Environment Variables

Backend variables (local: backend/.env.development)

For local workflow, prefer backend/.env.development and run local scripts (dev:local, test:local, Prisma local scripts).

Required variables

Variable	Required	Default	Description
DATABASE_URL	Yes	-	PostgreSQL connection string used by Prisma.
GOOGLE_CLIENT_ID	Yes	-	Google OAuth client ID.
GOOGLE_CLIENT_SECRET	Yes	-	Google OAuth client secret.
GOOGLE_CALLBACK_URL	Yes	-	OAuth callback URL handled by backend.
JWT_SECRET or JWT_SECRET_KEY	Yes (one of both)	-	Secret used to sign/verify JWT tokens.
FRONTEND_URL	Yes	http://localhost:5173	Primary frontend origin (used for CORS fallback/redirects).

Optional variables

Variable	Required	Default	Description
PORT	No	5000	Backend HTTP port.
NODE_ENV	No	development	Runtime mode (development, test, production).
CORS_ORIGINS	No	FRONTEND_URL	Comma-separated allowlist of frontend origins.
SMTP_HOST	No	-	SMTP provider host.
SMTP_PORT	No	587	SMTP provider port.
SMTP_USER	No	-	SMTP username.
SMTP_PASS	No	-	SMTP password or API token.
EMAIL_FROM	No	noreply@korta.click	Sender email used in verification emails.

Frontend variables (frontend/.env)

Variable	Required	Default	Description
VITE_API_URL	Yes (prod)	http://localhost:5000/api/v1	Backend API base URL.
VITE_GOOGLE_AUTH_URL	Yes (prod)	http://localhost:5000/api/v1/auth/google	Google auth entrypoint in backend.
VITE_BASE_URL	Yes (prod)	-	Public frontend base URL for share/copy links.

Example

backend/.env.development

PORT=5000
NODE_ENV=development
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/korta
TEST_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/korta_test
SHADOW_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/korta_shadow

FRONTEND_URL=http://localhost:5173
CORS_ORIGINS=http://localhost:5173

JWT_SECRET=change-me-strong-secret

GOOGLE_CLIENT_ID=your-google-client-id
GOOGLE_CLIENT_SECRET=your-google-client-secret
GOOGLE_CALLBACK_URL=http://localhost:5000/api/v1/auth/google/callback

SMTP_HOST=smtp.resend.com
SMTP_PORT=587
SMTP_USER=resend
SMTP_PASS=your-resend-api-key
EMAIL_FROM=onboarding@resend.dev

# frontend/.env
VITE_API_URL=http://localhost:5000/api/v1
VITE_GOOGLE_AUTH_URL=http://localhost:5000/api/v1/auth/google
VITE_BASE_URL=http://localhost:5173

Security notes

• Never commit real secrets to Git.
• Rotate secrets immediately if exposed (DATABASE_URL, JWT_SECRET, GOOGLE_CLIENT_SECRET, SMTP_PASS).
• Keep separate credentials per environment (dev/staging/prod).
• Ensure CORS_ORIGINS, FRONTEND_URL, and Google OAuth callback/origin values match exact deployed domains.