Validated at runtime by lib/env.ts (Zod). All optional with safe defaults so a
fresh clone builds. Copy .env.example → .env.local for development.
| Variable | Scope | Default | Purpose |
|---|---|---|---|
NEXT_PUBLIC_APP_URL |
public | http://localhost:3000 |
Canonical URL for metadata, sitemap, robots |
NEXT_PUBLIC_APP_NAME |
public | BENZUKO |
Display name |
API_BASE_URL |
server | http://localhost:3000/api |
Server-side API base |
NODE_ENV |
server | development |
Runtime mode |
AUTH_SECRET |
server | — | Signing secret for auth (set in production) |
JWT_ISSUER |
server | benzuko |
JWT issuer claim |
RATE_LIMIT_WINDOW_MS |
server | 60000 |
Rate-limit window (ms) |
RATE_LIMIT_MAX |
server | 60 |
Max requests per window |
NEXT_PUBLIC_* vars reach the browser. Never prefix secrets with it..env*.