# Environment variables

Every secret and setting Docup reads, what it is for, and where it is set locally, on the Worker and on Trigger.dev.

Docup reads configuration in three places, and the same name can be needed in more than one:

- **Local development:** `.dev.vars`, copied from `.dev.vars.example`.
- **The Worker:** secrets declared in `cloudflare.config.ts` and set with the `cf` CLI. Never add or change them in the Cloudflare dashboard. See [Deployment](/development/deployment).
- **Trigger.dev tasks:** environment variables set in the Trigger.dev dashboard. Tasks run on Trigger.dev, so they cannot read the Worker's secrets.

## Core

| Variable | Used by | Purpose |
| --- | --- | --- |
| `BETTER_AUTH_SECRET` | Worker | Signs sessions. Generate with `openssl rand -base64 32`. |
| `BETTER_AUTH_URL` | Worker | Public origin of the app: `http://localhost:3000` locally, `https://docup.dev` in production. |
| `DATABASE_URL` | Worker secret, tasks, drizzle-kit | Postgres connection string. The Worker reaches the database through the Hyperdrive binding. |

## Sign-in

| Variable | Purpose |
| --- | --- |
| `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET` | GitHub OAuth app. Callback: `<origin>/api/auth/callback/github`. |
| `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` | Google OAuth. Redirect: `<origin>/api/auth/callback/google`. |

## GitHub

| Variable | Used by | Purpose |
| --- | --- | --- |
| `GITHUB_SERVER_TOKEN` | Worker, tasks | A read-only token for public data, used when a user pastes a public repository link. Needs no extra permissions. |
| `GITHUB_APP_ID`, `GITHUB_APP_SLUG` | Worker, tasks (id) | Identify the Docup GitHub App. |
| `GITHUB_APP_PRIVATE_KEY` | Worker, tasks | Signs app JWTs. May be on one line with `\n` for line breaks. |
| `GITHUB_APP_CLIENT_ID`, `GITHUB_APP_CLIENT_SECRET` | Worker | Verify, right after install, that the signed-in user can see the installation. |
| `GITHUB_WEBHOOK_SECRET` | Worker | Signs every webhook delivery. See [GitHub webhook](/reference/github-webhook). |

The GitHub App needs **Contents: read** and **Metadata: read**, "Request user authorization (OAuth) during installation" turned on, its first callback URL set to `<origin>/api/github/setup`, and a subscription to the **push** event.

## AI

| Variable | Used by | Purpose |
| --- | --- | --- |
| `GOOGLE_VERTEX_CREDENTIALS` | Worker, tasks | Service account JSON on one line, with the Vertex AI User role. The project id is read from it and the location is always `global`. |
| `QDRANT_CLUSTER_ENDPOINT`, `QDRANT_API_KEY` | Worker, tasks | The Qdrant cluster for Ask AI. |
| `CLOUDFLARE_TURNSTILE_SECRET` | Worker | Verifies the Ask AI bot check. The site key is public and lives in `lib/ask/turnstile.ts`. |

## Custom domains

| Variable | Used by | Purpose |
| --- | --- | --- |
| `CLOUDFLARE_ZONE_ID` | Worker, tasks | The Cloudflare zone ID of the main domain (e.g., `docup.dev`). Leave empty locally unless testing custom domains. |
| `CLOUDFLARE_SAAS_TOKEN` | Worker, tasks | Cloudflare API token with Zone > SSL and Certificates > Edit permissions on the zone. |

## Data services

| Variable | Used by | Purpose |
| --- | --- | --- |
| `UPSTASH_REDIS_REST_URL`, `UPSTASH_REDIS_REST_TOKEN` | Worker, tasks | Redis for caches, limits and de-duplication. Locally `http://localhost:8079` and `docup-local-redis-token`. |

## Background tasks

| Variable | Used by | Purpose |
| --- | --- | --- |
| `TRIGGER_PROJECT_REF` | `trigger.config.ts`, CLI scripts | Your Trigger.dev project. |
| `TRIGGER_SECRET_KEY` | Worker | Starts tasks and mints run tokens. Use the dev key locally. |

## Analytics

| Variable | Purpose |
| --- | --- |
| `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_ANALYTICS_TOKEN` | Read docs analytics back from the Analytics Engine SQL API. |
| `POSTHOG_KEY` | Docup's own product analytics. Off in development unless started with `POSTHOG_DEV=1 pnpm dev`. |

## Not wired up yet

`RESEND_API_KEY` is reserved for welcome and "docs ready" emails.

## What tasks need

For the pipeline to run, Trigger.dev needs: `DATABASE_URL`, `GITHUB_SERVER_TOKEN`, `GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY`, `GOOGLE_VERTEX_CREDENTIALS`, `QDRANT_CLUSTER_ENDPOINT`, `QDRANT_API_KEY`, `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN`.

The custom domain check task also requires `CLOUDFLARE_ZONE_ID` and `CLOUDFLARE_SAAS_TOKEN` to be set in the Trigger.dev environment.

A task that finds a required variable missing stops with "X is not set in the Trigger.dev environment" or "CLOUDFLARE_ZONE_ID and CLOUDFLARE_SAAS_TOKEN are not set in the Trigger.dev environment".