Environment variables
Environment values are the deployment boundary. Keep secrets in Cloudflare Worker secrets; do not commit them to the application or website repository.
Bindings such as D1, R2, KV, Durable Objects, Workflows, Workers AI, Containers, and email delivery are platform resources rather than string values. Environment variables configure how Discoflare uses those bindings; they do not create a missing binding.
Required values
| Variable | Setup | Purpose and verification |
|---|---|---|
AUTH_SECRET | Generated by the guided installer; required manually | Encrypts sessions and workspace-managed provider secrets. Use a random value of at least 32 characters and keep it stable. Verify by signing out and back in after setup. |
PUBLIC_ORIGIN | Usually derived; optional override | Exact external origin, with scheme and no path, when automatic request-origin detection is not appropriate. Verify that sign-in, API requests, and WebSockets work from that origin. |
ADMIN_EMAIL | Collected by the guided installer; required manually | Intended first owner. Before setup, /api/setup/health returns a masked owner hint. |
ADMIN_SETUP_TOKEN | Generated by the guided installer; required manually | Private owner claim. Use a random value of at least 32 characters and verify it completes setup once and cannot create another owner afterward. |
Rotating AUTH_SECRET invalidates sessions and makes provider secrets encrypted in D1 unreadable. Replace those stored provider secrets after an intentional rotation.
Initial workspace and branding
| Variable | Default | Behavior |
|---|---|---|
APP_NAME | Discoflare | Name beside the fixed Discoflare mark and in the browser title. |
APP_TITLE | Deployment-specific | Sign-in headline. Use \n for a deliberate line break. |
APP_SUBTITLE | Deployment-specific | Supporting sign-in copy. |
ADMIN_WORKSPACE | HQ | First workspace name for manual or unattended bootstrap. |
AUTH_REGISTRATION_MODE | invite_only | Initial policy. After the authentication settings row exists, the owner controls the policy in the UI. |
APP_NAME, APP_TITLE, APP_SUBTITLE, and the registration mode are configuration, not secrets.
Legacy unattended bootstrap
| Variable | Purpose |
|---|---|
ADMIN_PASSWORD | With ADMIN_EMAIL, creates the owner automatically when the database is empty. Prefer the setup claim for interactive installations. |
ADMIN_NAME | Display name for unattended bootstrap. |
ADMIN_HANDLE | Optional handle for unattended bootstrap. |
Both the guided installer and the manual GitHub method should use the private setup claim so the password is chosen on the workspace origin.
Authentication providers
| Variables | Provider |
|---|---|
GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET | GitHub |
TWITTER_CLIENT_ID, TWITTER_CLIENT_SECRET | X |
TELEGRAM_CLIENT_ID, TELEGRAM_CLIENT_SECRET | Telegram |
TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY | Cloudflare Turnstile |
The owner can normally configure these in Workspace Settings → Authentication. Values supplied by the deployment override the corresponding workspace values and cannot be revealed in the UI.
Provider callback URLs always use the deployed workspace origin, not discoflare.com:
https://chat.example.com/api/auth/callback/github
https://chat.example.com/api/auth/callback/twitter
https://chat.example.com/api/auth/callback/telegram
Verification and password-reset email
| Variable | Purpose |
|---|---|
EMAIL_FROM | Verified login-email sender. |
EMAIL_FROM_NAME | Human-readable sender name. |
On Cloudflare, delivery additionally requires an onboarded Email Service domain and a restricted Worker send_email binding named EMAIL. The binding is separate from the workspace-mail binding named MAIL_EMAIL.
New email signup requires the sender, delivery binding, Turnstile, email login, and either open registration or an Invite. Existing verified users can sign in without sending an email.
Workspace mail
| Variable or binding | Purpose |
|---|---|
MAIL_DOMAIN | Domain accepted by the workspace mailboxes, such as chat.example.com. |
MAIL_ZONE_ID | Cloudflare zone that owns the mail routing configuration. |
MAIL_APP_HOSTNAME | Public Discoflare hostname that receives routed mail. |
MAIL_DEFAULT_LOCAL_PART | First mailbox local part; defaults to inbox. |
MAIL_EMAIL | Worker send_email binding used for new outbound mail and replies. |
The guided installer supplies this group only when Workspace email is enabled. A manual deployment must configure the variables, Email Routing rule, Email Sending domain, and binding together. Omitting the complete group leaves workspace mail disabled without affecting text chat.
Web Push
| Variable | Purpose |
|---|---|
VAPID_SUBJECT | Contact URI, normally mailto:admin@example.com. |
VAPID_PUBLIC_KEY | Public half of one stable VAPID pair. |
VAPID_PRIVATE_KEY | Secret half of the same pair. |
Generate the pair once with pnpm vapid:generate from the application repository. Rotating either key invalidates existing browser subscriptions.
RealtimeKit huddles
| Variable | Purpose |
|---|---|
REALTIMEKIT_ACCOUNT_ID | Cloudflare account containing RealtimeKit. |
REALTIMEKIT_APP_ID | RealtimeKit application. |
REALTIMEKIT_API_KEY | Current API-token credential. |
REALTIMEKIT_PRESET_VOICE | Voice preset; defaults to voice. |
REALTIMEKIT_PRESET_AV | Optional audio/video preset; defaults to group_call_host. |
REALTIMEKIT_API_SECRET | Legacy Basic Auth path only. |
The owner can instead configure RealtimeKit in Workspace Settings → Huddles. The saved token is encrypted with AUTH_SECRET. Deployment values override saved settings.
Agent model
AGENT_MODEL is an optional public Worker variable. Agent profiles may override it with another model ID supported by the deployment's Workers AI binding. The default Cloudflare Agent runtime does not require an OpenAI or OpenRouter key.
Website installer environment
These server-only values configure the guided installer running at discoflare.com; they are not copied into installed workspaces:
| Variable | Purpose |
|---|---|
NUXT_CLOUDFLARE_OAUTH_CLIENT_ID | Public identifier for the installer OAuth client. |
NUXT_CLOUDFLARE_OAUTH_CLIENT_SECRET | Secret used by the installer during the OAuth code exchange. |
NUXT_CLOUDFLARE_OAUTH_SCOPES | Space-separated permissions the installer requests for provisioning. Keep this aligned with the registered Cloudflare OAuth client. |
NUXT_INSTALLER_SESSION_PASSWORD | Random 32-character-or-longer secret that encrypts temporary installer sessions. |
NUXT_INSTALLER_ORIGIN | Exact public installer origin, normally https://discoflare.com. |
NUXT_INSTALLER_MANIFEST_URL | Trusted release manifest used to pin the application bundle installed into a workspace. |
The website repository can remain private. Publishing the rendered site and documentation does not expose these runtime values, provided secrets remain in Cloudflare Worker secrets rather than source control or client-side configuration.