| Variable | Description |
|---|
DATABASE_URL | PostgreSQL connection string, e.g. postgresql://user:pass@localhost:5432/ablebase. |
BETTER_AUTH_SECRET | Secret used to sign auth tokens. Generate with openssl rand -base64 32. |
BETTER_AUTH_URL | Must be the web origin (e.g. http://localhost:5173), not the API’s own port. Auth callbacks and session cookies are issued against this URL. |
| Variable | Default | Description |
|---|
PORT | 3001 | Port the API listens on. |
HOST | 0.0.0.0 | Bind address. |
CLIENT_ORIGIN | http://localhost:4813 | Comma-separated list of allowed CORS origins. |
TRUST_PROXY | — | Set to "true" when running behind a reverse proxy to get accurate client IPs for rate limiting. |
SKIP_MIGRATIONS | — | Set to "1" to skip automatic migrations at startup. |
UPLOAD_DIR | ./uploads | Filesystem path for storing uploaded profile pictures and org logos. Must be a persistent volume in containerized deployments. |
| Variable | Default | Description |
|---|
ALLOW_SIGNUP | false | Set to "true" to allow new email/password account registration. |
| Variable | Description |
|---|
GITHUB_CLIENT_ID | GitHub OAuth App client ID. |
GITHUB_CLIENT_SECRET | GitHub OAuth App client secret. |
The OAuth callback URL must be <BETTER_AUTH_URL>/api/auth/callback/github.
| Variable | Description |
|---|
SENTRY_DSN | Sentry DSN for server-side error tracking. Optional. |
| Variable | Description |
|---|
FLAGSMITH_ENVIRONMENT_KEY | Server-side Flagsmith environment key (secret — do not expose to clients). Optional. |
| Variable | Description |
|---|
CI | Set to any truthy value to disable the global rate limiter during test runs. |
PLAYWRIGHT | Same effect as CI. Used to disable rate limiting during Playwright end-to-end tests. |
| Variable | Description |
|---|
RAILWAY_SERVICE__ABLEBASE_WEB_URL | Injected automatically by Railway. Ablebase trusts this domain as a CORS and auth origin. No manual configuration needed. |
| Variable | Description |
|---|
VITE_FLAGSMITH_ENVIRONMENT_ID | Client-side Flagsmith environment ID. Safe to ship to the browser. Optional. |
