> ## Documentation Index > Fetch the complete documentation index at: https://docs.usertour.io/llms.txt > Use this file to discover all available pages before exploring further. # Environment Variables > Environment Variables. Usertour uses environment variables to configure various application parameters. Here's a detailed explanation of the environment variables: | Environment Variable | Required | Description | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Database Configuration** | | | | DATABASE\_URL | Yes | PostgreSQL database connection URL. Can be configured to use connection poolers like PgBouncer or Prisma Accelerate. This is the main connection URL used by your application. Both DATABASE\_URL and DATABASE\_DIRECT\_URL must be configured. | | DATABASE\_DIRECT\_URL | Yes | Direct PostgreSQL database connection URL. Required when using connection poolers in DATABASE\_URL. Used by Prisma CLI commands that need direct database access (like migrations, schema pushes, and introspection). Both DATABASE\_URL and DATABASE\_DIRECT\_URL must be configured. | | **Server Configuration** | | | | NEST\_SERVER\_PORT | No | NestJS server port, default is 3000 | | NODE\_ENV | Yes | Node.js environment | | **Email Service Configuration** | | | | EMAIL\_HOST | Yes | Email server address | | EMAIL\_PORT | Yes | Email server port | | EMAIL\_USER | Yes | Email service account | | EMAIL\_PASS | Yes | Email service password | | **Important**: Email service configuration is required for user registration and member invitation features. Without proper email configuration, these features will not be available. | | | | **Redis Configuration** | | | | Redis\_HOST | Yes | Redis server address | | Redis\_PORT | Yes | Redis server port | | Redis\_PASS | No | Redis server password | | **Application Configuration** | | | | APP\_HOMEPAGE\_URL | Yes | Application homepage URL | | API\_URL | No | GraphQL API endpoint, default is /graphql | | DOC\_URL | No | Documentation URL for error responses, default is [https://docs.usertour.com](https://docs.usertour.com) | | USERTOUR\_TOKEN | No | Usertour Environment token | | **AWS S3 Configuration** | | | | AWS\_S3\_REGION | Yes | AWS S3 region | | AWS\_S3\_ENDPOINT | Yes | AWS S3 endpoint | | AWS\_S3\_ACCESS\_KEY\_ID | Yes | AWS S3 access key ID | | AWS\_S3\_SECRET\_ACCESS\_KEY | Yes | AWS S3 secret access key | | AWS\_S3\_BUCKET | Yes | AWS S3 bucket name | | AWS\_S3\_DOMAIN | Yes | AWS S3 domain | | **Analytics Configuration** | | | | POSTHOG\_KEY | No | PostHog API key | | POSTHOG\_HOST | No | PostHog host URL | | **OpenTelemetry Configuration** | | | | OTLP\_TRACES\_ENDPOINT | No | OpenTelemetry traces endpoint URL for distributed tracing | | OTLP\_METRICS\_ENDPOINT | No | OpenTelemetry metrics endpoint URL for metrics collection | | **Encryption** | | | | ENCRYPTION\_KEY | Yes (prod) | 64-character hex string (32 bytes) used as the AES-256-GCM key for encrypting sensitive data at rest (currently 2FA TOTP secrets). Generate with `openssl rand -hex 32`. If unset, the server falls back to a known-insecure development key and logs no warning — do **not** ship that to production. Once users have enrolled in 2FA, do not rotate this key: existing TOTP secrets won't decrypt with a new value. | | **Authentication Configuration** | | | | JWT\_SECRET | Yes | JWT token secret key | | JWT\_EXPIRATION\_TIME | Yes | JWT token expiration time (e.g. 1h) | | JWT\_REFRESH\_EXPIRATION\_TIME | Yes | JWT refresh token expiration time (e.g. 7d) | | **Email Authentication** | | | | EMAIL\_AUTH\_ENABLED | No | Enable/disable email authentication | | EMAIL\_SENDER | No | Email sender name and address | | **GitHub Authentication** | | | | GITHUB\_AUTH\_ENABLED | No | Enable/disable GitHub authentication | | GITHUB\_CLIENT\_ID | No | GitHub OAuth client ID | | GITHUB\_CLIENT\_SECRET | No | GitHub OAuth client secret | | GITHUB\_CALLBACK\_URL | No | GitHub OAuth callback URL. Optional — defaults to `/api/auth/github/callback` when unset. | | **Google Authentication** | | | | GOOGLE\_AUTH\_ENABLED | No | Enable/disable Google authentication | | GOOGLE\_CLIENT\_ID | No | Google OAuth client ID | | GOOGLE\_CLIENT\_SECRET | No | Google OAuth client secret | | GOOGLE\_CALLBACK\_URL | No | Google OAuth callback URL. Optional — defaults to `/api/auth/google/callback` when unset. | | **SSO (OIDC)** | | | | SSO\_CALLBACK\_URL | No | OIDC redirect URI shown to admins and sent to the IdP. Optional — defaults to `/api/auth/sso/callback` when unset. | | **Other Configuration** | | | | LOGIN\_REDIRECT\_URL | No | URL to redirect after login | | USERTOUR\_COOKIE\_DOMAIN | No | Domain where cookies are valid and can be accessed | | USERTOUR\_COOKIE\_SECURE | No | Controls whether cookies can only be transmitted over HTTPS. | | **Outbound Security** | | | | ALLOW\_PRIVATE\_NETWORK\_EGRESS | No | When `true`, the server may make outbound requests — such as SSO issuer discovery — to private/internal addresses. Defaults to `false`: only public HTTPS targets are allowed, as an SSRF safeguard. Set to `true` if your identity provider is reachable only on an internal network (common for self-hosted IdPs such as Keycloak on `localhost`). | | **AI Provider (machine translation)** | | | | AI\_PROVIDER | No | Which AI provider powers [machine translation](/how-to-guides/localization): `anthropic` (default), `openai-compatible` (any OpenAI-shaped gateway, e.g. the OpenAI API, Azure OpenAI, or a local gateway), or `bedrock` (AWS). The feature is enabled by providing the provider's requirement below — no key/config means the AI translate buttons simply don't appear. | | AI\_API\_KEY | No | API key for the provider. Required for `anthropic`; optional for `openai-compatible` (keyless gateways work); for `bedrock` it is treated as a Bedrock API key (Bearer auth). | | AI\_MODEL | No | Model identifier, in the provider's own naming. Defaults to `claude-opus-4-8`. For `bedrock`, use a Bedrock model or inference-profile ID (e.g. `us.anthropic.claude-sonnet-4-6`). | | AI\_BASE\_URL | No | Base URL of the API. Required for `openai-compatible` (e.g. `https://api.openai.com/v1`); optional override for `anthropic`. | | AI\_AWS\_REGION | No | `bedrock` only. AWS region; falls back to `AWS_REGION` when unset. | | AI\_AWS\_ACCESS\_KEY\_ID | No | `bedrock` only. Explicit SigV4 credentials. When neither this pair nor `AI_API_KEY` is set, the AWS default credential chain is used (env vars, profile, instance role) — so deployments on AWS can run keyless. | | AI\_AWS\_SECRET\_ACCESS\_KEY | No | `bedrock` only. Secret half of the SigV4 key pair. | ## Important Notes * For local development, `APP_HOMEPAGE_URL` can be set to `http://[ip]:[port]` * For production environments, make sure to modify the default security-related configurations (such as JWT secrets) * `DATABASE_URL` includes the database connection parameters with SSL mode preference * Both `DATABASE_URL` and `DATABASE_DIRECT_URL` must be configured, regardless of whether you're using connection poolers or not * When using connection poolers (like PgBouncer) in production, make sure to: * Configure `DATABASE_URL` to use the connection pooler * Set `DATABASE_DIRECT_URL` to point directly to your PostgreSQL database * Ensure both URLs have proper SSL configuration for production use * The `DATABASE_DIRECT_URL` is essential for Prisma CLI operations and should always be configured when using connection poolers * Email service configuration is required for user registration and member invitation features. Without proper email configuration, these features will not be available ## Configuration Example (.env) Create a `.env` file in the project root directory. You can refer to the following example: ```env theme={null} # Database Configuration DATABASE_URL=postgresql://user:password@localhost:5432/dbname DATABASE_DIRECT_URL=postgresql://user:password@localhost:5432/dbname # Server Configuration NEST_SERVER_PORT=3000 NODE_ENV=production # Email Service Configuration EMAIL_HOST=smtp.example.com EMAIL_PORT=587 EMAIL_USER=your_email@example.com EMAIL_PASS=your_email_password # Redis Configuration Redis_HOST=localhost Redis_PORT=6379 Redis_PASS= # Application Configuration APP_HOMEPAGE_URL=http://localhost:8011 API_URL= DOC_URL=https://docs.usertour.com USERTOUR_TOKEN=your_token # AWS S3 Configuration AWS_S3_REGION=your_region AWS_S3_ENDPOINT=your_endpoint AWS_S3_ACCESS_KEY_ID=your_access_key AWS_S3_SECRET_ACCESS_KEY=your_secret_key AWS_S3_BUCKET=your_bucket AWS_S3_DOMAIN=your_domain # Analytics Configuration POSTHOG_KEY=your_posthog_key POSTHOG_HOST=your_posthog_host # OpenTelemetry Configuration OTLP_TRACES_ENDPOINT= OTLP_METRICS_ENDPOINT= # Encryption (run `openssl rand -hex 32` to generate) ENCRYPTION_KEY=replace_with_64_hex_chars # JWT Configuration JWT_SECRET=your_jwt_secret JWT_EXPIRATION_TIME=1h JWT_REFRESH_EXPIRATION_TIME=7d # Email Authentication EMAIL_AUTH_ENABLED=true EMAIL_SENDER=Your App # GitHub Authentication GITHUB_AUTH_ENABLED=true GITHUB_CLIENT_ID=your_github_client_id GITHUB_CLIENT_SECRET=your_github_client_secret # Optional — defaults to /api/auth/github/callback when unset GITHUB_CALLBACK_URL=http://localhost:8011/api/auth/github/callback # Google Authentication GOOGLE_AUTH_ENABLED=true GOOGLE_CLIENT_ID=your_google_client_id GOOGLE_CLIENT_SECRET=your_google_client_secret # Optional — defaults to /api/auth/google/callback when unset GOOGLE_CALLBACK_URL=http://localhost:8011/api/auth/google/callback # SSO (OIDC) — optional callback override; defaults to /api/auth/sso/callback SSO_CALLBACK_URL= # Outbound Security # Set to true only if your SSO identity provider is reachable on an internal network ALLOW_PRIVATE_NETWORK_EGRESS=false # AI Provider (optional — enables machine translation) # anthropic (default) | openai-compatible | bedrock AI_PROVIDER=anthropic AI_API_KEY=your_ai_api_key AI_MODEL=claude-opus-4-8 # Required for openai-compatible, e.g. https://api.openai.com/v1 AI_BASE_URL= # bedrock only — region falls back to AWS_REGION; credentials fall back to the AWS default chain AI_AWS_REGION= AI_AWS_ACCESS_KEY_ID= AI_AWS_SECRET_ACCESS_KEY= ``` **Note: Do not use these example values directly. Configure them according to your actual environment. Make sure to use secure keys and passwords in production environments.**