Environment variables

The committed .env.example is the configuration source for this reference. Variable names are documented here; secret values are never documented or committed.

Some variables are optional, provider-specific, or mutually exclusive. Production validation is performed by npm run preflight:production.

Application / runtime

• NODE_ENV
• PORT
• VITE_APP_ID
• APP_URL
• JWT_SECRET
• CORS_ORIGINS
• RATE_LIMIT_PER_MINUTE
• START_EMBEDDED_WORKERS
• ENABLE_LOCAL_DEMO
• ENABLE_DEV_AUTH
• LOCAL_STORAGE_DIR

Data / queues

• DATABASE_URL
• REDIS_URL

Authentication

• AUTH_PROVIDER
• VITE_CLERK_PUBLISHABLE_KEY
• CLERK_PUBLISHABLE_KEY
• CLERK_SECRET_KEY
• CLERK_JWT_KEY

Storage / scanning

• STORAGE_PROVIDER
• S3_BUCKET
• S3_REGION
• S3_KMS_KEY_ID
• S3_ENDPOINT
• S3_FORCE_PATH_STYLE
• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• SUPABASE_URL
• SUPABASE_SERVICE_ROLE_KEY
• SUPABASE_STORAGE_BUCKET
• SCANNER_PROVIDER
• SCANNER_ENDPOINT

OCR / AI

• OCR_PHI_PROCESSING_APPROVED
• GOOGLE_DOCUMENT_AI_PROCESSOR_URL
• GOOGLE_DOCUMENT_AI_PROCESSOR_ID
• GOOGLE_CLOUD_PROJECT_ID
• GOOGLE_APPLICATION_CREDENTIALS_JSON
• LLM_PHI_PROCESSING_APPROVED
• LLM_PROVIDER
• ANTHROPIC_API_KEY
• LLM_MODEL_DRAFTING
• LLM_MODEL_CLASSIFY
• LLM_TIMEOUT_MS
• LLM_MAX_RETRIES

Delivery / billing

• SENDGRID_API_KEY
• EMAIL_FROM
• SENDGRID_FROM_EMAIL
• SENDGRID_FROM_NAME
• PADDLE_ENVIRONMENT
• PADDLE_API_KEY
• PADDLE_WEBHOOK_SECRET

SMART / voice controls

• SMART_JWKS_PUBLIC_KEY_PEM
• SMART_JWKS_KEY_ID
• VOICE_AGENT_SIMULATION_GLOBAL_KILL_SWITCH
• APPROVED_ACTION_GLOBAL_KILL_SWITCH

Do not paste secret values into documentation or chat. Use the deployment secret manager and existing secret-binding references.