Environment variables

Everything FlowRunner reads from the environment, split into the variables it cannot start without and the optional ones that each switch on a feature. Set these in your host's environment settings (Vercel project settings, a .env file, container secrets — wherever your platform reads them).

How validation works

packages/core/src/env.ts is the single source of truth. At boot — via the instrumentation register() hook — the app calls validateEnv(), which:

• logs an error for each missing required variable, naming exactly which ones — but does not throw, so the app still starts;
• warns to the log for each missing optional variable, then keeps running with that feature disabled.

So a misconfigured deploy is loud about the essentials in the boot logs — check them on first start — while an optional feature you chose not to use only ever logs a warning.

Required

AUTH_SECRET and MONGODB_URI are the two the validator checks — the app can't do anything useful without them. AUTH_URL and AUTH_TRUST_HOST are strongly recommended for any real deploy (see the note below).

Variable	Purpose	How to generate
AUTH_SECRET	Signs the Auth.js session JWTs.	openssl rand -base64 32
MONGODB_URI	The MongoDB connection string — the app's only datastore.	From Atlas or your Mongo host
AUTH_URL	The public base URL of the deploy, e.g. https://app.example.com. Strongly recommended (correct Auth.js behaviour behind a proxy); not checked by the validator.	Your deployed URL
AUTH_TRUST_HOST	Set to true when running behind a proxy or a hosted platform (Vercel, most containers). Strongly recommended (correct Auth.js behaviour behind a proxy); not checked by the validator.	true

NOTE

validateEnv() only knows about AUTH_SECRET and MONGODB_URI — a missing one is logged as an error at boot (the app still starts). AUTH_URL and AUTH_TRUST_HOST are strongly recommended (correct Auth.js behaviour behind a proxy) but aren't checked by the validator — set all four for any real deploy, or authentication will misbehave.

Optional

Each of these enables one feature. Leave it unset and that feature is simply off — the app logs a one-line warning ([env] <VAR> not set — <feature> disabled) and continues.

Variable	Enables	How to generate
SECRETS_KEY	The encrypted per-workspace secrets vault. Must be 32 bytes.	openssl rand -base64 32
CRON_SECRET	Scheduled flow triggers (the /api/cron/tick endpoint).	openssl rand -hex 32
RESEND_API_KEY + EMAIL_FROM	Outbound email — the Email node and workspace invites.	RESEND_API_KEY from the Resend dashboard; EMAIL_FROM is a verified sender like FlowRunner <hello@yourdomain.com>
FLOWRUNNER_TRUSTED_PUBLISHER_KEYS	Additional publisher keys allowed to sign installable components. Comma-separated base64 DER (SPKI). FlowRunner's own key is trusted by default, so the first-party nodes work with this unset — setting it adds to the list rather than replacing it.	The public key from your own publisher keypair
FLOWRUNNER_PUBLIC_ENV	Comma-separated names of environment variables that flows may read via ${env.NAME}. Empty by default: a flow can read no server environment variable unless you list it here. Server secrets (SECRETS_KEY, MONGODB_URI, AUTH_SECRET, cron/publisher keys) are hard-denied and never resolve even if listed.	PUBLIC_REGION,APP_ENV
FLOWRUNNER_TRUST_FIRST_PARTY	Set to false to refuse FlowRunner's own publisher key. Every first-party node then stops installing, and its flow nodes pass through doing nothing — only do this if you publish a replacement set yourself.	false
NEXT_PUBLIC_COMPONENTS_URL	Where the components/catalog server is served from. Defaults to http://127.0.0.1:5500 (the local dev server).	https://components.yourdomain.com

Notes on the optional trio

• SECRETS_KEY encrypts the secrets vault at rest. Without it, workspace secrets can't be stored. Treat this key like a database password — and back it up separately from the database, because rotating or losing it strands every existing secret. See Backup & restore.
• CRON_SECRET guards the scheduler's tick endpoint. Without it, the endpoint is fail-closed (returns 401) and no schedule ever fires. See Scheduled triggers wiring.
• RESEND_API_KEY turns on email delivery via Resend. If EMAIL_FROM is omitted, the app falls back to a default Resend onboarding sender, which is fine for testing but not for production. See Email node.

Generating secrets

# 32-byte base64 — use for AUTH_SECRET and SECRETS_KEY
openssl rand -base64 32

# 64-char hex — use for CRON_SECRET
openssl rand -hex 32

TIP

Generate a fresh value for each secret rather than reusing one across variables. They protect different things: session signing, the secrets vault, and the cron endpoint.

See also

• Self-hosting overview
• First deploy
• Scheduled triggers wiring
• Backup & restore