Required
| Variable | Description |
|---|---|
DATABASE_URL | PostgreSQL connection string |
BETTER_AUTH_SECRET | Auth secret (32 hex chars): openssl rand -hex 32 |
BETTER_AUTH_URL | Your app URL |
ENCRYPTION_KEY | Encryption key (32 hex chars): openssl rand -hex 32 |
INTERNAL_API_SECRET | Internal API secret (32 hex chars): openssl rand -hex 32 |
NEXT_PUBLIC_APP_URL | Public app URL |
NEXT_PUBLIC_SOCKET_URL | WebSocket URL (default: http://localhost:3002) |
AI Providers
| Variable | Provider |
|---|---|
OPENAI_API_KEY | OpenAI |
ANTHROPIC_API_KEY_1 | Anthropic Claude |
GEMINI_API_KEY_1 | Google Gemini |
MISTRAL_API_KEY | Mistral |
OLLAMA_URL | Ollama (default: http://localhost:11434) |
For load balancing, add multiple keys with _1, _2, _3 suffixes (e.g., OPENAI_API_KEY_1, OPENAI_API_KEY_2). Works with OpenAI, Anthropic, and Gemini.
In Docker, use OLLAMA_URL=http://host.docker.internal:11434 for host-machine Ollama.
Azure OpenAI
| Variable | Description |
|---|---|
AZURE_OPENAI_API_KEY | Azure OpenAI API key |
AZURE_OPENAI_ENDPOINT | Azure OpenAI endpoint URL |
AZURE_OPENAI_API_VERSION | API version (e.g., 2024-02-15-preview) |
vLLM (Self-Hosted)
| Variable | Description |
|---|---|
VLLM_BASE_URL | vLLM server URL (e.g., http://localhost:8000/v1) |
VLLM_API_KEY | Optional bearer token for vLLM |
OAuth Providers
| Variable | Description |
|---|---|
GOOGLE_CLIENT_ID | Google OAuth client ID |
GOOGLE_CLIENT_SECRET | Google OAuth client secret |
GITHUB_CLIENT_ID | GitHub OAuth client ID |
GITHUB_CLIENT_SECRET | GitHub OAuth client secret |
Social Login (identity-only)
Login providers authenticate a user into Cadense and use identity-only scopes. They are separate
from integration OAuth (which authorizes workflows to call third-party services). A provider appears
in the login UI only when both its client id and secret are set and it is not disabled. Preferred
AUTH_* credentials fall back to the shared integration credentials during migration.
| Variable | Description |
|---|---|
AUTH_GOOGLE_CLIENT_ID / AUTH_GOOGLE_CLIENT_SECRET | Google login credentials (fall back to GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET) |
AUTH_GITHUB_CLIENT_ID / AUTH_GITHUB_CLIENT_SECRET | GitHub login credentials (fall back to GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET) |
AUTH_MICROSOFT_CLIENT_ID / AUTH_MICROSOFT_CLIENT_SECRET | Microsoft login credentials (fall back to MICROSOFT_CLIENT_ID / MICROSOFT_CLIENT_SECRET) |
AUTH_MICROSOFT_TENANT | Entra tenant: organizations (default) | common | consumers | <tenant-id>; falls back to MICROSOFT_TENANT_ID |
DISABLE_GOOGLE_AUTH / DISABLE_GITHUB_AUTH / DISABLE_MICROSOFT_AUTH | Set to true to hide a provider even when its credentials are set |
Register each provider's redirect URI as ${BETTER_AUTH_URL}/api/auth/callback/<provider>. Provider
readiness is queryable at GET /api/auth/providers and is logged at startup. See the deployment
runbook at docs/deployment/auth-provider-expansion.md for details.
Optional
| Variable | Description |
|---|---|
API_ENCRYPTION_KEY | Encrypts stored API keys (32 hex chars): openssl rand -hex 32 |
COPILOT_API_KEY | API key for copilot features |
ADMIN_API_KEY | Admin API key for GitOps operations |
RESEND_API_KEY | Email service for notifications |
ALLOWED_LOGIN_DOMAINS | Restrict signups to domains (comma-separated) |
ALLOWED_LOGIN_EMAILS | Restrict signups to specific emails (comma-separated) |
DISABLE_REGISTRATION | Set to true to disable new user signups |
Example .env
DATABASE_URL=postgresql://postgres:postgres@db:5432/billflowap
BETTER_AUTH_SECRET=<openssl rand -hex 32>
BETTER_AUTH_URL=https://billflowap.yourdomain.com
ENCRYPTION_KEY=<openssl rand -hex 32>
INTERNAL_API_SECRET=<openssl rand -hex 32>
NEXT_PUBLIC_APP_URL=https://billflowap.yourdomain.com
NEXT_PUBLIC_SOCKET_URL=https://billflowap.yourdomain.com
OPENAI_API_KEY=sk-...See apps/cadense/.env.example for all options.