Environment variables

Deployment variables and capability bindings, what breaks without them, and which host needs them. Operator configuration may additionally name environment variables explicitly; those names are not source authority.

The minimum that runs

Configure Auth0 and the app URLs, with local file storage unless Mongo is selected. Copy applications/main/.env.example and provision secret values outside source control. Presence-only startup logging is diagnostic, not proof that credentials, endpoints or keyrings are valid.

APP_BASE_URL=http://localhost:3000
NEXT_PUBLIC_APP_BASE_URL=http://localhost:3000
# Supply required AUTH0_* through your local secret configuration.

See Auth0 setup, installation and deployment bindings.

Core and storage

Auth0

Integrations

The main application maps these names to stable capability aliases. Missing optional credentials leave a capability unavailable at dispatch; they do not change the compiled program. Malformed supplied key/JSON configuration, or absent required persistent keyring material when signing is configured, can fail host initialization.

The old requireSafeExecuteEnvOrExit helper no longer exists. Source privateKeyEnv / rpcUrlEnv overrides are compatibility identifiers, not permission to read arbitrary environment variables. Nondefault pairs require a bindings.safeAliases entry in PROCESS_APP_CONFIG, selected with the app's safeBindingKey; that alias must resolve to configured signing and endpoint capabilities.

Default RPC provisioning strips supported Alchemy/Infura path credentials into protected insertion. Other authenticated endpoint shapes require explicit public URL and secret-placement configuration. Public endpoint definitions must not contain raw credentials.

Closed-runtime provisioning

Never accept provisioning paths from an untrusted request. For explicit effects, encryption.keys, derivationKeyEnvironment, credential environment and signing-key environment select operator-owned names; they need not be the defaults above. Provision their values out-of-band and keep keyrings durable and consistent across workers sharing protected storage. Regenerating random keys does not recover existing protected handles. Never place secrets in authoring metadata, logs, committed config or NEXT_PUBLIC_* variables.

Main-app policy: repository templates compiled into the app may use the current deployment's configured capabilities. There is no runtime authoring path (templates:write is retired). That does not create arbitrary destinations or let source metadata manufacture grants. Generic standalone deployments remain operator-explicit and deny capabilities by default. Follow deployment bindings.

Frontend

Next.js public variables require static property access to be inlined in browser output. Set them for the intended build; private capability configuration belongs only on authorized server hosts.

Files and CORS

Storage

STORAGE_DRIVER=memory|file|mongo → explicit override
otherwise MONGO_URL set         → MongoDB
otherwise                       → files in .process-platform/

VITEST selects synthetic defaults in tests, not production. Configuration changes require a restart. Old formats require offline conversion; startup does not reinterpret or migrate records automatically. See storage.

Which deploy needs what

• Web/API and worker must agree on registration, storage and public capability aliases. Configuring signing also requires the protected keyring during host construction.
• Workers need the secrets/endpoints for process integration effects and a durable protected store.
• Main-app Edit with AI runs on the web authoring service, so that host needs its Gemini capability. “All credentials belong only on the worker” is not correct for this path.
• A separate frontend normally needs its backend origin, browser/session settings and public URLs; standalone backend/worker effects are explicitly provisioned.

Build secrets are not needed to determine the stable compiled program. Do not copy production secrets into fixtures to prove a build. See deployment before activation.

Required deployment access policy

Set exactly one of PROCESS_ACCESS_CONFIG (private JSON file path) or PROCESS_ACCESS_CONFIG_JSON. All web services and workers require the same reviewed owner/application policy. A file is preferable for large membership policies. Missing/invalid policy fails closed; applicationAccess inside backend provisioning is no longer supported. See application access. AUTH0_ONBOARDING_ORGANIZATION_ID is an explicit invitation destination, not a data tenant assignment.