> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ansvisor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment variables

> Full reference for every env var across web and server.

## Web (`web/.env`)

Fed to the Next.js app. Variables prefixed with `NEXT_PUBLIC_` are exposed to the browser.

| Variable                        | Required   | Description                                                                                                      |
| ------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------- |
| `NEXT_PUBLIC_SUPABASE_URL`      | ✅          | Your Supabase project URL                                                                                        |
| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | ✅          | Supabase anon key (public, RLS-protected)                                                                        |
| `SUPABASE_SERVICE_ROLE_KEY`     | ✅          | Service role key (bypasses RLS — used for server actions; never expose)                                          |
| `NEXT_PUBLIC_API_URL`           | ✅          | Server URL (e.g. `https://api.your-domain.com` or `http://localhost`)                                            |
| `NEXT_PUBLIC_APP_URL`           | ✅          | Web app URL (used for OAuth callback URLs)                                                                       |
| `OPENAI_API_KEY`                | optional\* | OpenAI API key                                                                                                   |
| `GOOGLE_GEMINI_API_KEY`         | optional\* | Google AI Studio Gemini key                                                                                      |
| `ANTHROPIC_API_KEY`             | optional\* | Anthropic Claude key                                                                                             |
| `PERPLEXITY_API_KEY`            | optional\* | Perplexity API key                                                                                               |
| `GROK_API_KEY`                  | optional\* | xAI Grok key                                                                                                     |
| `NEXT_PUBLIC_IS_CLOUD`          | optional   | `"true"` for the official cloud build (enables billing UI). Leave unset for self-hosted (all features unlocked). |
| `STRIPE_SECRET_KEY`             | cloud only | Stripe live/test secret key                                                                                      |
| `STRIPE_WEBHOOK_SECRET`         | cloud only | Stripe webhook signing secret                                                                                    |
| `CRON_SECRET`                   | cloud only | Shared secret for Vercel cron → server auth                                                                      |

\* You need **at least one AI provider key** for tracking to work. Configure providers per-brand in the dashboard.

## Server (`server/.env`)

Fed to the Express API + workers.

| Variable                       | Required   | Description                                                                                                                                                                         |
| ------------------------------ | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `NODE_ENV`                     | ✅          | `production` for live, `development` for local                                                                                                                                      |
| `PORT`                         | ✅          | Default `80`                                                                                                                                                                        |
| `SUPABASE_URL`                 | ✅          | Same as web's `NEXT_PUBLIC_SUPABASE_URL`                                                                                                                                            |
| `SUPABASE_ANON_KEY`            | ✅          | Supabase anon key                                                                                                                                                                   |
| `SUPABASE_SERVICE_ROLE_KEY`    | ✅          | Service role key (used by workers and admin endpoints)                                                                                                                              |
| `OPENAI_API_KEY`               | optional\* | OpenAI key                                                                                                                                                                          |
| `ANTHROPIC_API_KEY`            | optional\* | Anthropic key                                                                                                                                                                       |
| `GOOGLE_GENERATIVE_AI_API_KEY` | optional\* | Google Gemini key (server-side name differs from web)                                                                                                                               |
| `DEFAULT_SUGGESTION_MODEL`     | optional   | Default LLM for AI suggestions (default: `google/gemini-3-flash-preview`)                                                                                                           |
| `TOPIC_SUGGESTION_MODEL`       | optional   | LLM for topic suggestions                                                                                                                                                           |
| `PROMPT_SUGGESTION_MODEL`      | optional   | LLM for prompt suggestions                                                                                                                                                          |
| `COMPETITOR_SUGGESTION_MODEL`  | optional   | LLM for competitor suggestions                                                                                                                                                      |
| `AUDIT_LLM_MODEL`              | optional   | LLM for the Site Audit's LLM-judged signals + AI recommendations (default: `google/gemini-3-flash-preview`)                                                                         |
| `ALLOWED_ORIGINS`              | ✅          | Comma-separated list of web origins allowed to call the API (for CORS)                                                                                                              |
| `IS_CLOUD`                     | optional   | `"true"` only for the official cloud build                                                                                                                                          |
| `DATAFORSEO_LOGIN`             | optional   | DataForSEO login (for prompt volume analysis)                                                                                                                                       |
| `DATAFORSEO_PASSWORD`          | optional   | DataForSEO password                                                                                                                                                                 |
| `CLORO_API_KEY`                | optional   | Cloro web scraper API key (for ChatGPT/Gemini/Perplexity web scraping)                                                                                                              |
| `PLATFORM_PROVIDER`            | optional   | Default `cloro`. Used to pick scraper backend                                                                                                                                       |
| `SCRAPEDO_API_KEY`             | Site Audit | Scrape.do API key — required to run **Site Audit** (it fetches target pages via Scrape.do's proxy + JS render). Distinct from `CLORO_API_KEY`, which scrapes the AI answer engines. |
| `AI_VOLUME_MULTIPLIER`         | optional   | Estimated AI search adoption rate (default `0.15` = 15% of Google volume)                                                                                                           |
| `CRON_SECRET`                  | cloud only | Shared secret with web's CRON\_SECRET; protects internal cron endpoints                                                                                                             |

## Tips for production

* **Mark secrets as sensitive** — on Vercel, toggle the *Sensitive* flag on every secret env var. Once set, the value is write-only and can't be read back from the UI.
* **Rotate `SUPABASE_SERVICE_ROLE_KEY` and `CRON_SECRET`** quarterly as a hygiene practice
* **Use a different Supabase project for each environment** (dev / staging / prod). Don't share databases across environments — RLS bypasses make it easy to corrupt prod data with a misconfigured dev pointer

<Card title="Continue: Upgrading" icon="arrow-right" href="/self-host/upgrading">
  How to upgrade your self-hosted instance to a new release.
</Card>