Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.
Certiva validates all environment variables at startup using a Zod schema. A missing or invalid value causes an immediate hard failure with a descriptive error. Several rules are only enforced when APP_ENV=staging or APP_ENV=production.
These rules are enforced in apps/api/src/config/env.schema.ts at startup:
JWT_SECRET must be at least 64 characters and must not be a known placeholder value in staging/prod.
CORS_ORIGINS must not be empty or contain * in staging/prod.
STORAGE_DRIVER must be r2 in staging/prod — local is rejected.
When BLOCKCHAIN_ENABLED=true: POLYGON_AMOY_RPC_URL, PRIVATE_KEY, and CONTRACT_ADDRESS are all required.
When STORAGE_DRIVER=r2: all R2_* variables are required.
PRIVATE_KEY must not match known development test keys in staging/prod.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Archive Circle","colors":{"primary":"#E07AAE","light":"#F29BC1","dark":"#7EC7D1"},"logo":{"light":"https://mintcdn.com/archivecircle/FjLY4c9CRnMT_uZN/logo/light.svg?fit=max\u0026auto=format\u0026n=FjLY4c9CRnMT_uZN\u0026q=85\u0026s=ccb1134687234eb93997c52eafeeb7ad","dark":"https://mintcdn.com/archivecircle/FjLY4c9CRnMT_uZN/logo/dark.svg?fit=max\u0026auto=format\u0026n=FjLY4c9CRnMT_uZN\u0026q=85\u0026s=40976682b25e3d26d34e78ee542fdade"},"favicon":"https://mintcdn.com/archivecircle/FjLY4c9CRnMT_uZN/favicon.svg?fit=max\u0026auto=format\u0026n=FjLY4c9CRnMT_uZN\u0026q=85\u0026s=6973afdead181394f3268b352c7a5f27","navbar":{"links":[{"href":"https://github.com/Archive-Circle","label":"GitHub"}]},"footer":{"socials":{"github":"https://github.com/Archive-Circle/eternum"}},"contextual":{"options":["copy","view","chatgpt","claude","perplexity","mcp","cursor","vscode"],"display":"header"},"styling":{"latex":false},"navigation":{"global":{"anchors":[{"anchor":"Archive Circle GitHub","icon":"github","href":"https://github.com/Archive-Circle"}]},"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"archivecircle","hasAudioNarration":false,"actualSubdomain":"archivecircle","customDomains":["docs.archivecircle.xyz"],"gitSource":{"type":"github","owner":"archive-circle","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":false,"mountPath":"","label":""},"entitlements":{"AI_CHAT":{"status":"DISABLED"}},"buildId":"6ae957d837dad6e4be6b1c77:success","clientVersion":"0.0.4117","searchFilterCounts":[{"language":"default","tag":"Eternum","count":16},{"language":"default","tag":"Product guide","count":11},{"language":"default","tag":"Start here","count":8},{"language":"default","tag":"Certiva","count":6},{"language":"default","tag":"ChainLens","count":6},{"language":"default","tag":"SplitBot","count":6},{"language":"default","tag":"User guides","count":5},{"language":"default","tag":"Operators","count":3},{"language":"default","tag":"Recovery","count":3},{"language":"default","tag":"Security","count":3}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-rbac-roles","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"certiva/configuration","slug":"/certiva/configuration","pageMetadata":{"title":"Configuration","description":"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.","icon":"sliders","href":"/certiva/configuration"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={code:`code`,li:`li`,p:`p`,tbody:`tbody`,td:`td`,th:`th`,thead:`thead`,tr:`tr`,ul:`ul`,..._provideComponents(),...props.components},{Heading,Table,Warning}=_components;if(!Heading)_missingMdxReference(`Heading`,true);if(!Table)_missingMdxReference(`Table`,true);if(!Warning)_missingMdxReference(`Warning`,true);return _jsxs(_Fragment,{children:[_jsxs(_components.p,{children:[`Certiva validates all environment variables at startup using a Zod schema. A missing or invalid value causes an immediate hard failure with a descriptive error. Several rules are only enforced when `,_jsx(_components.code,{children:`APP_ENV=staging`}),` or `,_jsx(_components.code,{children:`APP_ENV=production`}),`.`]}),`\n`,_jsx(Heading,{level:`2`,id:`root-level-variables`,children:`Root-level variables`}),`\n`,_jsxs(_components.p,{children:[`Used by Docker Compose and Turborepo. Set in the root `,_jsx(_components.code,{children:`.env`}),`.`]}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`POSTGRES_USER`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`PostgreSQL username`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`POSTGRES_PASSWORD`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`PostgreSQL password`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`POSTGRES_DB`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`PostgreSQL database name`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`NODE_ENV`})}),_jsx(_components.td,{children:`Yes`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`development`}),` / `,_jsx(_components.code,{children:`production`}),` / `,_jsx(_components.code,{children:`test`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`APP_ENV`})}),_jsx(_components.td,{children:`Yes`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`development`}),` / `,_jsx(_components.code,{children:`staging`}),` / `,_jsx(_components.code,{children:`production`}),` — controls validation strictness`]})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`api-variables`,children:`API variables`}),`\n`,_jsxs(_components.p,{children:[`Set in `,_jsx(_components.code,{children:`apps/api/.env`}),`.`]}),`\n`,_jsx(Heading,{level:`3`,id:`database-and-cache`,children:`Database and cache`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Example`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`DATABASE_URL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:_jsx(_components.code,{children:`postgresql://user:pass@localhost:5432/certiva`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`REDIS_URL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:_jsx(_components.code,{children:`redis://localhost:6379`})})]})]})]}),`\n`,_jsx(Heading,{level:`3`,id:`auth-and-server`,children:`Auth and server`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Default`}),_jsx(_components.th,{children:`Notes`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`JWT_SECRET`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`—`}),_jsx(_components.td,{children:`Minimum 64 characters. Placeholder values rejected in staging/prod.`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`JWT_EXPIRES_IN`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`12h`})}),_jsx(_components.td,{children:`Token lifetime`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`PORT`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`4000`})}),_jsx(_components.td,{children:`API listening port`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`CORS_ORIGINS`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`—`}),_jsxs(_components.td,{children:[`Comma-separated allowlist. Wildcard (`,_jsx(_components.code,{children:`*`}),`) rejected in staging/prod.`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`COOKIE_SECURE`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{children:_jsx(_components.code,{children:`false`})}),_jsxs(_components.td,{children:[`Set `,_jsx(_components.code,{children:`true`}),` when behind HTTPS`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`TRUST_PROXY`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{children:_jsx(_components.code,{children:`false`})}),_jsxs(_components.td,{children:[`Set `,_jsx(_components.code,{children:`true`}),` when behind a reverse proxy or Cloudflare`]})]})]})]}),`\n`,_jsx(Heading,{level:`3`,id:`public-urls`,children:`Public URLs`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`API_PUBLIC_BASE_URL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`Used when generating QR codes and verification links`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`WEB_PUBLIC_BASE_URL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`Used in credential metadata URIs`})]})]})]}),`\n`,_jsx(Heading,{level:`3`,id:`storage`,children:`Storage`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Options`}),_jsx(_components.th,{children:`Notes`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`STORAGE_DRIVER`})}),_jsx(_components.td,{children:`Yes`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`local`}),` / `,_jsx(_components.code,{children:`r2`})]}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`r2`}),` is enforced in staging/prod`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`ASSET_STORAGE_ROOT`})}),_jsxs(_components.td,{children:[`If `,_jsx(_components.code,{children:`local`})]}),_jsx(_components.td,{children:`—`}),_jsx(_components.td,{children:`Filesystem root path for local driver`})]})]})]}),`\n`,_jsx(Heading,{level:`3`,id:`cloudflare-r2`,children:`Cloudflare R2`}),`\n`,_jsxs(_components.p,{children:[`Required when `,_jsx(_components.code,{children:`STORAGE_DRIVER=r2`}),`.`]}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`R2_ACCOUNT_ID`})}),_jsx(_components.td,{children:`Cloudflare account ID`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`R2_BUCKET`})}),_jsx(_components.td,{children:`Bucket name`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`R2_ACCESS_KEY_ID`})}),_jsx(_components.td,{children:`R2 access key`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`R2_SECRET_ACCESS_KEY`})}),_jsx(_components.td,{children:`R2 secret key`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`R2_ENDPOINT`})}),_jsx(_components.td,{children:`S3-compatible endpoint URL`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`R2_PUBLIC_BASE_URL`})}),_jsx(_components.td,{children:`Public CDN base URL for served assets`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`R2_FORCE_PATH_STYLE`})}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`true`}),` / `,_jsx(_components.code,{children:`false`})]})]})]})]}),`\n`,_jsx(Heading,{level:`3`,id:`blockchain`,children:`Blockchain`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`BLOCKCHAIN_ENABLED`})}),_jsx(_components.td,{children:`No`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`true`}),` to enable anchoring. Requires all variables below.`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`POLYGON_AMOY_RPC_URL`})}),_jsx(_components.td,{children:`If enabled`}),_jsx(_components.td,{children:`RPC endpoint for Polygon Amoy testnet`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`PRIVATE_KEY`})}),_jsx(_components.td,{children:`If enabled`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`0x`}),`-prefixed 64-char hex key. Known dev keys rejected in staging/prod.`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`CONTRACT_ADDRESS`})}),_jsx(_components.td,{children:`If enabled`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`0x`}),`-prefixed 40-char deployed `,_jsx(_components.code,{children:`CredentialRegistry`}),` address`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`ISSUER_WALLET`})}),_jsx(_components.td,{children:`If enabled`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`0x`}),`-prefixed 40-char issuer wallet address`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`BLOCKCHAIN_RPC_TIMEOUT_MS`})}),_jsx(_components.td,{children:`No`}),_jsxs(_components.td,{children:[`RPC timeout in ms (default: `,_jsx(_components.code,{children:`12000`}),`)`]})]})]})]}),`\n`,_jsx(Heading,{level:`3`,id:`rate-limiting`,children:`Rate limiting`}),`\n`,_jsx(_components.p,{children:`Redis-backed rate limiting is strongly recommended in staging and production.`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Default`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_STORE`})}),_jsx(_components.td,{children:_jsx(_components.code,{children:`memory`})}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`redis`}),` or `,_jsx(_components.code,{children:`memory`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_REDIS_PREFIX`})}),_jsx(_components.td,{children:`—`}),_jsx(_components.td,{children:`Redis key namespace`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_AUTH_LOGIN_MAX`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`5`})}),_jsx(_components.td,{children:`Login attempts per window`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_AUTH_LOGIN_WINDOW_SECONDS`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`60`})}),_jsx(_components.td,{children:`Login window`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_VERIFY_MAX`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`30`})}),_jsx(_components.td,{children:`Verification requests per window`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_VERIFY_WINDOW_SECONDS`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`60`})}),_jsx(_components.td,{children:`Verification window`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_VERIFY_UPLOAD_MAX`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`10`})}),_jsx(_components.td,{children:`Upload verification requests per window`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_VERIFY_UPLOAD_WINDOW_SECONDS`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`60`})}),_jsx(_components.td,{children:`Upload window`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_ADMIN_MAX`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`100`})}),_jsx(_components.td,{children:`Admin route requests per window`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`RATE_LIMIT_ADMIN_WINDOW_SECONDS`})}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`60`})}),_jsx(_components.td,{children:`Admin window`})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`web-variables`,children:`Web variables`}),`\n`,_jsxs(_components.p,{children:[`Set in `,_jsx(_components.code,{children:`apps/web/.env`}),`.`]}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Exposed to browser`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`NODE_ENV`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{children:`Build mode`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`APP_ENV`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{children:`Deployment context`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`INTERNAL_API_URL`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{children:`Server-side URL used by Next.js BFF routes to call the API`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`COOKIE_SECURE`})}),_jsx(_components.td,{children:`No`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`true`}),` for HTTPS`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`NEXT_PUBLIC_SITE_URL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`Public-facing site URL shown in the UI`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`NEXT_PUBLIC_SUPPORT_EMAIL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`Support contact email shown in the UI`})]})]})]}),`\n`,_jsx(Warning,{children:_jsxs(_components.p,{children:[_jsx(_components.code,{children:`NEXT_PUBLIC_`}),` variables are embedded into the browser bundle at build time. Never put secrets, internal URLs, or API keys in them.`]})}),`\n`,_jsx(Heading,{level:`2`,id:`worker-variables`,children:`Worker variables`}),`\n`,_jsxs(_components.p,{children:[`Set in `,_jsx(_components.code,{children:`apps/worker/.env`}),`.`]}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Variable`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`DATABASE_URL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`PostgreSQL connection string`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`REDIS_URL`})}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`Redis connection string`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`BLOCKCHAIN_ENABLED`})}),_jsx(_components.td,{children:`No`}),_jsxs(_components.td,{children:[_jsx(_components.code,{children:`true`}),` to process blockchain anchoring jobs`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`POLYGON_AMOY_RPC_URL`})}),_jsx(_components.td,{children:`If enabled`}),_jsx(_components.td,{children:`RPC endpoint`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`PRIVATE_KEY`})}),_jsx(_components.td,{children:`If enabled`}),_jsx(_components.td,{children:`Signing key`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`CONTRACT_ADDRESS`})}),_jsx(_components.td,{children:`If enabled`}),_jsx(_components.td,{children:`Contract address`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`ISSUER_WALLET`})}),_jsx(_components.td,{children:`If enabled`}),_jsx(_components.td,{children:`Issuer wallet address`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`BLOCKCHAIN_RPC_TIMEOUT_MS`})}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{children:`RPC timeout in ms`})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`startup-validation-rules`,children:`Startup validation rules`}),`\n`,_jsxs(_components.p,{children:[`These rules are enforced in `,_jsx(_components.code,{children:`apps/api/src/config/env.schema.ts`}),` at startup:`]}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`JWT_SECRET`}),` must be at least 64 characters and must not be a known placeholder value in staging/prod.`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`CORS_ORIGINS`}),` must not be empty or contain `,_jsx(_components.code,{children:`*`}),` in staging/prod.`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`STORAGE_DRIVER`}),` must be `,_jsx(_components.code,{children:`r2`}),` in staging/prod — `,_jsx(_components.code,{children:`local`}),` is rejected.`]}),`\n`,_jsxs(_components.li,{children:[`When `,_jsx(_components.code,{children:`BLOCKCHAIN_ENABLED=true`}),`: `,_jsx(_components.code,{children:`POLYGON_AMOY_RPC_URL`}),`, `,_jsx(_components.code,{children:`PRIVATE_KEY`}),`, and `,_jsx(_components.code,{children:`CONTRACT_ADDRESS`}),` are all required.`]}),`\n`,_jsxs(_components.li,{children:[`When `,_jsx(_components.code,{children:`STORAGE_DRIVER=r2`}),`: all `,_jsx(_components.code,{children:`R2_*`}),` variables are required.`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`PRIVATE_KEY`}),` must not match known development test keys in staging/prod.`]}),`\n`]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Configuration","description":"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.","icon":"sliders","href":"/certiva/configuration"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Root-level variables","slug":"root-level-variables","depth":2,"children":[]},{"title":"API variables","slug":"api-variables","depth":2,"children":[{"title":"Database and cache","slug":"database-and-cache","depth":3,"children":[]},{"title":"Auth and server","slug":"auth-and-server","depth":3,"children":[]},{"title":"Public URLs","slug":"public-urls","depth":3,"children":[]},{"title":"Storage","slug":"storage","depth":3,"children":[]},{"title":"Cloudflare R2","slug":"cloudflare-r2","depth":3,"children":[]},{"title":"Blockchain","slug":"blockchain","depth":3,"children":[]},{"title":"Rate limiting","slug":"rate-limiting","depth":3,"children":[]}]},{"title":"Web variables","slug":"web-variables","depth":2,"children":[]},{"title":"Worker variables","slug":"worker-variables","depth":2,"children":[]},{"title":"Startup validation rules","slug":"startup-validation-rules","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":[],"subdomain":"archivecircle","siteName":"Archive Circle","title":"Configuration - Archive Circle","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-05-30T07:28:03.715Z","originalFileLocation":"certiva/configuration.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Archive Circle\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Configuration - Archive Circle\">\u003cmeta data-mint-head property=\"og:description\" content=\"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Archive Circle\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.archivecircle.xyz/certiva/configuration\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://archivecircle.mintlify.site/_mintlify/api/og/v2?division=Product+guide\u0026amp;title=Configuration\u0026amp;description=Every+environment+variable+for+the+Certiva+API%2C+web+dashboard%2C+and+background+worker+%E2%80%94+with+validation+rules+and+production+requirements.\u0026amp;theme=ba915dc549f64248150ee650\u0026amp;signature=44f85f318a06c673e655603ff2863e44ea4276ad81e43c2d4cd4ae0f3de12e52\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Configuration - Archive Circle\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://archivecircle.mintlify.site/_mintlify/api/og/v2?division=Product+guide\u0026amp;title=Configuration\u0026amp;description=Every+environment+variable+for+the+Certiva+API%2C+web+dashboard%2C+and+background+worker+%E2%80%94+with+validation+rules+and+production+requirements.\u0026amp;theme=ba915dc549f64248150ee650\u0026amp;signature=44f85f318a06c673e655603ff2863e44ea4276ad81e43c2d4cd4ae0f3de12e52\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/archivecircle/2C-A2_FwsLInr9Bg/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Archive Circle\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#E07AAE\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.archivecircle.xyz/certiva/configuration\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/certiva/configuration.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.archivecircle.xyz/#organization\",\"name\":\"Archive Circle\",\"url\":\"https://docs.archivecircle.xyz\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/archivecircle/FjLY4c9CRnMT_uZN/logo/light.svg?fit=max\u0026auto=format\u0026n=FjLY4c9CRnMT_uZN\u0026q=85\u0026s=ccb1134687234eb93997c52eafeeb7ad\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.archivecircle.xyz#website\",\"name\":\"Archive Circle\",\"url\":\"https://docs.archivecircle.xyz\",\"publisher\":{\"@id\":\"https://docs.archivecircle.xyz/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.archivecircle.xyz/certiva/configuration#webpage\",\"url\":\"https://docs.archivecircle.xyz/certiva/configuration\",\"name\":\"Configuration\",\"description\":\"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.\",\"dateModified\":\"2026-05-30T07:28:03.715Z\",\"isPartOf\":{\"@id\":\"https://docs.archivecircle.xyz#website\"},\"breadcrumb\":{\"@id\":\"https://docs.archivecircle.xyz/certiva/configuration#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.archivecircle.xyz/certiva/configuration#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Product guide\",\"item\":\"https://docs.archivecircle.xyz/certiva/concepts\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Configuration\",\"item\":\"https://docs.archivecircle.xyz/certiva/configuration\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://docs.archivecircle.xyz/certiva/configuration#article\",\"headline\":\"Configuration\",\"name\":\"Configuration\",\"description\":\"Every environment variable for the Certiva API, web dashboard, and background worker — with validation rules and production requirements.\",\"url\":\"https://docs.archivecircle.xyz/certiva/configuration\",\"mainEntityOfPage\":{\"@id\":\"https://docs.archivecircle.xyz/certiva/configuration#webpage\"},\"dateModified\":\"2026-05-30T07:28:03.715Z\",\"publisher\":{\"@id\":\"https://docs.archivecircle.xyz/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.archivecircle.xyz#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Archive Circle\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"Archive Circle\"},\"provider\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","agentPointerHref":"/certiva/configuration.md","siteName":"Archive Circle","nav":{"global":{"anchors":[{"anchor":"Archive Circle GitHub","icon":"github","href":"https://github.com/Archive-Circle"}]},"tabs":[{"tab":"Eternum","pages":[{"title":"Eternum","href":"/eternum"}]},{"tab":"ChainLens","pages":[{"title":"ChainLens","href":"/chainlens/overview"}]},{"tab":"SplitBot","pages":[{"title":"SplitBot","href":"/splitbot/overview"}]},{"tab":"Certiva","groups":[{"group":"Start here","pages":[{"title":"Overview","icon":"certificate","href":"/certiva/overview"},{"title":"Quickstart","icon":"rocket","href":"/certiva/quickstart"}]},{"group":"Product guide","pages":[{"title":"Concepts","description":"Credential lifecycle, verification modes, blockchain anchoring, document proofs, admin roles, and the audit trail.","icon":"book-open","href":"/certiva/concepts"},{"title":"Configuration","icon":"sliders","href":"/certiva/configuration"},{"title":"Workflows","description":"Step-by-step instructions for the most common Certiva operator tasks.","icon":"arrow-progress","href":"/certiva/workflows"}]},{"group":"API reference","pages":[{"title":"API Reference","icon":"code","href":"/certiva/api-reference"}]}]}]},"basePath":"","title":"Configuration - Archive Circle","buildId":"dpl_41S5Z2jG9QnfDRwN1KZrLdBwj7DM","deploymentId":"dpl_41S5Z2jG9QnfDRwN1KZrLdBwj7DM","dynamics":[],"chunks":[]}
