Ansvisor Docs

Web (`web/.env`)

Fed to the Next.js app. Variables prefixed with NEXT_PUBLIC_ are exposed to the browser.

Variable	Required	Description
`NEXT_PUBLIC_SUPABASE_URL`	✅	Your Supabase project URL
`NEXT_PUBLIC_SUPABASE_ANON_KEY`	✅	Supabase anon key (public, RLS-protected)
`SUPABASE_SERVICE_ROLE_KEY`	✅	Service role key (bypasses RLS — used for server actions; never expose)
`NEXT_PUBLIC_API_URL`	✅	Server URL (e.g. `https://api.your-domain.com` or `http://localhost`)
`NEXT_PUBLIC_APP_URL`	✅	Web app URL (used for OAuth callback URLs)
`OPENAI_API_KEY`	optional*	OpenAI API key
`GOOGLE_GEMINI_API_KEY`	optional*	Google AI Studio Gemini key
`ANTHROPIC_API_KEY`	optional*	Anthropic Claude key
`PERPLEXITY_API_KEY`	optional*	Perplexity API key
`GROK_API_KEY`	optional*	xAI Grok key
`NEXT_PUBLIC_IS_CLOUD`	optional	`"true"` for the official cloud build (enables billing UI). Leave unset for self-hosted (all features unlocked).
`STRIPE_SECRET_KEY`	cloud only	Stripe live/test secret key
`STRIPE_WEBHOOK_SECRET`	cloud only	Stripe webhook signing secret
`CRON_SECRET`	cloud only	Shared secret for Vercel cron → server auth

* You need at least one AI provider key for tracking to work. Configure providers per-brand in the dashboard.

Server (`server/.env`)

Fed to the Express API + workers.

Variable	Required	Description
`NODE_ENV`	✅	`production` for live, `development` for local
`PORT`	✅	Default `80`
`SUPABASE_URL`	✅	Same as web’s `NEXT_PUBLIC_SUPABASE_URL`
`SUPABASE_ANON_KEY`	✅	Supabase anon key
`SUPABASE_SERVICE_ROLE_KEY`	✅	Service role key (used by workers and admin endpoints)
`OPENAI_API_KEY`	optional*	OpenAI key
`ANTHROPIC_API_KEY`	optional*	Anthropic key
`GOOGLE_GENERATIVE_AI_API_KEY`	optional*	Google Gemini key (server-side name differs from web)
`DEFAULT_SUGGESTION_MODEL`	optional	Default LLM for AI suggestions (default: `google/gemini-3-flash-preview`)
`TOPIC_SUGGESTION_MODEL`	optional	LLM for topic suggestions
`PROMPT_SUGGESTION_MODEL`	optional	LLM for prompt suggestions
`COMPETITOR_SUGGESTION_MODEL`	optional	LLM for competitor suggestions
`AUDIT_LLM_MODEL`	optional	LLM for the Site Audit’s LLM-judged signals + AI recommendations (default: `google/gemini-3-flash-preview`)
`ALLOWED_ORIGINS`	✅	Comma-separated list of web origins allowed to call the API (for CORS)
`IS_CLOUD`	optional	`"true"` only for the official cloud build
`DATAFORSEO_LOGIN`	optional	DataForSEO login (for prompt volume analysis)
`DATAFORSEO_PASSWORD`	optional	DataForSEO password
`CLORO_API_KEY`	optional	Cloro web scraper API key (for ChatGPT/Gemini/Perplexity web scraping)
`PLATFORM_PROVIDER`	optional	Default `cloro`. Used to pick scraper backend
`SCRAPEDO_API_KEY`	Site Audit	Scrape.do API key — required to run Site Audit (it fetches target pages via Scrape.do’s proxy + JS render). Distinct from `CLORO_API_KEY`, which scrapes the AI answer engines.
`AI_VOLUME_MULTIPLIER`	optional	Estimated AI search adoption rate (default `0.15` = 15% of Google volume)
`CRON_SECRET`	cloud only	Shared secret with web’s CRON_SECRET; protects internal cron endpoints

Tips for production

Mark secrets as sensitive — on Vercel, toggle the Sensitive flag on every secret env var. Once set, the value is write-only and can’t be read back from the UI.
Rotate SUPABASE_SERVICE_ROLE_KEY and CRON_SECRET quarterly as a hygiene practice
Use a different Supabase project for each environment (dev / staging / prod). Don’t share databases across environments — RLS bypasses make it easy to corrupt prod data with a misconfigured dev pointer

Continue: Upgrading

How to upgrade your self-hosted instance to a new release.