatedDuplicate of the above
WEB_SOCKET_URLOptionalServer-side variant
WS_AUTH_SECRETRequiredMust match across both apps; falls back to NEXTAUTH_SECRET
WS_ALLOWED_ORIGINSRequiredComma-separated; connections from other origins are refused
GIT_SERVICE_URLRequiredWhere apps/web reaches the git microservice
GIT_SERVICE_SECRETRequiredBearer token for that service

:::warning Three variables, one value NEXT_PUBLIC_WEB_SOCKET_URL, NEXT_PUBLIC_WS_URL and WEB_SOCKET_URL all describe the same endpoint. Set NEXT_PUBLIC_WEB_SOCKET_URL; treat the others as legacy. :::

Voice & video (LiveKit)​

VariableStatusNotes
LIVEKIT_API_KEYCallsServer-side
LIVEKIT_API_SECRETCallsServer-side
LIVEKIT_HOSTCallsHTTP(S) URL for server API
NEXT_PUBLIC_LIVEKIT_URLCallsws:///wss:// for the browser

Object storage​

VariableStatusNotes
S3_ENDPOINTUploadsLocalStack, R2 or AWS
S3_BUCKETUploadsMain bucket
DRAFT_BUCKETUploadsUnsaved editor drafts
S3_FORCE_PATH_STYLEUploadstrue for LocalStack and R2
S3_PUBLIC_BASE_URLUploadsPublic read URL
AWS_ACCESS_KEY_IDUploads
AWS_SECRET_ACCESS_KEYUploads
AWS_REGIONUploadsauto for R2
LOCALSTACK_AUTH_TOKENLocal onlyNow mandatory; absent from turbo.json
MINIO_ACCESS_KEYUnusedSpecced for call recording — not built
MINIO_SECRET_KEYUnusedAs above
MINIO_ENDPOINTUnusedAs above
MINIO_BUCKETUnusedAs above

AI​

VariableStatusNotes
GROQ_API_KEYAI featuresEditor assistant, README generation
GROQ_MODELAI featuresDefault llama-3.3-70b-versatile

Bug reporting​

VariableStatusNotes
BUG_REPORT_GITHUB_TOKENBug reportsPAT with repo scope
BUG_REPORT_REPOBug reportsowner/repo for filed issues
BUG_ADMIN_EMAILBug reportsNotification recipient

Email​

:::caution Largely dead code Eight email variables exist with heavy overlap. The OTP sign-in flow they served is no longer wired up. Treat these as legacy unless you are reviving that flow. :::

VariableStatus
EMAIL_FROMLegacy
EMAIL_USER / EMAIL_PASSLegacy — duplicate pair
EMAIL_PASSWORDLegacy — duplicate of EMAIL_PASS
EMAIL_SERVER_HOST / EMAIL_SERVER_PORTLegacy
EMAIL_SERVER_USER / EMAIL_SERVER_PASSWORDLegacy

Platform (Vercel)​

VariableStatus
VERCEL_URLAuto-injected
VERCEL_PROJECT_PRODUCTION_URLAuto-injected

Adding a new variable​

Turborepo hashes declared env vars for caching. A new variable must be added to the env array in turbo.json, or builds will be cached against a stale value and silently pick up the wrong config.