Environment Reference

Legend

Column	Description
Service	Which service(s) use this variable: `migrator`, `seeder`, `app`, `portal`, `api`
Phase	`build` = Docker build arg, `runtime` = loaded from env file at startup
Required	`required-minimal` = needed for basic deployment, `conditional` = needed for specific features, `optional` = safe to omit

Minimal Required Variables

These variables are required for a functional Docker deployment:

Name	Service(s)	Phase	Notes
`DATABASE_URL`	migrator, seeder, app, portal	runtime	PostgreSQL connection string with `?sslmode=require`
`AUTH_SECRET`	app	runtime	32-byte base64 secret for auth. Generate: `openssl rand -base64 32`
`SECRET_KEY`	app	runtime	Encryption key for sensitive data. Generate: `openssl rand -base64 32`
`BETTER_AUTH_URL`	app, portal	runtime	Base URL for Better Auth (app or portal’s public URL)
`NEXT_PUBLIC_BETTER_AUTH_URL`	app, portal	build	Public auth URL (same as `BETTER_AUTH_URL`)
`BETTER_AUTH_SECRET`	portal	runtime	Portal-specific auth secret. Generate: `openssl rand -base64 32`
`RESEND_API_KEY`	app, portal	runtime	Resend API key for email
`TRIGGER_SECRET_KEY`	app	runtime	Trigger.dev project secret key
`REVALIDATION_SECRET`	app	runtime	Random string for revalidation. Generate: `openssl rand -base64 16`
`NEXT_PUBLIC_PORTAL_URL`	app	build	Public URL of the portal (e.g., `https://portal.yourdomain.com`)

All Variables by Category

Database

Name	Service(s)	Phase	Required	Notes
`DATABASE_URL`	migrator, seeder, app, portal	runtime	required-minimal	Format: `postgresql://user:pass@host:5432/db?sslmode=require`

Authentication

Name	Service(s)	Phase	Required	Notes
`AUTH_SECRET`	app	runtime	required-minimal	Main app auth secret
`SECRET_KEY`	app	runtime	required-minimal	Encryption key for sensitive data
`BETTER_AUTH_URL`	app, portal	runtime	required-minimal	Base URL for auth
`BETTER_AUTH_SECRET`	portal	runtime	required-minimal	Portal auth secret
`NEXT_PUBLIC_BETTER_AUTH_URL`	app, portal	build	required-minimal	Public auth URL for client code
`AUTH_GOOGLE_ID`	app	runtime	conditional	Google OAuth client ID
`AUTH_GOOGLE_SECRET`	app	runtime	conditional	Google OAuth client secret
`AUTH_GITHUB_ID`	app	runtime	optional	GitHub OAuth client ID
`AUTH_GITHUB_SECRET`	app	runtime	optional	GitHub OAuth client secret
`AUTH_MICROSOFT_CLIENT_ID`	app	runtime	conditional	Microsoft/Entra OAuth client ID
`AUTH_MICROSOFT_CLIENT_SECRET`	app	runtime	conditional	Microsoft/Entra OAuth client secret
`AUTH_MICROSOFT_TENANT_ID`	app	runtime	optional	`common` (default), `organizations`, or tenant GUID to restrict login

Microsoft sign-in only creates a user, or links to an existing one, when the ID token proves the email address. Accounts already linked keep working. In the Entra app registration, add the optional ID-token claims email, xms_edov, verified_primary_email and verified_secondary_email, and leave acceptMappedClaims off. Without them, first-time Microsoft sign-ins end with account_not_linked.

Email

Name	Service(s)	Phase	Required	Notes
`RESEND_API_KEY`	app, portal	runtime	required-minimal	Resend API key for transactional email
`RESEND_DOMAIN`	portal	runtime	optional	Custom domain for sending emails

Workflows (Trigger.dev)

Name	Service(s)	Phase	Required	Notes
`TRIGGER_SECRET_KEY`	app	runtime	required-minimal	Trigger.dev project secret
`REVALIDATION_SECRET`	app	runtime	required-minimal	Server-side revalidation secret

AWS S3 Storage

Name	Service(s)	Phase	Required	Notes
`APP_AWS_ACCESS_KEY_ID`	app, portal	runtime	conditional	AWS access key
`APP_AWS_SECRET_ACCESS_KEY`	app, portal	runtime	conditional	AWS secret key
`APP_AWS_REGION`	app, portal	runtime	conditional	AWS region (e.g., `us-east-1`)
`APP_AWS_BUCKET_NAME`	app, portal	runtime	conditional	General file storage bucket
`APP_AWS_ORG_ASSETS_BUCKET`	app	runtime	conditional	Organization logos, compliance certs
`APP_AWS_QUESTIONNAIRE_UPLOAD_BUCKET`	app	runtime	conditional	Security questionnaire uploads
`APP_AWS_KNOWLEDGE_BASE_BUCKET`	app	runtime	conditional	Knowledge base documents
`APP_AWS_ENDPOINT`	app, portal	runtime	optional	URL for alternative S3-compatible providers

AWS S3 variables are required for file upload features (attachments, logos, questionnaires). Without them, these features will fail.

AI Providers

Name	Service(s)	Phase	Required	Notes
`OPENAI_API_KEY`	app	runtime	conditional	OpenAI API key for AI features
`ANTHROPIC_API_KEY`	app	runtime	optional	Anthropic API key (alternative models)
`GROQ_API_KEY`	app	runtime	optional	Groq API key for dashboard chat
`FIRECRAWL_API_KEY`	app	runtime	conditional	Firecrawl for vendor research

Rate Limiting & Caching (Upstash)

Name	Service(s)	Phase	Required	Notes
`UPSTASH_REDIS_REST_URL`	app	runtime	optional	Upstash Redis URL for rate limiting
`UPSTASH_REDIS_REST_TOKEN`	app	runtime	optional	Upstash Redis token
`UPSTASH_VECTOR_REST_URL`	app	runtime	optional	Upstash Vector for embeddings
`UPSTASH_VECTOR_REST_TOKEN`	app	runtime	optional	Upstash Vector token

Analytics & Tracking

Name	Service(s)	Phase	Required	Notes
`NEXT_PUBLIC_POSTHOG_KEY`	app, portal	build	optional	PostHog project key
`NEXT_PUBLIC_POSTHOG_HOST`	app, portal	build	optional	PostHog host (e.g., `/ingest`)

Vercel (Trust Portal Domains)

Name	Service(s)	Phase	Required	Notes
`VERCEL_ACCESS_TOKEN`	app	runtime	conditional	Vercel API token for portal domains
`VERCEL_TEAM_ID`	app	runtime	conditional	Vercel team ID
`VERCEL_PROJECT_ID`	app	runtime	conditional	Vercel project ID
`NEXT_PUBLIC_VERCEL_URL`	app	build	optional	Vercel deployment URL

Slack app (internal `/comp` command)

Used by the API (apps/api) for the Comp AI team’s /comp Slack slash command. Self-hosted deployments can leave these unset; the command then refuses every request.

Name	Service(s)	Phase	Required	Notes
`SLACK_SIGNING_SECRET`	api	runtime	optional	Slack app signing secret. Used to verify that requests to `/v1/slack/commands` and `/v1/slack/interactions` come from Slack
`SLACK_BOT_TOKEN`	api	runtime	optional	Slack app bot token (`xoxb-…`) with `commands`, `users:read`, `users:read.email`, `usergroups:read`, `channels:read`, `groups:read` and `chat:write`. Used to confirm the caller, read channel members, and post finding summaries and reminders to connected channels. Also set it in the Trigger.dev environment of the API
`SLACK_CX_USERGROUP_HANDLE`	api	runtime	optional	Handle of the Slack user group whose members may run `/comp register` (default `customer-success`)
`SLACK_ALLOWED_TEAM_ID`	api	runtime	optional	ID of the Slack workspace (`T…`) that can use the command. The API refuses requests from other workspaces

MDM (Fleet)

Name	Service(s)	Phase	Required	Notes
`FLEET_URL`	app	runtime	conditional	Fleet MDM server URL
`FLEET_TOKEN`	app	runtime	conditional	Fleet API token

Miscellaneous

Name	Service(s)	Phase	Required	Notes
`NEXT_PUBLIC_API_URL`	app	build	optional	Override API base URL
`NEXT_OUTPUT_STANDALONE`	app	runtime	optional	Set `true` for AWS/Docker deployments
`SLACK_SALES_WEBHOOK`	app	runtime	optional	Slack webhook for sales notifications
`DUB_API_KEY`	app	runtime	optional	Dub.co link shortener API key
`DUB_REFER_URL`	app	runtime	optional	Dub.co referral URL

Example Minimal Configuration

DATABASE_URL="postgresql://user:pass@host:5432/comp?sslmode=require"

DATABASE_URL="postgresql://user:pass@host:5432/comp?sslmode=require"
AUTH_SECRET="your-32-byte-secret-here"
SECRET_KEY="your-32-byte-encryption-key"
BETTER_AUTH_URL="https://app.yourdomain.com"
NEXT_PUBLIC_BETTER_AUTH_URL="https://app.yourdomain.com"
NEXT_PUBLIC_PORTAL_URL="https://portal.yourdomain.com"
RESEND_API_KEY="re_your_api_key"
TRIGGER_SECRET_KEY="tr_your_secret_key"
REVALIDATION_SECRET="random-revalidation-string"

DATABASE_URL="postgresql://user:pass@host:5432/comp?sslmode=require"
BETTER_AUTH_SECRET="your-32-byte-portal-secret"
BETTER_AUTH_URL="https://portal.yourdomain.com"
NEXT_PUBLIC_BETTER_AUTH_URL="https://portal.yourdomain.com"
RESEND_API_KEY="re_your_api_key"

Platform Overview

Integration Guides

Developer Guides

Self-Hosting

Legend

Minimal Required Variables

All Variables by Category

Database

Authentication

Email

Workflows (Trigger.dev)

AWS S3 Storage

AI Providers

Rate Limiting & Caching (Upstash)

Analytics & Tracking

Vercel (Trust Portal Domains)

Slack app (internal `/comp` command)

MDM (Fleet)

Miscellaneous

Example Minimal Configuration

​Legend

​Minimal Required Variables

​All Variables by Category

​Database

​Authentication

​Email

​Workflows (Trigger.dev)

​AWS S3 Storage

​AI Providers

​Rate Limiting & Caching (Upstash)

​Analytics & Tracking

​Vercel (Trust Portal Domains)

​Slack app (internal /comp command)

​MDM (Fleet)

​Miscellaneous

​Example Minimal Configuration

Legend

Minimal Required Variables

All Variables by Category

Database

Authentication

Email

Workflows (Trigger.dev)

AWS S3 Storage

AI Providers

Rate Limiting & Caching (Upstash)

Analytics & Tracking

Vercel (Trust Portal Domains)

Slack app (internal `/comp` command)

MDM (Fleet)

Miscellaneous

Example Minimal Configuration