Getting started

Every setting, in one place.

Each app reads its own .env. The defaults work on your machine; this page says what to change for a real deployment.

The API

The API reads back-end/.env.

PORT: the API's port, 8000 by default.
DB_TYPE: sqlite (the default, with SQLITE_DATABASE as the file) or mysql, with DB_HOST, DB_PORT, DB_USERNAME, DB_PASSWORD and DB_DATABASE.
JWT_SECRET and JWT_EXPIRATION: the signing secret for sessions and how long a session lasts.
CORS_ORIGIN: the browser origins allowed to call the API: the website and the dashboard.
DASHBOARD_URL and PUBLIC_API_URL: where people reach the dashboard and the API, used in emails and links.
SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_USER, SMTP_PASSWORD, SMTP_FROM: the mail server for invitations and password resets. Without them, each message is written to the API's log instead.
CONTACT_INBOX: where messages from the contact form are forwarded. They are stored either way.
BILLING_PROVIDER, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, BILLING_GRACE_DAYS: see Billing.
PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET, PAYPAL_ENV: PayPal for the license checkout; see License checkout.
R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_ENDPOINT, R2_BUCKET_NAME, R2_PUBLIC_URL: store uploads in Cloudflare R2. Without all five, uploads go to MEDIA_UPLOAD_DIR on the server.
GOOGLE_API_KEY, OPENAI_API_KEY, DEEPSEEK_API_KEY: the assistant's model providers. Leave them empty and each person can add their own key.
DEMO_MODE: see Demo mode.

The dashboard reads dashboard/.env.

PORT: 3031 by default.
NEXT_PUBLIC_API_BASE_URL: the API's address, ending in /api. Leave it empty to run the dashboard on its built-in sample data, with no API: any password signs in, each seeded email opens its role, and changes stay in that browser. A Sample data notice says so on every page, and yarn remove:mock deletes the sample data.
NEXT_PUBLIC_WEBSOCKET_BASE_URL: the API's address without /api, for live permission updates.
NEXT_PUBLIC_BASE_URL and NEXT_PUBLIC_WEBSITE_URL: the dashboard's own address and this site's.
NEXT_PUBLIC_DEMO_MODE: keep it equal to the API's DEMO_MODE.

This site reads website/.env.

NEXT_PUBLIC_SITE_URL: the site's public address, used for canonical links, the sitemap and sharing cards.
NEXT_PUBLIC_API_BASE_URL: the API's address, for the contact form and the license checkout.
Leave NEXT_PUBLIC_API_BASE_URL empty to run the site on its built-in sample data, with no API: the contact form and the license checkout answer in the browser, the checkout opens the site's own test checkout, and nothing is sent anywhere. A Sample data notice says so on every page.
NEXT_PUBLIC_DASHBOARD_URL: the dashboard's address, for sign-in and the live demo.
NEXT_PUBLIC_PURCHASE_URL_SINGLE and NEXT_PUBLIC_PURCHASE_URL_STUDIO: an outside store's checkout for each license, if you sell through one. Empty, Continue opens this site's own checkout.
NEXT_PUBLIC_DEMO_MODE: shows the demo line in the footer.

The NEXT_PUBLIC_ values are read when an app is built. Change one, then build again.