.env.example

# =============================================================================
# ROOT SUPERSET ENV — production / deployed template
# Fill every value for a deployed environment.
#
# For LOCAL development you do NOT need any of these: run
# `./.paradev/setup.local.sh` (or `cp .env.local.example .env`), which uses
# fake-but-valid placeholders + a local Postgres container. See .env.local.example.
# =============================================================================

# -----------------------------------------------------------------------------
# Neon Organization Credentials (DB branch tooling)
# -----------------------------------------------------------------------------
NEON_ORG_ID=
NEON_PROJECT_ID=
NEON_API_KEY=

# -----------------------------------------------------------------------------
# Database (Neon Postgres connection strings)
# -----------------------------------------------------------------------------
DATABASE_URL=
DATABASE_URL_UNPOOLED=

# -----------------------------------------------------------------------------
# Cross-App URLs
# -----------------------------------------------------------------------------
NEXT_PUBLIC_API_URL=
NEXT_PUBLIC_WEB_URL=
NEXT_PUBLIC_ADMIN_URL=
NEXT_PUBLIC_MARKETING_URL=
NEXT_PUBLIC_DOCS_URL=
NEXT_PUBLIC_ROOT_DOMAIN=
# Desktop name in menus, the Dock and dialogs; productName stays "Superset".
DESKTOP_DISPLAY_NAME=

# -----------------------------------------------------------------------------
# Mobile (Expo) — read at Metro bundle time; EAS builds get these from eas.json
# -----------------------------------------------------------------------------
EXPO_PUBLIC_API_URL=
EXPO_PUBLIC_ROOT_DOMAIN=
EXPO_PUBLIC_POSTHOG_KEY=
EXPO_PUBLIC_SENTRY_DSN_MOBILE=
EXPO_PUBLIC_SENTRY_ENVIRONMENT=
# App Review demo account, read by apps/mobile/store.config.js for `eas metadata:push`
APP_REVIEW_EMAIL=
APP_REVIEW_PASSWORD=

# -----------------------------------------------------------------------------
# Better Auth
# -----------------------------------------------------------------------------
BETTER_AUTH_SECRET=
NEXT_PUBLIC_COOKIE_DOMAIN=

APPLE_CLIENT_ID=
APPLE_CLIENT_SECRET=
APPLE_APP_BUNDLE_IDENTIFIER=

# AES-256-GCM key for encrypting stored project secrets: base64 of exactly 32 bytes.
# Generate with: openssl rand -base64 32
SECRETS_ENCRYPTION_KEY=

# -----------------------------------------------------------------------------
# OAuth Credentials (GitHub / Google sign-in)
# -----------------------------------------------------------------------------
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# The separate Google OAuth client the google connector (Gmail plugin) runs on.
GOOGLE_CONNECTIONS_CLIENT_ID=
GOOGLE_CONNECTIONS_CLIENT_SECRET=
GOOGLE_PUBSUB_TOPIC=
GOOGLE_PUBSUB_PUSH_TOKEN=
GH_CLIENT_ID=
GH_CLIENT_SECRET=

# -----------------------------------------------------------------------------
# GitHub App Credentials (PR integration)
# -----------------------------------------------------------------------------
GH_APP_ID=
GH_APP_PRIVATE_KEY=
GH_WEBHOOK_SECRET=
# The same App's OAuth client, for a person's own GitHub connection (Settings → Connections).
# Its callback URL is <API>/api/github/user/callback. Unset: nobody can connect.
GH_APP_CLIENT_ID=
GH_APP_CLIENT_SECRET=

# -----------------------------------------------------------------------------
# Linear Integration
# -----------------------------------------------------------------------------
LINEAR_CLIENT_ID=
LINEAR_CLIENT_SECRET=
LINEAR_WEBHOOK_SECRET=

# -----------------------------------------------------------------------------
# Notion Integration (public integration; webhook subscription in its settings)
# -----------------------------------------------------------------------------
NOTION_CLIENT_ID=
NOTION_CLIENT_SECRET=
NOTION_WEBHOOK_VERIFICATION_TOKEN=

# -----------------------------------------------------------------------------
# Slack Integration
# -----------------------------------------------------------------------------
SLACK_CLIENT_ID=
SLACK_CLIENT_SECRET=
SLACK_SIGNING_SECRET=
SLACK_BILLING_WEBHOOK_URL=

# -----------------------------------------------------------------------------
# Microsoft Teams Integration (optional; Entra app registration with
# application permissions ChannelMessage.Read.All, Channel.ReadBasic.All,
# Team.ReadBasic.All, User.ReadBasic.All)
# -----------------------------------------------------------------------------
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=

# -----------------------------------------------------------------------------
# Anthropic (server-side AI features)
# -----------------------------------------------------------------------------
SERVER_ANTHROPIC_API_KEY=

# OpenAI (mobile voice mode). Optional: voice reports "not configured" without it.
SERVER_OPENAI_API_KEY=

# -----------------------------------------------------------------------------
# Blob Storage
# -----------------------------------------------------------------------------

# -----------------------------------------------------------------------------
# Cloudflare storage + user content origin (pages, thumbnails, chat attachments)
# -----------------------------------------------------------------------------
CLOUDFLARE_ACCOUNT_ID=
R2_ACCESS_KEY_ID=
R2_SECRET_ACCESS_KEY=
# Pages and files; read through the usercontent Worker (apps/usercontent) with a ticket.
R2_PRIVATE_BUCKET=
R2_PUBLIC_BUCKET=
R2_ENDPOINT=
# Where pages are served from, one subdomain per page under it (apps/usercontent):
# https://frame.supersetusercontent.com
USERCONTENT_URL=
# App-referenced files with tickets (apps/usercontent, same Worker); must match
# the Worker's own MEDIA_URL: https://media.supersetusercontent.com
MEDIA_URL=
# Public-bucket images (avatars, logos), served straight from the bucket's domain.
STATIC_URL=
# Shared with the usercontent Worker (wrangler secret); 32+ characters.
USERCONTENT_TOKEN_SECRET=
# Agent runs: the worker trades AGENT_WORKER_SECRET for a turn token signed with AGENT_TURN_SIGNING_SECRET (API only).
AGENT_WORKER_SECRET=
AGENT_TURN_SIGNING_SECRET=
# Signs agent session log tickets; the API and realtime share it.
AGENT_SESSION_SECRET=
# Temporal Cloud, for agent sessions (API and agent worker). Unset: the API reports agents unavailable.
TEMPORAL_ADDRESS=
TEMPORAL_NAMESPACE=
TEMPORAL_API_KEY=
# Optional: page thumbnails are skipped while unset.
# Local only: the channel router's Jev key. On Vercel it uses the deployment's OIDC token.
VERCEL_AI_GATEWAY_KEY=
CLOUDFLARE_BROWSER_RENDERING_TOKEN=

# -----------------------------------------------------------------------------
# PostHog Analytics
# -----------------------------------------------------------------------------
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_HOST=
POSTHOG_API_KEY=
POSTHOG_PROJECT_ID=
POSTHOG_PROJECT_SECRET_KEY=

# -----------------------------------------------------------------------------
# Plugin OAuth (optional — falls back to NEXT_PUBLIC_API_URL)
# Origin an authorization server fetches a plugin's client id metadata document
# from. Setting this alone does not make local dev work: redirect_uris in that
# document come from NEXT_PUBLIC_API_URL, and the document declares
# application_type "web", so a loopback redirect is rejected. To connect a
# dynamic-client plugin locally, point one public https tunnel at the API and
# set NEXT_PUBLIC_API_URL to it; this variable is for the case where the two
# origins genuinely differ.
# -----------------------------------------------------------------------------
PLUGIN_CLIENT_METADATA_BASE_URL=

# -----------------------------------------------------------------------------
# Sentry Error Tracking
# -----------------------------------------------------------------------------
SENTRY_AUTH_TOKEN=
NEXT_PUBLIC_SENTRY_ENVIRONMENT=
NEXT_PUBLIC_SENTRY_DSN_WEB=
NEXT_PUBLIC_SENTRY_DSN_MARKETING=
NEXT_PUBLIC_SENTRY_DSN_DOCS=
NEXT_PUBLIC_SENTRY_DSN_API=
SENTRY_DSN_DESKTOP=
# Compiled into the desktop bundle and handed to the host service the desktop
# spawns. Sandboxes cannot use this one — see SENTRY_DSN_SANDBOX below.
SENTRY_DSN_HOST_SERVICE=

# Sentry public integration — powers Sentry automation triggers (issue created,
# resolved, assigned, ...). Optional: leave blank and the Sentry trigger simply
# reports "Requires connection" in the editor; nothing else breaks.
#
# These come from a Sentry *public integration* (Settings -> Developer Settings
# -> Public Integration), not from the DSN/auth-token above, which are for error
# reporting. A Sentry app allows exactly one Redirect URL, so a local checkout
# needs its own app rather than sharing the deployed one:
#   Redirect URL: http://localhost:<API_PORT>/api/integrations/sentry/callback
#   Webhook URL:  http://localhost:<API_PORT>/api/integrations/sentry/webhook
# Permissions: Project, Issue & Event, Organization, Member = Read.
# The client secret is shown once, at creation — save it then.
# Sentry cannot reach localhost, so webhooks (and therefore live triggers) need
# a tunnel; the install flow and the project picker work without one.
SENTRY_APP_SLUG=
SENTRY_CLIENT_ID=
SENTRY_CLIENT_SECRET=

# -----------------------------------------------------------------------------
# Resend (Email)
# -----------------------------------------------------------------------------
RESEND_API_KEY=
EMAIL_SENDING_DOMAIN=

# -----------------------------------------------------------------------------
# Stripe Billing
# -----------------------------------------------------------------------------
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_PRO_MONTHLY_PRICE_ID=
STRIPE_PRO_YEARLY_PRICE_ID=
STRIPE_ENTERPRISE_YEARLY_PRICE_ID=

# -----------------------------------------------------------------------------
# Upstash Redis & QStash
# -----------------------------------------------------------------------------
KV_REST_API_URL=
KV_REST_API_TOKEN=
KV_URL=

# Shared by the API and marketing: marketing's server-side leaderboard reads
# present it to skip the per-IP anonymous limiter. One value, both apps.
LEADERBOARD_INTERNAL_TOKEN=
QSTASH_TOKEN=
QSTASH_URL=
QSTASH_CURRENT_SIGNING_KEY=
QSTASH_NEXT_SIGNING_KEY=

# MCP API Key for Claude Code
SUPERSET_MCP_API_KEY=

# -----------------------------------------------------------------------------
# GitHub (marketing /starchart page and the admin dashboard's star tile)
#
# Read-only PAT, no scopes required — GitHub's stargazers endpoint requires an
# authenticated request even for public repos. Without it /starchart still
# renders with the live total star count but no historical chart, and the admin
# star tile reports it as unavailable. Both apps read the same variable, so it
# belongs on the marketing project and the API project alike.
# -----------------------------------------------------------------------------
GITHUB_TOKEN=

# Relay service URL (v2 tunnel proxy forwarding cloud API calls to host-service
# instances on user devices).
RELAY_URL=
RELAY_BACKUP_URL=
NEXT_PUBLIC_RELAY_URL=
NEXT_PUBLIC_REALTIME_URL=
EXPO_PUBLIC_RELAY_URL=
EXPO_PUBLIC_REALTIME_URL=

# Realtime channel (apps/realtime): the API nudges subscribed windows to refetch
# after it writes hosts, pull requests or cloud workspaces.
REALTIME_URL=
# Shared with the Worker (`wrangler secret put NUDGE_SECRET` in apps/realtime).
REALTIME_NUDGE_SECRET=

# Cloud workspaces (Vercel sandboxes). A token for the team's `sandboxes`
# project — not the deploy token — and the Ed25519 key that signs sandbox
# access tokens (`bun run scripts/sandbox/generate-access-key.ts`).
VERCEL_SANDBOX_TOKEN=
VERCEL_SANDBOX_TEAM_ID=
VERCEL_SANDBOX_PROJECT_ID=
AUTUMN_SECRET_KEY=
AUTUMN_WEBHOOK_SECRET=
BILLING_PROVIDER=
# Shared with the gate Worker (apps/gate): signs the tickets
# clients present there and derives each sandbox's host-service secret.
SANDBOX_GATE_SECRET=
# The gate with `*` where a workspace's `<id>-<port>` label goes.
SANDBOX_GATE_ORIGIN=https://*.sandbox.supersetusercontent.com
# Sandboxes get their own Sentry project, separate from the host-service one
# (which means the host service on people's desktops). Set here rather than in
# the desktop build because a sandbox is started by the API and never sees a
# desktop bundle. Unset means sandbox crashes go unreported.
SENTRY_DSN_SANDBOX=
# The GitHub App this deployment mints installation tokens for. Must match
# GH_APP_ID — a mismatch surfaces much later as a 404 on token creation.
GH_APP_SLUG=superset-app

# Read-only support account lookup (apps/api /api/support/lookup); unset = endpoint off
SUPPORT_LOOKUP_TOKEN=