classroomio/apps/api/.env.example

# Required
DATABASE_URL=""
REDIS_URL=""
PUBLIC_SERVER_URL=""

TRUSTED_ORIGINS=""
BETTER_AUTH_SECRET=""

AUTH_BEARER_TOKEN=""
AUTH_COOKIE_DOMAIN=""

# Email provider — used by the API only for auth-flow emails (forgot
# password, password-reset confirmation, email verification, email-change
# verification). Every other email is sent by @cio/jobs-worker; see
# apps/jobs/.env.example. Both processes can point at the same SMTP server.
SMTP_HOST=""
SMTP_PORT=""
SMTP_USER=""
SMTP_SENDER=""
SMTP_PASSWORD=""

# Optional Zoho ZeptoMail token. When set, @cio/email uses Zoho instead of
# nodemailer/SMTP. Same dual-process note as SMTP above.
# ZOHO_TOKEN=""

# Optional - MinIO (S3-compatible, for Docker / on-premise self-hosting)
# When API runs in Docker: use http://minio:9000. For local API: use http://localhost:9000
MINIO_ROOT_USER=""
MINIO_ROOT_PASSWORD=""
OBJECT_STORAGE_ENDPOINT=""
OBJECT_STORAGE_PUBLIC_ENDPOINT=""
OBJECT_STORAGE_ACCESS_KEY_ID=""
OBJECT_STORAGE_SECRET_ACCESS_KEY=""
OBJECT_STORAGE_FORCE_PATH_STYLE=""
OBJECT_STORAGE_MEDIA_PUBLIC_BASE_URL=""

# Optional - Cloudflare R2 (for hosted deployments)
CLOUDFLARE_BUCKET_ID=""
CLOUDFLARE_ACCESS_KEY=""
CLOUDFLARE_ACCOUNT_ID=""
CLOUDFLARE_BUCKET_DOMAIN=""
CLOUDFLARE_SECRET_ACCESS_KEY=""

# HMAC secret used to sign the `cio_hls` playback cookie. The same value must
# be set on the tenant-router Worker (`wrangler secret put HLS_SIGNING_SECRET`)
# so segments served from R2 at the edge verify against this signature.
# Without it the cookie endpoints return 503 and HLS playback won't start —
# uploads still work, so leave it unset for upload-only local development.
# Generate one with: node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
HLS_SIGNING_SECRET=""

# Sentry (server-side error tracking). Leave SENTRY_DSN unset to disable.
# Skipped automatically in dev (NODE_ENV !== 'production') and self-hosted (PUBLIC_IS_SELFHOSTED=true).
SENTRY_DSN=""
SENTRY_ENVIRONMENT="production"
SENTRY_TRACES_SAMPLE_RATE="0"

# BullMQ dashboard (/admin/queues) ───────────────────────────────────────────
# In dev the dashboard is open. In production it's hidden unless ONE of the
# following is set; failing requests get 404 (not 401) so the route stays
# invisible to scanners.
#
# Comma-separated allowlist of Better Auth user emails — log in normally,
# visit /admin/queues, the middleware checks your session.
# QUEUE_DASHBOARD_ADMIN_EMAILS="you@yourdomain.com,partner@yourdomain.com"
#
# Bearer-token escape hatch for curl / scripts. Pass via
# `Authorization: Bearer <token>` or `?token=<token>`.
# QUEUE_DASHBOARD_TOKEN=""

# Enterprise (Optional)
# Required only when using Enterprise-only features (SSO, token-auth, no-tracking)
LICENSE_KEY=""

# SSO (Optional)
# For enterprise SSO with SAML (future support)
# SSO_ENCRYPTION_KEY="your-32-character-secret-key"

# AI Assistant (Optional)
# Per-provider API keys. The dashboard model picker exposes Gemini 3 Flash
# (Google) and GPT-4o (OpenAI). Anthropic is supported in code but not in the
# picker UI. Set at least one key to enable the assistant.
OPENAI_API_KEY=""
GOOGLE_API_KEY=""
ANTHROPIC_API_KEY=""
MOONSHOT_API_KEY=""

# Jina Reader — optional Bearer for higher rate limits when using fetch_documentation_url
# JINA_API_KEY=""
# AGENT_MAX_FETCHES_PER_CONVERSATION=15
# AGENT_MAX_FETCHES_PER_ORG_PER_DAY=500

# Tinybird event tracking for AI observability (optional — silently skipped when not set)
# TINYBIRD_TOKEN=""
# TINYBIRD_BASE_URL="https://api.tinybird.co"