Environment Variables
Complete reference for all Ctrl AI environment variables.
| Variable | Description |
|---|
DATABASE_URL | PostgreSQL connection string |
AUTH_SECRET | Random secret for session signing. Generate with openssl rand -hex 32 |
At least one LLM provider key is required.
| Variable | Description |
|---|
GEMINI_API_KEY | Google Gemini API key (default for parse/evaluate/prose roles) |
ANTHROPIC_API_KEY | Anthropic Claude API key (default for unit generation) |
OPENAI_API_KEY | OpenAI API key (optional) |
OPENROUTER_API_KEY | OpenRouter API key (access all models via single key) |
| Variable | Default | Description |
|---|
LLM_PROVIDER | gemini | LLM backend: gemini, openai, ollama |
LLM_BASE_URL | — | Base URL for OpenAI-compatible or Ollama endpoint |
LLM_API_KEY | — | API key for OpenAI-compatible provider |
LLM_MODEL | — | Model name override (e.g., llama3, gpt-4o) |
| Variable | Description |
|---|
AUTH_GITHUB_ID | GitHub OAuth app client ID |
AUTH_GITHUB_SECRET | GitHub OAuth app client secret |
AUTH_GOOGLE_ID | Google OAuth client ID |
AUTH_GOOGLE_SECRET | Google OAuth client secret |
AUTH_LINKEDIN_ID | LinkedIn OAuth client ID |
AUTH_LINKEDIN_SECRET | LinkedIn OAuth client secret |
AUTH_RESEND_KEY | Resend API key for email magic links |
| Variable | Description |
|---|
SSO_ISSUER_URL | OIDC issuer URL (Okta, Azure AD, Google Workspace) |
SSO_CLIENT_ID | OIDC client ID |
SSO_CLIENT_SECRET | OIDC client secret |
| Variable | Default | Description |
|---|
RESEND_API_KEY | — | Resend API key for transactional email |
SMTP_HOST | — | SMTP server hostname (alternative to Resend) |
SMTP_PORT | 587 | SMTP server port |
SMTP_USER | — | SMTP username |
SMTP_PASS | — | SMTP password |
SMTP_FROM | Ctrl AI <noreply@ctrlai.local> | Sender address |
| Variable | Description |
|---|
ENCRYPTION_KEY | AES-256-GCM key for encrypting PII/PHI at rest |
| Variable | Description |
|---|
UPSTASH_REDIS_REST_URL | Upstash Redis URL for rate limiting |
UPSTASH_REDIS_REST_TOKEN | Upstash Redis auth token |
CRON_SECRET | Shared secret for internal cron HTTP calls |
| Variable | Description |
|---|
STRIPE_SECRET_KEY | Stripe secret key |
STRIPE_WEBHOOK_SECRET | Stripe webhook signing secret |
| Variable | Default | Description |
|---|
S3_ENDPOINT | Cloudflare R2 | Custom S3-compatible endpoint |
S3_PUBLIC_URL | https://cdn.ctrlai.com | Public URL for uploaded files |
R2_ACCOUNT_ID | — | Cloudflare R2 account ID |
R2_ACCESS_KEY_ID | — | S3-compatible access key |
R2_SECRET_ACCESS_KEY | — | S3-compatible secret key |
R2_BUCKET_NAME | ctrlai | Storage bucket name |