Environment

Secrets are environment variables or a secret manager. They are not committed. The names below are the contract. Values differ by machine.

API and worker

Name	Purpose
DATABASE_URL	The only PostgreSQL URL. The generated Prisma Client, prisma migrate, and prisma db execute all use it. TLS in production.
APP_BASE_URL	Public Next.js origin, used in email links.
API_BASE_URL	Public webhook origin.
JWT_ACCESS_SECRET	HMAC secret for access tokens.
STRIPE_SECRET_KEY	Server-side Stripe secret. USD charges.
STRIPE_WEBHOOK_SECRET	Stripe signature verification.
STORAGE_ENDPOINT	S3-compatible endpoint.
STORAGE_BUCKET	Private bucket name.
STORAGE_ACCESS_KEY	Storage credential for the API and worker.
STORAGE_SECRET_KEY	Storage secret.
SIGNED_URL_TTL_SECONDS	Initial value 300.
EMAIL_FROM	From address for transactional mail.
SMTP_URL	Mail transport, or the provider's equivalent variables.
MFA_ENCRYPTION_KEY	Key that encrypts TOTP secrets at rest.

Next.js receives API_BASE_URL for server-side calls. It does not receive DATABASE_URL, JWT_ACCESS_SECRET, the Stripe secret, or the storage secret.

Fixed product settings

These are code and database rules, not environment toggles:

• Currency is USD.
• Signed URL lifetime defaults to 300 seconds.
• Account setup tokens last 72 hours.
• Password reset tokens last 1 hour.
• Access tokens last 15 minutes.
• Refresh tokens last 14 days.
• Photo upload limit is 50 MB.
• Reward rounding is the integer formula in referrals and rewards.

Changing the reward percentage is a reward_policies row, not an environment variable. That keeps the rate that applied to a past order on the reward row.

Documentation site

The Docusaurus site has no database and no payment keys. url in docusaurus.config.ts is a placeholder until the documentation host name is chosen.