Environment Variables#

All environment variables are configured in the root .env file.

bashcp .env.example .env

Backend Variables (Server Only)#

Basic#

Database#

JWT#

API Authentication#

Email#

Switch the sending service via MAIL_PROVIDER (defaults to ses).

• MAIL_PROVIDER=cloudflare: requires CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN below.
• MAIL_PROVIDER=ses: requires the AWS credentials below (AWS_REGION / AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY).

Cloudflare (shared by Email / R2)#

AWS (SES email / S3 storage)#

Cloudflare R2 Storage#

Object storage supports R2 and S3 at the same time: setting R2_ACCESS_KEY_ID enables R2, setting S3_BUCKET_NAME enables S3. When no provider is specified, R2 is used by default (e.g. invoice/receipt PDFs are auto-uploaded to R2); code can also pass a provider to pick R2 or S3 per upload.

R2 Bucket CORS Configuration (Required)#

Browser-to-R2 direct uploads (presigned PUT and multipart) require CORS to be configured on the R2 bucket — otherwise the browser blocks the request, or multipart fails because ETag headers can't be read.

Go to Cloudflare Dashboard → R2 → your bucket → Settings → CORS Policy and add:

json[
  {
    "AllowedOrigins": ["http://localhost:3000", "https://yourdomain.com"],
    "AllowedMethods": ["GET", "PUT", "HEAD"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["*"]
  }
]

Notes:

• AllowedOrigins: list every origin that will upload (dev + production)
• AllowedMethods must list methods explicitly (S3/R2 CORS does not accept * wildcard). PUT for upload; GET/HEAD for fetch / <img crossOrigin> preflight
• ExposeHeaders: ["*"] is simplest, otherwise must include "ETag" or multipart complete will fail because the client can't read part ETags

Stripe#

Cloudflare Turnstile#

Frontend Variables (PUBLIC_ prefix)#

Exposed to the browser. Do not put sensitive data here.