Environment variables

Every variable is optional. The app starts with an empty environment, and each person configures their own AI services inside it. Each variable below adds a capability or moves a default. One AI service key is the whole minimum for an instance that works on first load.

Precedence

a person's own setting  ->  your environment variable  ->  the built-in default

That order holds at every point where a credential or an address is read. One deliberate inversion: when a Bedrock request falls through to your server credential, the region comes from BEDROCK_REGION. The region the browser sent is ignored.

AI service keys

Set the key and the service appears, already configured, for everyone who opens the instance.

Variable	What it does	Default
ANTHROPIC_API_KEY · ANTHROPIC_API_HOST	Anthropic credential; host override	api.anthropic.com
OPENAI_API_KEY · OPENAI_API_HOST · OPENAI_API_ORG_ID	OpenAI credential; host override; organization id	api.openai.com
GEMINI_API_KEY	Google Gemini credential	-
DEEPSEEK_API_KEY · GROQ_API_KEY · MISTRAL_API_KEY · MOONSHOT_API_KEY · OPENROUTER_API_KEY · PERPLEXITY_API_KEY · TOGETHERAI_API_KEY · XAI_API_KEY	One credential each	-
ALIBABA_API_KEY · ALIBABA_API_HOST	Alibaba credential; host override	https://dashscope-intl.aliyuncs.com/compatible-mode
NVIDIANIM_API_KEY · NVIDIANIM_API_HOST	NVIDIA NIM credential; host override	https://integrate.api.nvidia.com
CEREBRAS_API_KEY	Cerebras credential - reports nothing	-
SAKANA_API_KEY · SAKANA_API_HOST	Sakana credential; host override; reports nothing too	https://api.sakana.ai
OLLAMA_API_HOST	Address of an Ollama server the app's server can reach	http://127.0.0.1:11434
LOCALAI_API_HOST · LOCALAI_API_KEY	Address of a LocalAI server; optional credential	http://127.0.0.1:8080
AZURE_OPENAI_API_ENDPOINT · AZURE_OPENAI_API_KEY	Azure endpoint and credential - both required together	-
AZURE_OPENAI_API_VERSION · AZURE_DEPLOYMENTS_API_VERSION · AZURE_OPENAI_DISABLE_V1	Azure API versions; true turns the v1 API off	2025-04-01-preview · 2023-03-15-preview · unset
BEDROCK_BEARER_TOKEN or BEDROCK_ACCESS_KEY_ID + BEDROCK_SECRET_ACCESS_KEY	AWS Bedrock credential, either form	-
BEDROCK_SESSION_TOKEN · BEDROCK_REGION	Temporary-credential token; region, server-side only	- · us-east-1

Azure's v1 API is the default. It calls /openai/v1/responses with no deployment id; disabling it sends every model back through /openai/deployments/<name>/.

Cohere, LM Studio and Z.ai take no server-side variable: those are added per person in the app.

Services

Variable	What it does	Default
PUPPETEER_WSS_ENDPOINT	Remote browser for page fetching. ws:// or wss:// only	-
GOOGLE_CLOUD_API_KEY · GOOGLE_CSE_ID	Custom Search credentials - both required, or neither works	-
ELEVENLABS_API_KEY · ELEVENLABS_API_HOST · ELEVENLABS_VOICE_ID	ElevenLabs credential, host, voice - unread today	-
POSTGRES_PRISMA_URL · POSTGRES_URL_NON_POOLING	Share-link database - both required	-

Access and behaviour

Variable	What it does	Default
HTTP_BASIC_AUTH_USERNAME · HTTP_BASIC_AUTH_PASSWORD	Credentials for the basic-auth middleware, which also has to be enabled in a build - below	-
AIX_STRICT_PARSING	true makes the wire parser throw in production instead of warning. For diagnosing an AI service whose API drifted	warn only

Compiled into the browser bundle

These are read when the JavaScript is built, so they take effect only in a build you run.

Variable	What it does	Default
NEXT_PUBLIC_MOTD	The message-of-the-day banner - below	-
NEXT_PUBLIC_GOOGLE_DRIVE_CLIENT_ID	Google Drive in the attachment menu	-
NEXT_PUBLIC_PLANTUML_SERVER_URL	Where diagrams are rendered	https://www.plantuml.com/plantuml/svg/
NEXT_PUBLIC_GA4_MEASUREMENT_ID · NEXT_PUBLIC_POSTHOG_KEY	Your own analytics properties - below	-
NEXT_PUBLIC_BUILD_HASH	Overrides the build identifier the app displays	git revision, else 2-dev
NEXT_PUBLIC_DEBUG_BREAKS	true pauses the browser debugger on every error, critical and DEV log. Development builds only: npm run dev, never a published image	-

Three rules apply to all of the above:

• A host or endpoint value must carry its scheme. api.openai.com fails the build; https://api.openai.com passes.
• A bad value stops the build, not a request - see When this doesn't work.
• A key may be several keys, separated by commas, one picked at random per request. That spreads rate limits at no cost.

The field takes	AI services
several keys	Alibaba · Cerebras · Cohere · Deepseek · Gemini · Groq · Mistral · Moonshot · NVIDIA NIM · OpenRouter · Perplexity · Sakana · Together AI · xAI · Z.ai
one value	OpenAI · Anthropic · Azure · Bedrock · LocalAI · Ollama

Build time and run time

Everything named NEXT_PUBLIC_* is compiled into the JavaScript when the app is built. Everything else is read from the process environment while it runs.

What you do	What happens
prebuilt image + -e OPENAI_API_KEY=...	works immediately, no rebuild
prebuilt image + -e NEXT_PUBLIC_MOTD=...	nothing happens, ever
a server-side variable changed	takes effect on restart
its name contains _API_	every browser re-scans its model services once

The message of the day, Drive import, the analytics keys and the diagram server need a build you control: a Vercel project variable, or a build from source. The re-scan is Update.

Where to set them

You run it with	Put them in
Source build	.env in the project root
docker run	--env-file .env, or one -e per variable
Compose	the env_file entry the shipped file already has
Kubernetes	stringData in the secret manifest
Vercel	the project's Environment Variables screen

A variable that was accepted and changes nothing is one of the cases above, or a name that never reached the process. Everything else is My self-hosted instance is broken.

Related

• Run it yourself
• Turn on the optional services
• Keep your key safe