Variables live in [vars] in the root wrangler.toml. Secrets are set with wrangler secret put and are never stored in a file or a PUBLIC_ variable. For local development use .dev.vars (gitignored).
| Name |
Purpose |
CORS_ORIGINS |
Comma-separated browser origins allowed to call the API with credentials, e.g. https://www.example.com,http://localhost:4321 |
BETTER_AUTH_URL |
The API’s public URL. Set by setup; do not change casually |
ADMIN_URL |
Admin origin, used in email links |
EMAIL_PROVIDER |
cloudflare or resend; unset logs instead of sending |
EMAIL_FROM |
Sender address |
API_DOCS_ENABLED |
Set to "false" to disable /api/v1/openapi.json and /api/v1/docs (both then return 404) |
| Name |
Purpose |
BETTER_AUTH_SECRET |
Signs sessions. Generated by setup; the API refuses to run without it |
RESEND_API_KEY |
Needed for EMAIL_PROVIDER = "resend" |
TRUSTED_PROXY_SECRET |
Lets the same-origin proxy forward real visitor IPs |
TURNSTILE_SECRET_KEY |
Optional: require Turnstile on public sign-up |
OWNER_RECOVERY_SECRET |
Optional break-glass owner recovery. Absent by default (the route returns 404). Treat it as a standing master key and delete it after use |
PAYSTACK_SECRET_KEY |
Commerce payments |
| Name |
Purpose |
PUBLIC_KENRESOFT_CMS_URL |
The CMS API URL |
VITE_API_URL: the API URL baked into the admin build.
