Environment variables
Every variable the API and UI read, with validation rules and failure behaviour.
Configuration is validated at startup. The API refuses to start rather than running in an ambiguous state.
API — required
| Variable | Rule |
|---|---|
API_ORIGIN | Absolute URL of the API itself. |
UI_ORIGIN | Absolute URL of the UI. Also the only permitted CORS origin. |
DATABASE_URL | PostgreSQL connection string. |
BETTER_AUTH_SECRET | At least 32 characters. |
SCHEDULER_SECRET | At least 32 characters. Guards /internal/scheduler/tick. |
ENCRYPTION_KEY | Base64 that decodes to exactly 32 bytes. |
Generate the encryption key with:
openssl rand -base64 32API — inference
| Variable | Default | Rule |
|---|---|---|
LLM_GATEWAY_API_KEY | — | Required unless DEMO_MODE=true. Never required for the public model directory. |
LLM_GATEWAY_DEFAULT_MODEL | openai/gpt-5-mini | Non-empty string. |
DEMO_MODE | false | true or false. Rejected outright in production. |
NODE_ENV | development | development, production, or test. |
Startup fails when:
NODE_ENV=productionandDEMO_MODE=true;LLM_GATEWAY_API_KEYis absent andDEMO_MODEis nottrue; orENCRYPTION_KEYdoes not decode to 32 bytes.
Empty is the same as unset
An empty assignment such as LLM_GATEWAY_API_KEY= is treated as absent, so a
checked-in .env.example placeholder never satisfies a requirement by
accident.
API — connection providers
Every provider is optional and enabled by supplying its credentials. A provider without credentials is listed in the dashboard with its connect action disabled.
| Variable | Default | Notes |
|---|---|---|
GITHUB_OAUTH_CLIENT_ID | — | Enables the GitHub connection. |
GITHUB_OAUTH_CLIENT_SECRET | — | GitHub OAuth apps do not support PKCE. |
POSTHOG_OAUTH_CLIENT_ID | — | Enables the PostHog connection. |
POSTHOG_OAUTH_CLIENT_SECRET | — | |
POSTHOG_OAUTH_ISSUER | https://oauth.posthog.com | Must be an absolute URL. |
Register each callback as ${API_ORIGIN}/oauth/callback/<provider>.
Zernio needs no deployment configuration — each project pastes its own API key.
UI
| Variable | Notes |
|---|---|
API_ORIGIN | Where the UI proxies /api/auth/* and /api/service/*. |
DOCS_ORIGIN | Where documentation links point. |
Local development
.env.example holds local-only fixtures and is safe to copy:
cp .env.example .env
docker compose up -d postgres
pnpm db:migrate
pnpm db:seed
pnpm devGenerate fresh BETTER_AUTH_SECRET, ENCRYPTION_KEY, and SCHEDULER_SECRET
values for every deployed environment. .env files are ignored by git and must
never be committed.