Docs
Environment Variables
Environment Variables
Every variable the server reads, by name, with what it is for and how to rotate it. Values are never written here.
Set in Vercel (Settings, Environment Variables) for production and in .env.local on a developer's machine. .env.example in the repository lists every name with a comment.
Required
| Name | Purpose | Rotate by |
|---|---|---|
NEXT_PUBLIC_SUPABASE_URL, SUPABASE_URL | Supabase project address | Does not rotate |
SUPABASE_SECRET_KEY | The service key the server uses. Bypasses RLS. Never reaches a browser | Supabase, API Keys: create new, set on Vercel, redeploy, revoke old |
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY | Clerk's public key | Clerk, API Keys |
CLERK_SECRET_KEY | Clerk's server key | Clerk, API Keys: create, set, redeploy, delete old |
CLERK_WEBHOOK_SIGNING_SECRET | Verifies webhook calls | Clerk, Webhooks, the endpoint |
NEXT_PUBLIC_CLERK_SIGN_IN_URL | /sign-in | Does not rotate |
RESEND_API_KEY | Sends email | Resend, API Keys |
EMAIL_FROM | The sender | Change in Vercel |
CRON_SECRET | Bearer token every cron route requires | New random string, set on Vercel, update the Supabase pg_cron job, redeploy |
NEXT_PUBLIC_APP_URL | https://www.impacthubos.com, used in email links | Does not rotate |
Integrations
| Name | Purpose |
|---|---|
GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET | Google Calendar connection |
NEXUS_API_URL, NEXUS_API_KEY, NEXUS_OUTCOMES_PATH | Nexus. Without them: stub ranker, no rooms |
OPENROUTER_API_KEY | The OS Agent's model. Without it the agent is off |
ANTHROPIC_API_KEY | Fallback for the agent |
NEXT_PUBLIC_SENTRY_DSN | Error reports |
LINEAR_API_KEY, LINEAR_TEAM_ID, LINEAR_SUPPORT_LABEL_ID | In-app reports become Linear issues |
APPLICATION_NOTIFY_EMAILS | Comma-separated list for application alerts and report copies |
EMAIL_REPLY_TO | Optional reply-to |
LINK_SIGNING_SECRET | Signs one-click links in email; falls back to CRON_SECRET |
Tuning (Optional)
| Name | Default | Meaning |
|---|---|---|
NEXUS_MATCH_MIN_SCORE | 0.8 | Lowest score a match is kept at |
MATCH_FOUNDER_RUN_CAP | 5 | New suggestions per founder per run |
MATCH_SUPPORTER_OPEN_CAP | 3 | Open matches one supporter holds |
NEXT_PUBLIC_GOOGLE_CALENDAR_PRIMARY | true | Write to the member's primary calendar |
NEXT_PUBLIC_GOOGLE_CALENDAR_READ | unset | Read access in app-calendar mode |
The Rotation Rule
Create the new key first, set it on Vercel, redeploy, confirm the feature works, then revoke the old one. A NEXT_PUBLIC_ change needs a redeploy; it is baked into the build.
If a Key Leaks
Rotate it the same way, at once. Then check Vercel's deployment list for preview deployments and the repository for any accidental commit of .env.local (it is ignored by Git; confirm it stayed that way).