Environment Variables

API (packages/api/.env)

The API validates its environment at startup. A missing required variable or an invalid value (for example a non-numeric PORT) causes the process to exit immediately with an error naming the offending variable, rather than failing later at runtime.

Required

Variable	Description
DATABASE_URL	PostgreSQL connection string, e.g. postgresql://user:pass@localhost:5432/ablebase.
BETTER_AUTH_SECRET	Secret used to sign auth tokens. Generate with openssl rand -base64 32.
BETTER_AUTH_URL	Must be the web origin (e.g. http://localhost:5173), not the API’s own port. Auth callbacks and session cookies are issued against this URL.

BETTER_AUTH_URL is listed as required because any real deployment needs it for correct auth callbacks and cookies. The app will still boot without it (useful for local/test runs), but set it for anything beyond local development.

Server

Variable	Default	Description
PORT	3001	Port the API listens on.
HOST	0.0.0.0	Bind address.
CLIENT_ORIGIN	http://localhost:4813	Comma-separated list of allowed CORS origins.
TRUST_PROXY	—	Set to "true" when running behind a reverse proxy to get accurate client IPs for rate limiting.
CLIENT_IP_HEADER	x-forwarded-for	Header the proxy puts the client IP in, when TRUST_PROXY is on. Either x-forwarded-for or x-real-ip.
TRUSTED_PROXY_HOPS	1	Number of proxies in front of the API. Used to find the client IP in X-Forwarded-For.
PUBLIC_API_URL	—	The API’s public origin, with no path (e.g. https://api.example.com). Shown to users as the address for the ingest API. When unset, the web app’s own /api path is shown instead.
SKIP_MIGRATIONS	—	Set to "1" to skip automatic migrations at startup.
UPLOAD_DIR	./uploads	Filesystem path for storing uploaded profile pictures, org logos, and cached integration logos. Must be a persistent volume in containerized deployments.

Don’t set CI or PLAYWRIGHT in production. They exist for the test suite, and either one turns off the API’s rate limiting.

Registration

Variable	Default	Description
ALLOW_SIGNUP	false	Set to "true" to allow new email/password account registration.

Email

Ablebase sends email through Resend for email verification, password resets, and email address changes. New accounts must verify their email address before they can sign in, so set both variables for any real deployment. When either is missing, emails are skipped.

Variable	Description
RESEND_API_KEY	Resend API key.
EMAIL_FROM	Sender address, e.g. Ablebase <noreply@example.com>. Must use a domain verified in Resend.

GitHub OAuth (sign-in)

These credentials power GitHub social login and are separate from the GitHub App used for integrations (below).

Variable	Description
GITHUB_CLIENT_ID	GitHub OAuth App client ID.
GITHUB_CLIENT_SECRET	GitHub OAuth App client secret.

The OAuth callback URL must be <BETTER_AUTH_URL>/api/auth/callback/github.

GitHub App (integration)

Credentials for the Integrations feature — linking repositories and importing issues. These are separate from the sign-in credentials above. All are optional: when any is missing, the GitHub integration is disabled and the app still boots. See Integrations.

Variable	Description
GITHUB_APP_ID	GitHub App ID.
GITHUB_APP_PRIVATE_KEY	GitHub App private key (PEM). In env files, encode newlines as \n.
GITHUB_APP_CLIENT_ID	GitHub App client ID.
GITHUB_APP_CLIENT_SECRET	GitHub App client secret.
GITHUB_APP_WEBHOOK_SECRET	Secret used to verify inbound GitHub webhooks. Must match the webhook secret configured on the GitHub App.
GITHUB_APP_SLUG	The GitHub App’s URL slug (used to build install links).

Point the GitHub App’s webhook URL at <host>/api/integrations/github/webhooks and subscribe to the Issues, Installation, and Installation repositories events. See GitHub App (integrations) for the full setup.

Linear (integration)

OAuth client credentials for connecting a Linear workspace via the Integrations feature. Both are optional: when either is missing, the Linear integration is disabled and the app still boots. See Integrations.

Variable	Description
LINEAR_CLIENT_ID	Linear OAuth application client ID.
LINEAR_CLIENT_SECRET	Linear OAuth application client secret.

The OAuth redirect URI registered in the Linear application must be <web-origin>/integrations/linear/setup.