Environment variables

The scaffold validates env vars at startup with @t3-oss/env-nextjs and Zod. The full schema lives in src/env.ts — open it for the source of truth. This page mirrors that file, organized by category, so you can copy-paste your way to a working .env.local (and prod env) in one pass. A few conventions:

Required vars throw at startup if missing or empty.
Optional vars default to empty string and the consuming module no-ops gracefully.
NEXT_PUBLIC_* vars are shipped to the browser. Never put secrets in them.
Set SKIP_ENV_VALIDATION=true to bypass validation in CI build steps that don’t need real values (Vercel preview builds, Docker image bakes, etc.).

Core

The bare minimum for the app to boot.

Variable	Required	Default	Description
`NODE_ENV`	no	`development`	`development` / `production` / `test`. Set automatically by your runtime.
`DATABASE_PROVIDER`	no	`postgres`	Reserved for future drivers. Only `postgres` is supported today.
`DATABASE_URL`	yes	—	Postgres connection string. Use the pooled URL in production.
`BETTER_AUTH_SECRET`	yes	—	16+ char secret for session signing. Generate: `openssl rand -base64 32`.
`BETTER_AUTH_URL`	no	—	Full URL (with scheme) of your deployed app. Required in production for OAuth callbacks.
`NEXT_PUBLIC_APP_URL`	no	`http://localhost:3000`	Used by sitemap, OG images, OAuth redirects. Set to your prod URL.
`NEXT_PUBLIC_APP_NAME`	no	`Vibestrap`	Display name in titles, OG metadata, emails.
`ADMIN_EMAILS`	no	`''`	Comma-separated list of admin emails. Auto-promoted to `role: 'admin'` on signup.

OAuth

Each provider is independent — set both id + secret to enable, leave blank to hide.

Variable	Required	Default	Description
`GOOGLE_CLIENT_ID`	no	`''`	Google OAuth client id. Enables “Sign in with Google”.
`GOOGLE_CLIENT_SECRET`	no	`''`	Google OAuth secret (server-only).
`NEXT_PUBLIC_GOOGLE_CLIENT_ID`	no	`''`	Mirror of `GOOGLE_CLIENT_ID`. Needed for client-side One-Tap. Safe to expose.
`GITHUB_CLIENT_ID`	no	`''`	GitHub OAuth app id. Enables “Sign in with GitHub”.
`GITHUB_CLIENT_SECRET`	no	`''`	GitHub OAuth secret.

Mail

Resend is the default. The mail facade no-ops gracefully if RESEND_API_KEY is empty.

Variable	Required	Default	Description
`RESEND_API_KEY`	no	`''`	Resend API key (`re_…`). Powers verification + welcome + reset-password emails.
`RESEND_FROM_EMAIL`	no	`onboarding@resend.dev`	`From:` address. Switch to your verified domain in production.
`RESEND_REPLY_TO_EMAIL`	no	`''`	Optional `Reply-To:` header.
`RESEND_AUDIENCE_ID`	no	`''`	Resend Audience id for newsletter (when `newsletter.provider = 'resend'`).

Only used if siteConfig.newsletter.provider = 'beehiiv'.

Variable	Required	Default	Description
`BEEHIIV_API_KEY`	no	`''`	Beehiiv v2 API key.
`BEEHIIV_PUBLICATION_ID`	no	`''`	Publication id (`pub_…`).

Payments — Stripe

Default provider. Only the *_PRICE_* ids you actually sell need to be set.

Variable	Required	Default	Description
`STRIPE_SECRET_KEY`	yes (if active)	`''`	`sk_test_…` / `sk_live_…`.
`STRIPE_WEBHOOK_SECRET`	yes (if active)	`''`	`whsec_…` from the Stripe dashboard webhook config.
`NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY`	no	`''`	`pk_…`. Needed for Stripe.js / Elements.
`STRIPE_PRICE_VIBESTRAP_PROMO`	no	`''`	Price id for the Vibestrap promo tier ($49).
`STRIPE_PRICE_VIBESTRAP_STANDARD`	no	`''`	Price id for the Vibestrap standard tier ($99).
`STRIPE_PRICE_PRO_MONTHLY`	no	`''`	Demo Pro plan, monthly recurring.
`STRIPE_PRICE_PRO_YEARLY`	no	`''`	Demo Pro plan, yearly recurring.

Payments — Creem

Only used if siteConfig.payment.provider = 'creem'.

Variable	Required	Default	Description
`CREEM_API_KEY`	yes (if active)	`''`	Creem API key.
`CREEM_WEBHOOK_SECRET`	yes (if active)	`''`	Webhook signing secret.
`CREEM_PRICE_VIBESTRAP_PROMO`	no	`''`	Price id for promo tier.
`CREEM_PRICE_VIBESTRAP_STANDARD`	no	`''`	Price id for standard tier.

AI providers

Set AI_PROVIDER to switch between providers. The mock provider streams fake tokens without keys, so demo pages run offline out of the box.

Variable	Required	Default	Description
`AI_PROVIDER`	no	`mock`	`mock` / `openrouter` / `openai` / `anthropic` / `replicate` / `fal`.
`OPENROUTER_API_KEY`	no	`''`	OpenRouter key (gateway to most LLMs).
`OPENROUTER_BASE_URL`	no	`https://openrouter.ai/api/v1`	Override only if self-hosting a gateway.
`OPENAI_API_KEY`	no	`''`	OpenAI key (`sk-…`).
`OPENAI_BASE_URL`	no	`https://api.openai.com/v1`	Override for Azure OpenAI or compat endpoints.
`ANTHROPIC_API_KEY`	no	`''`	Anthropic key (`sk-ant-…`).
`ANTHROPIC_BASE_URL`	no	`https://api.anthropic.com`	Override for Bedrock / proxy.
`REPLICATE_API_TOKEN`	no	`''`	Replicate API token for image / audio models.
`FAL_KEY`	no	`''`	fal.ai key for fast image generation.

Storage (S3 / R2)

Stub by default — wire only if you need uploads or signed downloads.

Variable	Required	Default	Description
`S3_ENDPOINT`	no	`''`	Endpoint URL. AWS S3, Cloudflare R2, MinIO all work.
`S3_REGION`	no	`''`	Bucket region. R2 uses `auto`.
`S3_ACCESS_KEY_ID`	no	`''`	Access key id.
`S3_SECRET_ACCESS_KEY`	no	`''`	Secret access key.
`S3_BUCKET`	no	`''`	Bucket name.
`S3_PUBLIC_URL`	no	`''`	Public CDN base URL for served objects.

Anti-bot — Cloudflare Turnstile

Set both keys to enable Turnstile on signup, forgot-password, and newsletter forms.

Variable	Required	Default	Description
`TURNSTILE_SECRET_KEY`	no	`''`	Server-side verification secret.
`NEXT_PUBLIC_TURNSTILE_SITE_KEY`	no	`''`	Public site key for the widget.

Customer service

One widget at a time, picked by siteConfig.customerService.provider. Each widget self-gates on its env vars.

Variable	Required	Default	Description
`NEXT_PUBLIC_CRISP_WEBSITE_ID`	no	`''`	Crisp website id (UUID).
`NEXT_PUBLIC_TAWK_PROPERTY_ID`	no	`''`	tawk.to property id.
`NEXT_PUBLIC_TAWK_WIDGET_ID`	no	`''`	tawk.to widget id.
`NEXT_PUBLIC_INTERCOM_APP_ID`	no	`''`	Intercom workspace id.
`NEXT_PUBLIC_CHATWOOT_WEBSITE_TOKEN`	no	`''`	Chatwoot website token.
`NEXT_PUBLIC_CHATWOOT_BASE_URL`	no	`https://app.chatwoot.com`	Self-hosted Chatwoot URL if you run your own.

Affiliate

Set the matching var(s) for whichever provider is active in siteConfig.affiliate.provider. The internal provider needs no env vars.

Variable	Required	Default	Description
`NEXT_PUBLIC_AFFONSO_PROGRAM_ID`	no	`''`	Affonso program id.
`NEXT_PUBLIC_REWARDFUL_API_KEY`	no	`''`	Rewardful public API key.

Analytics

Each script renders only when its env var is set. Mix and match freely.

Variable	Required	Default	Description
`NEXT_PUBLIC_GOOGLE_ANALYTICS_ID`	no	`''`	GA4 measurement id (`G-…`).
`NEXT_PUBLIC_POSTHOG_KEY`	no	`''`	PostHog project key.
`NEXT_PUBLIC_POSTHOG_HOST`	no	`https://us.i.posthog.com`	EU users: `https://eu.i.posthog.com`.
`NEXT_PUBLIC_PLAUSIBLE_DOMAIN`	no	`''`	Plausible site domain.
`NEXT_PUBLIC_PLAUSIBLE_HOST`	no	`https://plausible.io`	Self-hosted Plausible URL if applicable.
`NEXT_PUBLIC_UMAMI_WEBSITE_ID`	no	`''`	Umami website id.
`NEXT_PUBLIC_UMAMI_HOST`	no	`https://cloud.umami.is`	Self-hosted Umami URL if applicable.
`NEXT_PUBLIC_CLARITY_PROJECT_ID`	no	`''`	Microsoft Clarity project id (heatmaps + session replay).

Search-engine site verification

Each emits a <meta> tag in <head> via Next.js metadata.verification, proving ownership in the matching webmaster console. Server-side env vars (no NEXT_PUBLIC_ prefix). Empty values render no tag.

Variable	Required	Default	Description
`GOOGLE_SITE_VERIFICATION`	no	`''`	Google Search Console — `content` value of the `google-site-verification` meta tag.
`BING_SITE_VERIFICATION`	no	`''`	Bing Webmaster Tools — `content` value of the `msvalidate.01` meta tag.
`YANDEX_SITE_VERIFICATION`	no	`''`	Yandex Webmaster — `content` value of the `yandex-verification` meta tag.

GitHub invite delivery

Token used by the buyer flow to add a paid customer as a read-only collaborator on your private source repo. See GitHub invite delivery for the full setup.

Variable	Required	Default	Description
`GITHUB_INVITE_TOKEN`	no	`''`	Fine-grained PAT scoped to one repo with Metadata:read + Administration:write. Empty = invite UI disables itself.

Misc

Variable	Required	Default	Description
`NEXT_PUBLIC_DEMO_MODE`	no	`false`	Set `true` to hide real payment + auth and show the read-only demo overlay.

Getting started

Authentication

Payments

AI primitives

Growth

Content & i18n

Operations

Deployment

Reference

Environment variables

Core

OAuth

Mail

Payments — Stripe

Payments — Creem

AI providers

Storage (S3 / R2)

Anti-bot — Cloudflare Turnstile

Customer service

Affiliate

Analytics

Search-engine site verification

GitHub invite delivery

Misc

See also

​Core

​OAuth

​Mail

​Newsletter — Beehiiv

​Payments — Stripe

​Payments — Creem

​AI providers

​Storage (S3 / R2)

​Anti-bot — Cloudflare Turnstile

​Customer service

​Affiliate

​Analytics

​Search-engine site verification

​GitHub invite delivery

​Misc

​See also

Core

OAuth

Mail

Newsletter — Beehiiv

Payments — Stripe

Payments — Creem

AI providers

Storage (S3 / R2)

Anti-bot — Cloudflare Turnstile

Customer service

Affiliate

Analytics

Search-engine site verification

GitHub invite delivery

Misc

See also