Configuration

Every variable Creora reads, what it does, and what happens without it. src/lib/env.ts parses the server side of this list once at import; .env.example carries the same list with no values. Copy that file to .env.local, which is never committed.

How the environment is read

Values are trimmed, a blank one counts as unset, and a required variable has no default. A malformed one is a startup failure, not a fallback: the loader throws one error beginning Invalid environment: naming every variable that is wrong and its rule, echoing no values. The build imports it too and stops on the same error.

Required core

• MONGODB_URI. The MongoDB connection, the one store the app cannot run without. Required, beginning with mongodb:// or mongodb+srv://.
• JWT_SECRET. Signs session tokens. Required, at least 32 characters, and your-secret-key-change-in-production from the old example file is refused by name.
• NEXT_PUBLIC_APP_URL. The public origin, an absolute http or https URL. Required. Its origin is the SIWE uri, the session issuer and what the CSRF check compares against; its host, port included, is the SIWE domain. Anything but the origin served breaks signing in.
• NEXT_PUBLIC_REOWN_PROJECT_ID. The Reown (WalletConnect) Cloud project id the wallet modal is built with. Required.
• NODE_ENV. Next sets it. production makes DATABASE_SSL default to require and adds Strict-Transport-Security to the security headers.

The agent and Anthropic

• ANTHROPIC_API_KEY. The server wide key, used for a user who has stored none of their own. Optional. With no key from either source a run is refused, 412 no_api_key.
• ANTHROPIC_WORKSPACE_ID. The workspace that key acts in, sent as the anthropic-workspace-id header. Optional, and it must start with wrkspc_. Only an identity linked key needs one; a key that is not must send none.
• ANTHROPIC_MODEL. claude-opus-5 (the default), claude-sonnet-5 or claude-opus-4-8.
• ANTHROPIC_EFFORT. low, medium, high (the default), xhigh or max.
• ANTHROPIC_FALLBACKS. on (the default) or off. Off means a run fails rather than moving to another allowed model when the first is unavailable.
• AGENT_DAILY_OUTPUT_TOKEN_BUDGET. Output tokens one user may spend on the server's key in a UTC day. A non negative integer, default 2,000,000. Past it, 429 budget_exceeded. A user on their own key is never counted against it.
• AGENT_MAX_CONCURRENT_RUNS. Runs one server process holds at once. A positive integer, default 20. Past it, 429 server_busy. The registry is in process, so several instances multiply it.
• ENCRYPTION_KEY. Base64 of exactly 32 bytes, the AES-256-GCM key user supplied secrets are stored under. Optional. Without it stored keys answer 503 api_keys_disabled and GitHub 503 github_disabled; changing it leaves existing secrets unreadable, and a run that meets one is refused rather than billed to the server's key.

Credits need no variable of their own. See the agent.

Project databases

• DATABASE_URL_OWNER. The creora_owner connection, for provisioning and migrations only, over a fixed pool of 2.
• DATABASE_URL_APP. The creora_app connection, the only role on the request path.
• Both take a postgres:// or postgresql:// string and are set together or not at all; one without the other is a problem naming both. With neither, the feature is off rather than half on: no pool, no schema, and every surface that needs one says so.
• DATABASE_POOL_MAX. Connections in the app pool per web process. A positive integer, default 10, with the owner pool's 2 beside it.
• DATABASE_SSL. require, prefer or disable. Defaults to require in production and prefer elsewhere; a connection string carrying its own sslmode wins.
• DATA_API_ALLOWED_ORIGIN_SUFFIXES. Host suffixes the public data API answers CORS for, beside the app's own host. Comma separated, each starting with a dot. Default .csb.app,.codesandbox.io, where the Sandpack bundler serves a generated app from.

The test suites take their own pair, DATABASE_URL_OWNER_TEST and DATABASE_URL_APP_TEST, so a test run cannot reach the development cluster; unset, they skip themselves and say why. MONGODB_URI_TEST is the Mongo equivalent, default mongodb://localhost:27017/creora_test. See databases.

GitHub

GitHub has no variable of its own. The user brings a personal access token, stored encrypted under ENCRYPTION_KEY; without that key the integration answers 503 and says why. A server held token would write to other people's repositories, so there is none. See github.

The launchpad

Each has a NEXT_PUBLIC_ twin, because the server reads the chain and the browser signs the transactions. Give both halves the same value.

• LAUNCHPAD_ADDRESS and NEXT_PUBLIC_LAUNCHPAD_ADDRESS. The Launchpad every token is created and traded through. Optional. Without it the launchpad is off everywhere rather than showing a button that cannot work; an address that is not 20 hex bytes counts as unset.
• SWAP_ROUTER_ADDRESS and NEXT_PUBLIC_SWAP_ROUTER_ADDRESS. The router a graduated pool is traded through. Optional; without it the token page sends people to Uniswap's own site.
• LAUNCH_CHAIN_ID and NEXT_PUBLIC_LAUNCH_CHAIN_ID. 4663 for Robinhood Chain, 46630 for its testnet. Default 46630. The server refuses any other value, and refuses a public value that differs from its own: the browser signs on the chain the public value names, and it has to be the chain the server reads. The same rule binds the two address pairs above: a public address has to be set exactly when its server twin is, and equal to it.
• LAUNCH_RPC_URL. What the server reads the launchpad through. Optional; without it the chain's public endpoint is used, which is rate limited. It must be https, except on loopback, where http lets a local anvil stand in. See the launchpad.

Storage and Filecoin

• FILECOIN_API_KEY. A Lighthouse key that pins uploaded media to Filecoin. Optional, and its absence is supported rather than degraded: uploads still work, and every surface says plainly nothing was pinned.
• FILECOIN_API_URL. The node uploads are sent to. Optional, defaulting to Lighthouse's own; set it only to front the service with your own gateway.

The job worker

• JOBS_WORKER. on (the default) or off. On, the process starts one in process worker that polls the jobs collection every two seconds. One drainer is enough, so a single instance needs no setting; behind a load balancer leave it on for exactly one instance.

Proxies, moderators and chains

• TRUSTED_PROXY. 0 (the default) or 1. At 1 the first hop of x-forwarded-for is the address the per IP rate limits key on, which is right only behind a proxy that overwrites that header. At 0 no header is read and every caller shares one bucket.
• ADMIN_ADDRESSES. Comma separated wallet addresses holding moderator powers in the forum: pinning, locking, removing a post, and the report queue. Compared lowercased, and empty by default, so a deployment that sets nothing has no moderators.
• ETH_RPC_URLS. A JSON object mapping a chain id to an https RPC endpoint, used to verify smart contract wallet signatures under EIP-1271. Default empty. A chain with no entry accepts externally owned accounts only. The launchpad falls back to it when LAUNCH_RPC_URL is unset.

The public half

The environment module throws on a missing server variable and must never reach a client bundle, so what the browser needs travels as NEXT_PUBLIC_ instead: NEXT_PUBLIC_APP_URL, NEXT_PUBLIC_REOWN_PROJECT_ID, NEXT_PUBLIC_LAUNCHPAD_ADDRESS, NEXT_PUBLIC_SWAP_ROUTER_ADDRESS and NEXT_PUBLIC_LAUNCH_CHAIN_ID. Each is public, inlined into the bundle at build time, so changing one means rebuilding, not restarting.

What switches off entirely

• No ANTHROPIC_API_KEY and no stored key: every agent run is refused.
• No ENCRYPTION_KEY: stored Anthropic keys and the GitHub integration are off, and both say so.
• Not both of the DATABASE_URL pair: project databases are off, and so are the agent's data tools.
• No LAUNCHPAD_ADDRESS: the launchpad is off everywhere.
• No FILECOIN_API_KEY: uploads work and nothing is pinned.
• No ADMIN_ADDRESSES: the forum has no moderators.
• No ETH_RPC_URLS entry for a chain: only externally owned accounts sign in there.
• JOBS_WORKER off on every instance: nothing drains the job queue.