Environment Variables

Fully detailed reference for every configuration key used to control Vibe44 integrations, security, analytics, and provider adapters.

Important

Never commit your .env.local file to version control. The .env.example file serves as the template for required variables. You can automatically scaffold a new .env.local file with the correct keys by running the npm run setup-wizard command.

1. Application

Base URLs and fundamental Next.js application variables.

NEXT_PUBLIC_APP_URL: The base URL of your application. Set this to http://localhost:3000 for local development, and your production domain for deployment.
NEXT_PUBLIC_APP_NAME: The name of your application, displayed in emails, headers, and UI elements.

(Note: Description, tagline, version, and default support email are configured directly in lib/config.ts, not environment variables).

2. Security

Cryptographic secrets required for secure operation.

CSRF_SECRET: Random string used to generate CSRF nonces for authenticated mutations. Generate a strong secret using openssl rand -base64 32.
NEXT_AUTH_SECRET: Random string used to hash tokens and sign cookies for Supabase Auth.
TRUST_PROXY_HEADERS: Set to true to trust x-forwarded-for and real IP headers. Required when deployed behind a reverse proxy (e.g., Vercel, AWS ALB, Nginx). Set to false for raw local testing.

3. Environment

NODE_ENV: Automatically set by Next.js (development or production). Use process.env.NODE_ENV === 'development' in code for dev-only branches.
NEXT_PUBLIC_USE_MOCK_DATA: Enables dashboard/demo mock fallbacks when explicitly set to true. Keep false for production launches.

4. Supabase

Database and Authentication configuration. Obtain these from the Supabase Dashboard.

NEXT_PUBLIC_SUPABASE_URL: Your project's API URL.
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: The public anon key (safe for browser).
SUPABASE_SECRET_KEY: The service role key used for server-side admin operations. Keep this completely secret.
DATABASE_URL: Your Postgres connection string. Use the "Transaction" pooler mode URL (usually port 6543).

5. Payment Providers

Vibe44 supports a Universal Payment Adapter. Set the active provider via PAYMENT_PROVIDER.

PAYMENT_PROVIDER: Options are stripe, polar, lemon-squeezy, dodo, or creem.

Depending on your selected provider, you must configure its respective keys and product IDs:

Stripe

STRIPE_PUBLISHABLE_KEY: Public Stripe key (starts with pk_test_ or pk_live_).
STRIPE_SECRET_KEY: Secret Stripe key (starts with sk_test_ or sk_live_).
STRIPE_WEBHOOK_SECRET: Webhook signing secret (starts with whsec_).
STRIPE_TIER_*_PRICE_ID: Your recurring and lifetime price IDs configured in the Stripe Dashboard.

Polar

POLAR_ENVIRONMENT: Either sandbox or production.
POLAR_API_KEY: Your Polar personal access token.
POLAR_ORGANIZATION_ID: Your Polar organization UUID.
POLAR_WEBHOOK_SECRET: Webhook signing secret.
POLAR_TIER_*_PRODUCT_ID: Product UUIDs from the Polar dashboard.

Lemon Squeezy

LEMONSQUEEZY_TEST_MODE: Set to true or false.
LEMONSQUEEZY_API_KEY: API token.
LEMONSQUEEZY_STORE_ID: Your store ID number.
LEMONSQUEEZY_WEBHOOK_SECRET: Webhook signing secret.
LEMONSQUEEZY_TIER_*_VARIANT_ID: Subscription variant IDs.

Dodo Payments

DODO_ENVIRONMENT: Either test_mode or live_mode.
DODO_API_KEY: API key from Dodo.
DODO_WEBHOOK_SECRET: Webhook signing secret.
DODO_TIER_*_PRODUCT_ID: Product IDs from Dodo dashboard.

Creem

CREEM_TEST_MODE: Set to true or false.
CREEM_API_KEY: Creem API key.
CREEM_WEBHOOK_SECRET: Webhook signing secret.
CREEM_TIER_*_PRODUCT_ID: Product IDs from Creem dashboard.

6. Digital Products (One-time purchases)

Price and product IDs for one-time digital products, mapped to your active payment provider.

{PROVIDER}_FIRST_DIGI_PRODUCT_ID / {PROVIDER}_FIRST_DIGI_PRODUCT_PRICE_ID: Map to your specific digital products for the provider you selected in PAYMENT_PROVIDER.

7. Email Providers

Vibe44 uses a Universal Email Adapter. All providers work independently. If your primary provider fails or has its key removed, the system will fall back to the next available provider.

EMAIL_PROVIDER: The default provider (sendgrid, postmark, resend, or brevo).
SENDGRID_API_KEY: SendGrid API key.
POSTMARK_API_KEY: Postmark Server API Token.
RESEND_API_KEY: Resend API key.
BREVO_API_KEY: Brevo API key.
EMAIL_FROM: The default outbound address (e.g., [email protected]).
EMAIL_FROM_NAME: Sender name (e.g., Your App).
EMAIL_REPLY_TO: Default reply-to address.
PUBLIC_SUPPORT_EMAIL: User-facing support address.
SECURITY_ALERT_EMAIL: Internal recipient for brute force, IP ban, and role change alerts.

8. AI Services

Universal AI Provider Adapter for text generation and embeddings.

AI_PROVIDER: Active provider (gemini, openai, anthropic, or deepseek).
EMBEDDING_PROVIDER: Provider for vector embeddings (gemini or openai). Required if your AI_PROVIDER does not support embeddings (e.g., Anthropic, DeepSeek).
GEMINI_API_KEY: Google AI Studio key.
OPENAI_API_KEY: OpenAI platform key.
ANTHROPIC_API_KEY: Anthropic Console key.
DEEPSEEK_API_KEY: DeepSeek platform key.
*_MODEL: Optional override for specific AI models to use per provider.

9. Voice Provider

Universal Voice Adapter for Text-to-Speech (TTS) and Speech-to-Text (STT).

VOICE_PROVIDER: The active provider (elevenlabs or murf).
ELEVENLABS_API_KEY: API key from ElevenLabs (supports TTS & STT).
MURFAI_API_KEY: API key from Murf AI (supports high-quality TTS only).

10. Analytics Providers

Universal Analytics Adapter handling events seamlessly across 9 supported providers.

NEXT_EXTERNAL_ANALYTICS_PROVIDER: Active analytics provider. Supported values are:
- mixpanel (Product analytics, default)
- google (Google Analytics 4)
- datafast (Privacy-first)
- posthog (Product OS)
- plausible (Privacy-first)
- pirsch (Cookieless)
- umami (Self-hosted or cloud)
- vercel (Vercel built-in analytics)
- vemetric (Privacy-friendly analytics)

Depending on your selection, configure the corresponding variables:

NEXT_PUBLIC_GA_MEASUREMENT_ID: GA4 Measurement ID (G-...).
NEXT_PUBLIC_DATAFAST_WEBSITE_ID / NEXT_PUBLIC_DATAFAST_DOMAIN: DataFast credentials.
NEXT_PUBLIC_MIXPANEL_TOKEN: Mixpanel project token.
NEXT_PUBLIC_POSTHOG_KEY / NEXT_PUBLIC_POSTHOG_HOST: PostHog credentials and ingest host.
NEXT_PUBLIC_PLAUSIBLE_DOMAIN: Plausible tracked domain.
NEXT_PUBLIC_PIRSCH_CODE: Pirsch tracking code.
NEXT_PUBLIC_UMAMI_WEBSITE_ID / NEXT_PUBLIC_UMAMI_HOST: Umami tracking target.
NEXT_PUBLIC_VEMETRIC_TOKEN: Vemetric token.

11. Background Jobs Provider (Universal Adapter)

Only one provider is active at a time (default: QStash).

BACKGROUND_JOBS_PROVIDER: qstash (default) or trigger. Determines which engine processes scheduled background tasks (session cleanup, email digests, usage resets, subscription reminders, etc.).

QStash (Upstash)

QSTASH_TOKEN: Token for scheduling tasks via Upstash QStash.
QSTASH_CURRENT_SIGNING_KEY / QSTASH_NEXT_SIGNING_KEY: Required to verify incoming webhooks from QStash.
QSTASH_ALLOW_DEV_BYPASS: Developer convenience flag to bypass QStash signatures locally. Never set this in production.

Trigger.dev

TRIGGER_PROJECT_ID: Project identifier from the Trigger.dev dashboard.
TRIGGER_SECRET_KEY: Secret key used to securely enqueue tasks and authenticate the runtime.

12. Upstash Redis (Rate Limiting)

Required for production rate-limiting. Independent of background jobs provider choice.

UPSTASH_REDIS_REST_URL: Your Redis REST API URL.
UPSTASH_REDIS_REST_TOKEN: Your Redis REST API token.

13. Sentry (Error Monitoring & Performance)

Optional but highly recommended application monitoring.

SENTRY_DSN / NEXT_PUBLIC_SENTRY_DSN: Client keys pointing to your Sentry project.
SENTRY_AUTH_TOKEN: Token used by CI/CD systems to upload sourcemaps.
SENTRY_ORG / SENTRY_PROJECT: Your Sentry organization and project slugs.
SENTRY_SEND_PII / NEXT_PUBLIC_SENTRY_SEND_PII: Opt-in to send PII (IPs, emails) to Sentry. Ensure GDPR compliance if set to true.
NEXT_PUBLIC_SENTRY_REPLAY_ENABLED: Opt-in to record user sessions natively via Sentry Session Replay.

14. End-to-End Testing (Playwright)

Used exclusively for test environments.

TEST_USER_EMAIL: Pre-seeded email used to log in during automated test suites.
TEST_USER_PASSWORD: Pre-seeded password for the test user.