Skip to main content

Environment Variables

Complete reference for all environment variables used across the UniPulse platform.

API Backend (apps/api/.env)​

Core​

VariableRequiredDefaultDescription
DATABASE_URLYes-PostgreSQL connection string (postgresql://user:pass@host:5432/db)
REDIS_URLYes-Redis connection string (redis://localhost:6379)
JWT_SECRETYes-Secret for signing JWT access tokens (min 32 chars)
JWT_REFRESH_SECRETYes-Secret for signing JWT refresh tokens (min 32 chars)
ENCRYPTION_KEYYes-AES-256 encryption key for social tokens (64 hex characters)
PORTNo3000API server port
NODE_ENVNodevelopmentEnvironment (development, production)
FRONTEND_URLYes-Frontend URL for CORS and email links (http://localhost:5173)
ENCRYPTION_KEY Format

The ENCRYPTION_KEY must be exactly 64 hexadecimal characters (representing 32 bytes for AES-256). Generate one with:

openssl rand -hex 32

AI​

VariableRequiredDefaultDescription
GEMINI_API_KEYFor AI features-Google Gemini API key from ai.google.dev

Social Platforms​

VariableRequiredDescription
FACEBOOK_APP_IDFor Facebook/InstagramFacebook app ID
FACEBOOK_APP_SECRETFor Facebook/InstagramFacebook app secret
INSTAGRAM_CALLBACK_URLFor InstagramInstagram OAuth callback URL
TIKTOK_CLIENT_KEYFor TikTokTikTok app client key
TIKTOK_CLIENT_SECRETFor TikTokTikTok app client secret

OAuth Providers (User Login)​

VariableRequiredDescription
GOOGLE_CLIENT_IDFor Google loginGoogle OAuth 2.0 client ID
MICROSOFT_CLIENT_IDFor Microsoft loginMicrosoft (Azure AD) client ID
MICROSOFT_TENANT_IDFor Microsoft loginMicrosoft tenant ID

Payments​

VariableRequiredDescription
STRIPE_SECRET_KEYFor Stripe paymentsStripe API secret key
STRIPE_WEBHOOK_SECRETFor Stripe webhooksStripe webhook signing secret
PAYMOB_API_KEYFor Paymob paymentsPaymob API key

AWS (Media Storage)​

VariableRequiredDescription
AWS_S3_BUCKETFor media uploadsS3 bucket name
AWS_S3_REGIONFor media uploadsS3 region (e.g., us-east-1)
AWS_ACCESS_KEY_IDFor media uploadsAWS access key
AWS_SECRET_ACCESS_KEYFor media uploadsAWS secret key

Email (SMTP)​

VariableRequiredDescription
SMTP_HOSTFor emailsSMTP server hostname
SMTP_PORTFor emailsSMTP port (587 for TLS, 465 for SSL)
SMTP_USERFor emailsSMTP username
SMTP_PASSFor emailsSMTP password
SMTP_FROMFor emailsSender email address

Web Frontend (apps/web/.env)​

VariableRequiredDefaultDescription
VITE_API_URLYeshttp://localhost:3000Backend API base URL
Frontend Environment Variables

Only variables prefixed with VITE_ are included in the client bundle. Never put secrets in frontend env variables -- they are visible in the browser.

Control Center (UniPulse-Control-Center/apps/server/.env)​

VariableRequiredDescription
JWT_SECRETYesJWT signing secret (separate from Pulse)
JWT_REFRESH_SECRETYesRefresh token secret
GOOGLE_CLIENT_IDYesGoogle OAuth client ID (for admin login)
GOOGLE_CLIENT_SECRETYesGoogle OAuth client secret
GITHUB_TOKENFor CI/CD monitoringGitHub personal access token
ALLOWED_EMAILSYesComma-separated whitelist of authorized emails
PORTNo3001
DATABASE_URLNofile:./dev.db

Docker Dev Environment​

Default values for docker-compose.yml:

VariableDefaultDescription
POSTGRES_USERpostgresPostgreSQL username
POSTGRES_PASSWORDpostgresPostgreSQL password
POSTGRES_DBunipulseDatabase name

The resulting DATABASE_URL for local development:

DATABASE_URL=postgresql://postgres:postgres@localhost:5432/unipulse

Docker Prod Environment​

Production environment variables are typically set via:

  • .env file in the project root (loaded by Docker Compose)
  • Docker secrets for sensitive values
  • Environment-specific deployment configuration

Example .env File​

# === CORE ===
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/unipulse
REDIS_URL=redis://localhost:6379
JWT_SECRET=your-jwt-secret-min-32-characters-long
JWT_REFRESH_SECRET=your-refresh-secret-min-32-characters-long
ENCRYPTION_KEY=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
PORT=3000
NODE_ENV=development
FRONTEND_URL=http://localhost:5173

# === AI ===
GEMINI_API_KEY=your-gemini-api-key

# === SOCIAL PLATFORMS ===
FACEBOOK_APP_ID=your-facebook-app-id
FACEBOOK_APP_SECRET=your-facebook-app-secret
INSTAGRAM_CALLBACK_URL=http://localhost:3000/api/v1/auth/oauth/instagram/callback
TIKTOK_CLIENT_KEY=your-tiktok-client-key
TIKTOK_CLIENT_SECRET=your-tiktok-client-secret

# === OAUTH (User Login) ===
GOOGLE_CLIENT_ID=your-google-client-id
MICROSOFT_CLIENT_ID=your-microsoft-client-id
MICROSOFT_TENANT_ID=your-microsoft-tenant-id

# === PAYMENTS ===
STRIPE_SECRET_KEY=sk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...

# === AWS S3 ===
AWS_S3_BUCKET=unipulse-media
AWS_S3_REGION=us-east-1
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=...

# === EMAIL ===
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=noreply@example.com
SMTP_PASS=your-app-password
SMTP_FROM=UniPulse <noreply@example.com>

Security Checklist​

PracticeStatus
Never commit .env files.gitignore includes .env*
Use separate secrets per environmentDifferent JWT secrets for dev/staging/prod
Rotate ENCRYPTION_KEY with key migrationPlan for encrypted data re-encryption
Use strong JWT secretsMinimum 32 characters, cryptographically random
Restrict Gemini API keySet API restrictions in Google Cloud Console
Use Stripe test keys in developmentsk_test_* for dev, sk_live_* for prod
Cross-Reference