Reference

Configuration

Every production setting, where it belongs, and whether users can see it.

API values

Set these on Railway, Fly.io, or your own API runtime. Treat every value as secret unless the table says otherwise.

Variable	Required value
`DATABASE_URL`	PostgreSQL URL for normal API traffic. For Supabase transaction mode, add `sslmode=require&default_query_exec_mode=simple_protocol`.
`MIGRATION_DATABASE_URL`	Session-pooler or direct PostgreSQL URL for migrations. Falls back to `DATABASE_URL`, but transaction pooling is not safe for the migration lock.
`REDIS_URL`	`redis://` or `rediss://` URL.
`DATA_ENCRYPTION_KEY`	Base64 encoding of exactly 32 random bytes. Back it up separately.
`DATA_ENCRYPTION_KEY_VERSION`	`1` for a new installation.
`DATA_ENCRYPTION_READ_KEYS`	Empty initially. Old `version:base64` entries during key rotation.
`CLERK_ISSUER`	Clerk HTTPS issuer origin, without a path.
`CLERK_JWKS_URL`	Clerk HTTPS JWKS URL, with its path.
`CLERK_ALLOWED_DASHBOARD_ORIGINS`	Comma-separated dashboard origins, with no paths or trailing slashes.
`WEBSOCKET_AUTHENTICATION_TIMEOUT`	`5s`. Allowed range: 1s to 30s.
`RELAY_PAIRING_GRANT_TTL`	`10m`. Allowed range: 1m to 30m.
`LOG_LEVEL`	`info`. Allowed: `debug`, `info`, `warn`, `error`.
`MEDIA_S3_ENDPOINT`	S3 HTTPS endpoint, including a provider base path when required, without a trailing slash.
`MEDIA_S3_BUCKET`	Existing private bucket name.
`MEDIA_S3_REGION`	Region reported by the storage provider.
`MEDIA_S3_ACCESS_KEY_ID`	Server-side S3 access key.
`MEDIA_S3_SECRET_ACCESS_KEY`	Server-side S3 secret key.
`MEDIA_S3_ADDRESSING_STYLE`	`path` for Supabase, R2, and MinIO; `virtual` for AWS S3.
`HTTP_ADDR`	`:8080` on Fly.io or self-managed hosts. Leave unset on Railway so its `PORT` wins.
`GIN_MODE`	`release`.

MEDIA_S3_COMPOSE_ENDPOINT, POSTGRES_*, REDIS_PORT, and API_PORT are local Compose settings. Do not copy them to a cloud API service.

Dashboard build values

Variable	Visibility	Value
`VITE_CLERK_PUBLISHABLE_KEY`	Public	Clerk production publishable key
`VITE_API_BASE_URL`	Public	Public HTTPS API origin, no path or trailing slash

Vite embeds both values in browser JavaScript. A VITE_ prefix never protects a secret.

Relay build value

Variable	Value
`COOP_RELAY_SERVER_URL`	Public HTTPS API origin used when building Relay

Provider-specific storage examples

Provider	Endpoint	Addressing style
Supabase Storage	`https://<project>.storage.supabase.co/storage/v1/s3`	`path`
Cloudflare R2	`https://<account>.r2.cloudflarestorage.com`	`path`
AWS S3	`https://s3.<region>.amazonaws.com`	`virtual`
MinIO	Provider-specific origin	`path`