publicStripeKey: "" crash in env.js for self-hosted instances.

[raynellbell82]

Self-hosted dashboard blank screen — Stripe.js crashes on empty publicStripeKey

Description

The Nango dashboard renders a completely blank/black screen on self-hosted instances. The root cause is stripe.js attempting to initialize with an empty string, which throws an unhandled error that kills the entire React app.

Console Error

Uncaught (in promise) IntegrationError: Please call Stripe() with your publishable key. You used an empty string.
    at stripe.js:1

Additionally:

The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
    at stripe.js:1

Root Cause

The /env.js endpoint returns "publicStripeKey": "" for self-hosted instances (expected, since self-hosted doesn't use Stripe billing). However, the dashboard frontend code calls Stripe("") unconditionally without checking whether the key is a non-empty string first.

/env.js output:

window._env = {
  "apiUrl": "https://nango.example.com",
  "publicStripeKey": "",
  "isCloud": false,
  "isHosted": true,
  "isEnterprise": false,
  "features": {
    "plan": false
  }
}

Despite isCloud: false and features.plan: false, the Stripe initialization still runs and crashes.

Environment

• Image: nangohq/nango-server:hosted (also reproduced on hosted-0.69.30)
• Version: 0.69.40+ (git hash 5fc90c54d6b4efc23bddd6652fbbc087621ebd8d)
• Deployment: Docker Compose via Coolify on Ubuntu 24
• Self-hosted: Yes, free tier

Steps to Reproduce

1. Deploy nangohq/nango-server:hosted with standard self-hosted configuration per [docs](https://nango.dev/docs/guides/platform/free-self-hosting/configuration)
2. Navigate to the dashboard URL in a browser
3. Observe blank/black screen
4. Open browser DevTools → Console → see IntegrationError from stripe.js

Expected Behavior

The dashboard should load normally on self-hosted instances. Stripe initialization should be gated behind a check like:

if (window._env.publicStripeKey && window._env.isCloud) {
  loadStripe(window._env.publicStripeKey);
}

Workaround

The API itself is unaffected — /health returns {"result":"ok"} and all OAuth/proxy/connection endpoints work normally. The issue is isolated to the dashboard UI. Integrations can be managed via the API or @nangohq/node SDK as a workaround.

Impact

This completely blocks dashboard access for all self-hosted users on the current :hosted tag. No configuration changes or documented environment variables resolve the issue.

[linear]

NAN-5022