Home → Configuration
Platform · pydantic-settings
Source .env.example Prod .env.production.example

Environment
configuration reference

Every setting loaded at startup from environment variables. Production guards reject unsafe combinations (SQLite, AI mock, missing Stripe when payments enabled).

Core application

APP_NAME

Display name. Default: DocQStack

APP_ENV

development or production. Production enables strict validation.

DEBUG

Debug mode. Must be false in production.

SECRET_KEY

Session signing key. Min 16 chars; no placeholders in production.

ALLOWED_ORIGINS

CORS origins (comma-separated). Default includes localhost:3000.

FRONTEND_URL

Public site URL for email links and Stripe return URLs.

BACKEND_URL

API base for OAuth callbacks and webhook registration.

API_PREFIX

FastAPI mount prefix. Default: /api/v1

Database (MySQL)

MYSQL_*

MySQL connection: HOST, PORT, USER, PASSWORD, DATABASE. Charset utf8mb4.

DATABASE_URL_OVERRIDE

Full SQLAlchemy URL. SQLite only for tests/dev smoke. Rejected when APP_ENV=production.

Redis

REDIS_URL

Redis connection for Arq worker queue and /ready health check.

Sessions & cookies

SESSION_COOKIE_NAME

HttpOnly session cookie name. Default: docqstack_session

SESSION_MAX_AGE_SECONDS

Session lifetime. Default 14 days.

COOKIE_SECURE

Secure cookie flag. Must be true in production.

COOKIE_SAMESITE

SameSite policy. Default: lax

OAuth

GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET

Google OAuth credentials. Redirect URI must match provider console.

LINKEDIN_CLIENT_ID / LINKEDIN_CLIENT_SECRET

LinkedIn OIDC credentials.

AI

AI_ENABLED

Master AI switch. Default false — app runs without AI.

OPENAI_API_KEY

Required for OpenAI provider. Never exposed to browser.

AI_MOCK_MODE

Mock provider for dev. Forbidden when APP_ENV=production.

AI_SYNC_JOBS

Run AI jobs inline when Redis unavailable (dev only).

AI_MAX_TOKENS_PER_JOB / AI_DAILY_SPEND_CAP_USD

Token limit per job and daily spend cap (0 = no cap).

Monetization (Stripe)

PAYMENTS_ENABLED

Payments feature gate (also needs DB monetization flag).

STRIPE_*

Stripe secret, publishable key, webhook secret. Required in prod when payments enabled.

Email

SMTP_URL

SMTP relay URL, e.g. Postmark: smtp://TOKEN:TOKEN@smtp.postmarkapp.com:587

EMAIL_FROM

From address for outbound mail.

NEWSLETTER_DOUBLE_OPT_IN

Confirmation email before subscribe. Requires SMTP_URL in production when enabled.

Security & observability

CSRF_ENABLED

CSRF protection on mutating API requests.

RATE_LIMIT_*

API rate limiting toggle and requests per minute.

ADMIN_EMERGENCY_LOCKDOWN

Emergency admin lockdown mode.

LOG_LEVEL, LOG_JSON, REQUEST_LOG_ENABLED

Logging configuration for API and request tracing.

SOFT_LOGIN_*

Soft login prompt thresholds for anonymous readers.

BACKUP_DIR

Directory for MySQL backup scripts output.