Configuration

All configuration is via environment variables. For Docker, put them in .env (copied from .env.example). For native dev, use .env.local.

Required

Variable	Description
`AUTH_SECRET`	Random secret used to sign JWT sessions. Generate with `openssl rand -base64 32`.
`RESEND_API_KEY`	API key from resend.com. Used for reminder emails and password reset. Free tier (100/day, 3,000/month) is sufficient.
`OPENROUTER_API_KEY`	API key from openrouter.ai. Used for AI product search and gift suggestions. Free tier available.
`CRON_SECRET`	Bearer token that protects the `/api/cron/reminders` endpoint. Generate with `openssl rand -hex 32`.

Variable	Description
`DATABASE_URL`	PostgreSQL connection string. Leave blank when using Docker Compose — the compose file sets this automatically to the `db` service. For native dev or Neon: `postgresql://user:pass@host:5432/dbname`. Add `?sslmode=require` for Neon.

Variable	Default	Description
`OPENROUTER_MODEL`	`meta-llama/llama-3.3-70b-instruct:free`	Override the LLM model. Any model on openrouter.ai/models works. Free alternatives: `deepseek/deepseek-chat-v3.1:free`, `qwen/qwen-2.5-72b-instruct:free`.
`EBAY_APP_ID`	—	eBay Developer Portal App ID. Enables the eBay Browse API fallback for product search. Without it, only OpenRouter results are used.
`ALLOWED_EMAIL`	—	If set, only this email address can register. Useful for locking down a personal instance. Leave blank to allow any email.
`STORAGE_STRATEGY`	`local`	Where to store photo uploads. `local` saves files to `public/uploads/` (use a Docker volume for persistence). `base64` stores the file as a data URI in the DB column — safe for serverless/Vercel but bloats the DB.
`CRON_INTERVAL_SECONDS`	`86400`	How often the `cron` Docker sidecar hits `/api/cron/reminders`. Default is once daily.
`EMAIL_FROM`	`onboarding@resend.dev`	The From address used for reminder and password-reset emails. A custom domain requires Resend verification.
`NEXTAUTH_URL`	—	Required in some Auth.js deployments. Set to your public URL if login redirects break (e.g. `https://noted.example.com`).

Free models are aggressively rate-limited (a few requests per minute per account). There are two distinct sources of 429 errors:

Per-account limits — your own quota. Fix: upgrade your OpenRouter plan or switch model.
Upstream provider limits — affect all OpenRouter users at once (e.g. Google AI Studio for Gemma models). These appear as Provider returned error in the response body. Fix: switch to a different free model via OPENROUTER_MODEL.

The product search orchestrator (lib/products/search.ts) detects rate-limit-shaped errors and falls through to eBay automatically.

The docker-compose.yml sets DATABASE_URL for the app and migrate services automatically:

DATABASE_URL=postgresql://noted:noted@db:5432/noted

You do not need to set this in .env when using compose. All other variables must be in .env.