Environment variables reference
The full env-var reference, organized by subsystem.
Core
| Var | Required | Purpose | |---|---|---| | SESSION_SECRET | Production | 256-bit secret for signing JWT session cookies. Rotate to invalidate all sessions. | | NEXT_PUBLIC_SITE_URL | Recommended | Absolute base URL (no trailing slash). Used in canonicals, OG tags, sitemap, email links. | | NODE_ENV | Auto | production enables HSTS + secure cookies. |
Stripe
| Var | Required | Purpose | |---|---|---| | STRIPE_SECRET_KEY | Production | Server-side Stripe API key. Missing = DEV mode (payment intents simulated). | | NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY | Production | Client-side Stripe.js key. | | STRIPE_WEBHOOK_SECRET | Production | Signs the incoming Stripe webhook. Required to verify event authenticity. | | STRIPE_PRICE_DESIGNER_MEMBERSHIP | Web Designer feature | Stripe Price id for the designer membership product. |
| Var | Required | Purpose | |---|---|---| | RESEND_API_KEY | Production | Resend API key. Missing = console-log emails (DEV mode); in production sending throws instead of silently dropping. | | RESEND_FROM | Optional | Default From header on all transactional emails. Defaults to Restora 360 <donotreply@restora360.com>. Can be overridden per-chain via white-label. | | RESEND_REPLY_TO | Optional | Default Reply-To — the From address is an unattended no-reply box. |
Cron
| Var | Required | Purpose | |---|---|---| | CRON_SECRET | Production | Shared secret in the x-cron-secret header. Guards every /api/cron/* endpoint. Defaults to dev-cron-secret if unset. |
AI features
| Var | Required | Purpose | |---|---|---| | ANTHROPIC_API_KEY | AI features | Powers the menu writer, SEO assistant, blog generator. Missing = AI features degrade to deterministic templates. | | PEXELS_API_KEY | Food gallery | Stock-photo search for the media library. | | UNSPLASH_ACCESS_KEY | Food gallery | Alternative stock-photo source. |