Docup reads configuration in three places, and the same name can be needed in more than one:
- Local development:
.dev.vars, copied from .dev.vars.example.
- The Worker: secrets declared in
cloudflare.config.ts and set with the cf CLI. Never add or change them in the Cloudflare dashboard. See Deployment.
- Trigger.dev tasks: environment variables set in the Trigger.dev dashboard. Tasks run on Trigger.dev, so they cannot read the Worker's secrets.
Core#
| Variable |
Used by |
Purpose |
BETTER_AUTH_SECRET |
Worker |
Signs sessions. Generate with openssl rand -base64 32. |
BETTER_AUTH_URL |
Worker |
Public origin of the app: http://localhost:3000 locally, https://docup.dev in production. |
DATABASE_URL |
Worker secret, tasks, drizzle-kit |
Postgres connection string. The Worker reaches the database through the Hyperdrive binding. |
Sign-in#
| Variable |
Purpose |
GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET |
GitHub OAuth app. Callback: <origin>/api/auth/callback/github. |
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET |
Google OAuth. Redirect: <origin>/api/auth/callback/google. |
GitHub#
| Variable |
Used by |
Purpose |
GITHUB_SERVER_TOKEN |
Worker, tasks |
A read-only token for public data, used when a user pastes a public repository link. Needs no extra permissions. |
GITHUB_APP_ID, GITHUB_APP_SLUG |
Worker, tasks (id) |
Identify the Docup GitHub App. |
GITHUB_APP_PRIVATE_KEY |
Worker, tasks |
Signs app JWTs. May be on one line with \n for line breaks. |
GITHUB_APP_CLIENT_ID, GITHUB_APP_CLIENT_SECRET |
Worker |
Verify, right after install, that the signed-in user can see the installation. |
GITHUB_WEBHOOK_SECRET |
Worker |
Signs every webhook delivery. See GitHub webhook. |
The GitHub App needs Contents: read and Metadata: read, "Request user authorization (OAuth) during installation" turned on, its first callback URL set to <origin>/api/github/setup, and a subscription to the push event.
| Variable |
Used by |
Purpose |
GOOGLE_VERTEX_CREDENTIALS |
Worker, tasks |
Service account JSON on one line, with the Vertex AI User role. The project id is read from it and the location is always global. |
QDRANT_CLUSTER_ENDPOINT, QDRANT_API_KEY |
Worker, tasks |
The Qdrant cluster for Ask AI. |
CLOUDFLARE_TURNSTILE_SECRET |
Worker |
Verifies the Ask AI bot check. The site key is public and lives in lib/ask/turnstile.ts. |
Custom domains#
| Variable |
Used by |
Purpose |
CLOUDFLARE_ZONE_ID |
Worker, tasks |
The Cloudflare zone ID of the main domain (e.g., docup.dev). Leave empty locally unless testing custom domains. |
CLOUDFLARE_SAAS_TOKEN |
Worker, tasks |
Cloudflare API token with Zone > SSL and Certificates > Edit permissions on the zone. |
Data services#
| Variable |
Used by |
Purpose |
UPSTASH_REDIS_REST_URL, UPSTASH_REDIS_REST_TOKEN |
Worker, tasks |
Redis for caches, limits and de-duplication. Locally http://localhost:8079 and docup-local-redis-token. |
Background tasks#
| Variable |
Used by |
Purpose |
TRIGGER_PROJECT_REF |
trigger.config.ts, CLI scripts |
Your Trigger.dev project. |
TRIGGER_SECRET_KEY |
Worker |
Starts tasks and mints run tokens. Use the dev key locally. |
Analytics#
| Variable |
Purpose |
CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_ANALYTICS_TOKEN |
Read docs analytics back from the Analytics Engine SQL API. |
POSTHOG_KEY |
Docup's own product analytics. Off in development unless started with POSTHOG_DEV=1 pnpm dev. |
Not wired up yet#
RESEND_API_KEY is reserved for welcome and "docs ready" emails.
What tasks need#
For the pipeline to run, Trigger.dev needs: DATABASE_URL, GITHUB_SERVER_TOKEN, GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, GOOGLE_VERTEX_CREDENTIALS, QDRANT_CLUSTER_ENDPOINT, QDRANT_API_KEY, UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN.
The custom domain check task also requires CLOUDFLARE_ZONE_ID and CLOUDFLARE_SAAS_TOKEN to be set in the Trigger.dev environment.
A task that finds a required variable missing stops with "X is not set in the Trigger.dev environment" or "CLOUDFLARE_ZONE_ID and CLOUDFLARE_SAAS_TOKEN are not set in the Trigger.dev environment".