Reference
Configuration
Every environment variable the au1h server reads.
Set these in apps/server/.env (see .env.example).
Required
| Variable | Description |
|---|---|
DATABASE_URL | Postgres connection string |
REDIS_URL | Redis URL (default redis://localhost:6379) |
BETTER_AUTH_SECRET | Signs cookies, encrypts the JWT private key. Changing it invalidates both |
BETTER_AUTH_URL | Public base URL; also the JWT iss |
CORS_ORIGIN | Admin portal origin(s), comma-separated |
Environment
| Variable | Default | Description |
|---|---|---|
PORT | 4444 | |
NODE_ENV | development | production enables secure cookies, Better Auth's rate limiter, and the private-backend policy. |
LOG_LEVEL | debug / info in production |
Admin portal
| Variable | Default | Description |
|---|---|---|
AU1H_ADMIN_APP_SLUG | au1h-admin | Reserved slug the portal sends. Must match VITE_AU1H_ADMIN_APP_SLUG in apps/web |
AU1H_ADMIN_EMAILS | empty | Comma-separated emails and @domains allowed to sign up as admins |
Proxy
| Variable | Default | Description |
|---|---|---|
AU1H_PROXY_TIMEOUT_MS | 30000 | Backend fetch timeout; 504 on expiry |
AU1H_PROXY_ALLOW_PRIVATE_BACKENDS | true in dev, false in prod | Allow loopback/private route targets |
Rate limits
Per client IP per minute, Redis-backed.
| Variable | Default | Routes |
|---|---|---|
AU1H_RATE_LIMIT_ADMIN | 300 | /api/v1/* |
AU1H_RATE_LIMIT_PROXY | 600 | /proxy/* (+ slug) |
AU1H_RATE_LIMIT_APPS | 600 | /api/apps/* (+ slug) |
AU1H_AUTH_RATE_LIMIT | on in production | Better Auth's limiter on /api/auth/* (3 sign-ins / 10 s / IP) |
AU1H_TRUST_PROXY | false | Honour x-forwarded-for for limiting |
See Email for what is sent and when.
| Variable | Default | Description |
|---|---|---|
EMAIL_PROVIDER | console | console (log only), smtp, resend, or memory (tests) |
EMAIL_FROM_ADDRESS | Sender, e.g. "My Product" <[email protected]> | |
SMTP_URL | smtp://user:pass@host:587, required for smtp | |
RESEND_API_KEY | Required for resend | |
AU1H_SEND_VERIFICATION_ON_SIGNUP | true | Email a verification link as part of sign-up |
AU1H_REQUIRE_EMAIL_VERIFICATION | false | Refuse password sign-in until the address is verified |
AU1H_ADMIN_NAME | au1h admin | Name used in emails sent for the admin portal |
OAuth providers
| Variable | Description |
|---|---|
GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET | Enables GitHub sign-in when both are set |
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET | Enables Google sign-in when both are set |
AU1H_SKIP_OAUTH_STATE_CHECK | Dev only: skip the OAuth state cookie check for cross-port localhost |
All applications currently share these OAuth credentials.