Environment Setup

Configure production environment variables and secrets.

Before deploying to production, you need to configure all required environment variables. This guide covers the essential variables and how to set them up for the Prisma kit.

How to Configure

Set production variables directly in your hosting provider's environment settings (Railway, Docker, etc.). Public values (VITE_*) are inlined by Vite at build time, while server secrets are read from process.env at runtime — set both in your provider.

Use the committed apps/web/.env as the reference list of public variables, and add any required secrets (database URL, auth secret, billing keys, SMTP credentials) that are not committed.

Required Environment Variables

Database

DATABASE_URL=postgresql://user:password@host:5432/database

Your PostgreSQL connection string. Get this from your database provider (Neon, Supabase, Railway, etc.).

Site URL

VITE_SITE_URL=https://your-domain.com

Your production domain. Must match exactly - used for authentication callbacks, emails, and absolute URLs.

Authentication Secret

BETTER_AUTH_SECRET=your-random-secret-string

A random secret string used to sign authentication tokens and cookies. Generate a secure random string (at least 32 characters). You can generate one using:

openssl rand -base64 32

Billing Provider

VITE_BILLING_PROVIDER=stripe

Set to stripe or polar depending on your billing provider.

For Stripe:

STRIPE_SECRET_KEY=sk_live_...
STRIPE_WEBHOOK_SECRET=whsec_...

For Polar:

POLAR_ACCESS_TOKEN=...

Storage (S3-Compatible)

STORAGE_BASE_URL=https://your-bucket-endpoint.com
STORAGE_S3_ACCESS_KEY_ID=...
STORAGE_S3_SECRET_ACCESS_KEY=...
STORAGE_S3_BUCKET=your-bucket-name
STORAGE_S3_REGION=us-east-1

Required for file uploads. Works with AWS S3, Cloudflare R2, Railway Storage, or any S3-compatible provider.

Email

EMAIL_SENDER=noreply@your-domain.com

Plus your email provider credentials (Resend, Postmark, SendGrid, etc.).

Optional Environment Variables

OAuth Providers

If you enabled social login during development:

Google:

GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...

GitHub:

GITHUB_CLIENT_ID=...
GITHUB_CLIENT_SECRET=...

Feature Flags

VITE_ACCOUNT_MODE=hybrid
VITE_ENABLE_PERSONAL_ACCOUNT_BILLING=true
VITE_ALLOW_USER_TO_CREATE_ORGANIZATION=true

Match these to your development configuration. Team/organization behavior is controlled by VITE_ACCOUNT_MODE; see Account Modes.

Environment Variables Reference

VariableRequiredDescription
DATABASE_URLYesPostgreSQL connection string
VITE_SITE_URLYesProduction domain URL
BETTER_AUTH_SECRETYesAuthentication token signing secret
VITE_BILLING_PROVIDERYesstripe or polar
STRIPE_SECRET_KEYIf StripeStripe secret key
STRIPE_WEBHOOK_SECRETIf StripeStripe webhook signing secret
POLAR_ACCESS_TOKENIf PolarPolar API token
STORAGE_BASE_URLYesS3 endpoint URL
STORAGE_S3_ACCESS_KEY_IDYesS3 access key
STORAGE_S3_SECRET_ACCESS_KEYYesS3 secret key
STORAGE_S3_BUCKETYesS3 bucket name
STORAGE_S3_REGIONYesS3 region
EMAIL_SENDERYesFrom email address

For the complete list, see the Environment Variables Reference.

Best Practices

  1. Never commit secrets - Use .env.local for local development, never commit to git
  2. Use different values per environment - Don't reuse development keys in production
  3. Validate before deploying - Double-check that all required variables (see the table above) are set in your provider
  4. Rotate secrets regularly - Especially after team member changes
  5. Use your provider's secret management - Most hosting platforms encrypt environment variables

Common Mistakes

  • Wrong site URL - Must match your actual domain exactly, including https://
  • Missing webhook secrets - Billing won't work without webhook configuration
  • Development keys in production - Stripe test keys won't process real payments
  • Typos in variable names - Double-check spelling, especially for the VITE_ prefix