Environment Variables — Deployment Guide

Where Variables Live

Type	Local	Production
Server secrets	`.dev.vars`	`pnpm wrangler secret put NAME`
Public / build vars	`.dev.vars` or shell	`wrangler.jsonc` → `vars`
Cloudflare bindings	Local mock	`wrangler.jsonc` bindings

Important

VITE_* vars are injected at vite build into the client bundle. After changing them, run pnpm run deploy again — updating secrets alone won't refresh analytics scripts.

Core Variables

Variable	Secret	Required	Local	Production	Notes
`BETTER_AUTH_SECRET`	✓	✓	`.dev.vars`	secret	JWT signing, `openssl rand -base64 32`
`BETTER_AUTH_URL`		✓	`.dev.vars`	secret	Site root URL, OAuth callbacks
`SERVER_URL`		✓	`.dev.vars`	secret	Absolute server links
`VITE_SITE_URL`		✓	`.dev.vars`	vars	SEO, canonical URLs

Authentication

Variable	Secret	Required	Notes
`GOOGLE_CLIENT_ID`		✓	Google OAuth Web client ID
`GOOGLE_CLIENT_SECRET`	✓	✓	OAuth client secret
`GOOGLE_REDIRECT_URI`		✓	Must match Google Console exactly

Redirect URI examples:

Local: http://localhost:3000/api/auth/callback/google
Production: https://your-domain.com/api/auth/callback/google

Email (Resend)

Variable	Secret	Required	Notes
`RESEND_API_KEY`	✓	✓*	`re_...`, see Resend integration
`EMAIL_FROM`		✓*	Verified sender address

* Required when magic links or email marketing is enabled.

Payments (Stripe)

Variable	Secret	Required	Notes
`STRIPE_SECRET_KEY`	✓	✓*	`sk_test_...` / `sk_live_...`
`STRIPE_WEBHOOK_SECRET`	✓	✓*	Webhook `whsec_...`

Webhook URL: https://your-domain.com/api/stripe/webhook

Storage (R2)

Variable	Secret	Required	Notes
`R2_ACCOUNT_ID`		✓	Cloudflare account ID
`R2_ACCESS_KEY_ID`	✓	✓	R2 API token
`R2_SECRET_ACCESS_KEY`	✓	✓	R2 API token
`R2_BUCKET_NAME`		✓	Bucket name
`R2_PUBLIC_URL`		✓	Public access domain

Analytics (Optional)

Variable	Purpose
`VITE_POSTHOG_TOKEN`	Client ingest `phc_...`
`POSTHOG_PERSONAL_API_KEY`	Admin queries `phx_...`
`POSTHOG_PROJECT_ID`	Project ID
`VITE_GA_MEASUREMENT_ID`	GA4 measurement ID `G-...`
`GA4_SERVICE_ACCOUNT_*`	GA4 Data API, see `docs/ga4-admin-spec.md`
`VITE_CLARITY_PROJECT_ID`	Microsoft Clarity
`SENTRY_DSN`	Error monitoring

List Configured Secrets

bash

pnpm wrangler secret list

Full template: .env.example at repo root.