[{"data":1,"prerenderedAt":725},["ShallowReactive",2],{"-docs-reference-env-vars":3,"-docs-reference-env-vars-surround":718},{"id":4,"title":5,"body":6,"description":708,"extension":709,"links":710,"meta":711,"navigation":712,"path":714,"seo":715,"stem":716,"__hash__":717},"docs\u002Fdocs\u002F4.reference\u002F2.env-vars.md","Environment reference",{"type":7,"value":8,"toc":696},"minimark",[9,25,30,138,142,246,250,301,305,390,396,400,475,479,602,609,613,673,677],[10,11,12,13,17,18,17,21,24],"p",{},"All server config is env-driven. Source of truth: ",[14,15,16],"code",{},"server\u002Fsrc\u002Fhttp\u002Fenv.ts",", ",[14,19,20],{},"storage.ts",[14,22,23],{},"ai-adjudicator.ts",".",[26,27,29],"h2",{"id":28},"deployment-database","Deployment & database",[31,32,33,52],"table",{},[34,35,36],"thead",{},[37,38,39,43,46,49],"tr",{},[40,41,42],"th",{},"Variable",[40,44,45],{},"Default",[40,47,48],{},"Req?",[40,50,51],{},"Purpose",[53,54,55,80,100,121],"tbody",{},[37,56,57,63,68,71],{},[58,59,60],"td",{},[14,61,62],{},"DEPLOYMENT_MODE",[58,64,65],{},[14,66,67],{},"saas",[58,69,70],{},"–",[58,72,73,76,77,79],{},[14,74,75],{},"onprem"," (single-org, license-gated) or ",[14,78,67],{}," (multi-tenant).",[37,81,82,87,90,93],{},[58,83,84],{},[14,85,86],{},"DATABASE_URL",[58,88,89],{},"dev localhost",[58,91,92],{},"✔",[58,94,95,96,99],{},"Postgres connection string. BYO or the bundled ",[14,97,98],{},"postgres"," service.",[37,101,102,107,112,114],{},[58,103,104],{},[14,105,106],{},"MIGRATE_ON_BOOT",[58,108,109],{},[14,110,111],{},"1",[58,113,70],{},[58,115,116,117,120],{},"Run Drizzle migrations at startup. ",[14,118,119],{},"0"," to skip.",[37,122,123,128,133,135],{},[58,124,125],{},[14,126,127],{},"PORT",[58,129,130],{},[14,131,132],{},"8080",[58,134,70],{},[58,136,137],{},"Listen port (baked into the image).",[26,139,141],{"id":140},"licensing-on-prem","Licensing (on-prem)",[31,143,144,156],{},[34,145,146],{},[37,147,148,150,152,154],{},[40,149,42],{},[40,151,45],{},[40,153,48],{},[40,155,51],{},[53,157,158,177,192,212,229],{},[37,159,160,165,167,170],{},[58,161,162],{},[14,163,164],{},"LICENSE_JWT",[58,166,70],{},[58,168,169],{},"on-prem",[58,171,172,173,24],{},"The signed license JWT. Absent ⇒ ",[174,175,176],"strong",{},"read-only",[37,178,179,184,187,189],{},[58,180,181],{},[14,182,183],{},"LICENSE_PUBLIC_KEY",[58,185,186],{},"embedded",[58,188,70],{},[58,190,191],{},"base64url raw Ed25519 key overriding the embedded one (rotation).",[37,193,194,199,204,206],{},[58,195,196],{},[14,197,198],{},"LICENSE_JWKS_URL",[58,200,201],{},[14,202,203],{},"off",[58,205,70],{},[58,207,208,209,211],{},"Opt-in JWKS rotation refresh. ",[14,210,203],{},"\u002Fempty = fully air-gapped.",[37,213,214,219,224,226],{},[58,215,216],{},[14,217,218],{},"ONPREM_ORG_SLUG",[58,220,221],{},[14,222,223],{},"default",[58,225,70],{},[58,227,228],{},"Slug of the single org created at first boot.",[37,230,231,236,241,243],{},[58,232,233],{},[14,234,235],{},"ONPREM_ORG_NAME",[58,237,238],{},[14,239,240],{},"On-Prem",[58,242,70],{},[58,244,245],{},"Display name of that org.",[26,247,249],{"id":248},"telemetry","Telemetry",[31,251,252,262],{},[34,253,254],{},[37,255,256,258,260],{},[40,257,42],{},[40,259,45],{},[40,261,51],{},[53,263,264,286],{},[37,265,266,271,276],{},[58,267,268],{},[14,269,270],{},"TELEMETRY",[58,272,273],{},[14,274,275],{},"on",[58,277,278,279,282,283,285],{},"Daily+boot POST of version\u002Fusage-rollups\u002Ferror-counts (",[174,280,281],{},"never"," findings). ",[14,284,203],{}," = zero outbound.",[37,287,288,293,298],{},[58,289,290],{},[14,291,292],{},"TELEMETRY_URL",[58,294,295],{},[14,296,297],{},"…\u002Fv1\u002Ftelemetry",[58,299,300],{},"Where telemetry is sent when on.",[26,302,304],{"id":303},"auth-web","Auth & web",[31,306,307,319],{},[34,308,309],{},[37,310,311,313,315,317],{},[40,312,42],{},[40,314,45],{},[40,316,48],{},[40,318,51],{},[53,320,321,340,358,372],{},[37,322,323,328,331,333],{},[58,324,325],{},[14,326,327],{},"BETTER_AUTH_SECRET",[58,329,330],{},"dev secret",[58,332,92],{},[58,334,335,336,339],{},"Session signing secret. ",[174,337,338],{},"Set it"," (a warning is logged otherwise).",[37,341,342,347,352,355],{},[58,343,344],{},[14,345,346],{},"BETTER_AUTH_URL",[58,348,349],{},[14,350,351],{},"http:\u002F\u002Flocalhost:8080",[58,353,354],{},"✔*",[58,356,357],{},"Public URL (cookies \u002F redirects \u002F CSRF origin). Set to your real hostname.",[37,359,360,365,367,369],{},[58,361,362],{},[14,363,364],{},"BETTER_AUTH_TRUSTED_ORIGINS",[58,366,70],{},[58,368,70],{},[58,370,371],{},"Extra comma-separated trusted origins.",[37,373,374,379,385,387],{},[58,375,376],{},[14,377,378],{},"WEB_ROOT",[58,380,381,384],{},[14,382,383],{},"\u002Fapp\u002Fweb"," (image)",[58,386,70],{},[58,388,389],{},"Static SPA dir served same-origin. Set by the image; unset ⇒ API only.",[10,391,392,395],{},[14,393,394],{},"*"," required for any deployment users reach over a real hostname.",[26,397,399],{"id":398},"storage","Storage",[31,401,402,412],{},[34,403,404],{},[37,405,406,408,410],{},[40,407,42],{},[40,409,45],{},[40,411,51],{},[53,413,414,433,444,460],{},[37,415,416,421,426],{},[58,417,418],{},[14,419,420],{},"ARTIFACTS_DIR",[58,422,423],{},[14,424,425],{},".artifacts",[58,427,428,429,432],{},"On-disk artifact store (used when ",[14,430,431],{},"S3_BUCKET"," is unset).",[37,434,435,439,441],{},[58,436,437],{},[14,438,431],{},[58,440,70],{},[58,442,443],{},"Set to use S3-compatible object storage (MinIO\u002FR2\u002FS3) for artifacts.",[37,445,446,455,457],{},[58,447,448,451,452],{},[14,449,450],{},"S3_ENDPOINT"," \u002F ",[14,453,454],{},"S3_REGION",[58,456,70],{},[58,458,459],{},"S3 endpoint \u002F region.",[37,461,462,470,472],{},[58,463,464,451,467],{},[14,465,466],{},"S3_ACCESS_KEY_ID",[14,468,469],{},"S3_SECRET_ACCESS_KEY",[58,471,70],{},[58,473,474],{},"S3 credentials.",[26,476,478],{"id":477},"ai-dedupe","AI dedupe",[31,480,481,491],{},[34,482,483],{},[37,484,485,487,489],{},[40,486,42],{},[40,488,45],{},[40,490,51],{},[53,492,493,505,520,535,550,565,584],{},[37,494,495,500,502],{},[58,496,497],{},[14,498,499],{},"AI_DEDUPE_API_KEY",[58,501,70],{},[58,503,504],{},"BYO key enabling server-run AI dedupe (the paid lever). Unset ⇒ heuristics-only.",[37,506,507,512,517],{},[58,508,509],{},[14,510,511],{},"AI_DEDUPE_BASE_URL",[58,513,514],{},[14,515,516],{},"https:\u002F\u002Fapi.anthropic.com",[58,518,519],{},"Messages endpoint.",[37,521,522,527,532],{},[58,523,524],{},[14,525,526],{},"AI_DEDUPE_MODEL",[58,528,529],{},[14,530,531],{},"claude-haiku-4-5",[58,533,534],{},"Cheap classification model.",[37,536,537,542,547],{},[58,538,539],{},[14,540,541],{},"AI_DEDUPE_TIMEOUT_MS",[58,543,544],{},[14,545,546],{},"20000",[58,548,549],{},"Per-request adjudication timeout; batched requests scale it with pair count.",[37,551,552,557,562],{},[58,553,554],{},[14,555,556],{},"AI_DEDUPE_THRESHOLD",[58,558,559],{},[14,560,561],{},"0.15",[58,563,564],{},"Heuristic-confidence floor before an AI call fires.",[37,566,567,572,577],{},[58,568,569],{},[14,570,571],{},"AI_DEDUPE_DAILY_CAP",[58,573,574],{},[14,575,576],{},"500",[58,578,579,580,583],{},"Per-org\u002Fday cap on AI-adjudicated ",[174,581,582],{},"pairs"," (a batched request meters its pair count).",[37,585,586,591,596],{},[58,587,588],{},[14,589,590],{},"AI_DEDUPE_BATCH_SIZE",[58,592,593],{},[14,594,595],{},"20",[58,597,598,599,601],{},"Max candidate pairs per adjudication request (clamped 1–20; ",[14,600,111],{}," disables batching; ingest evaluates at most 12 candidates per finding).",[603,604,605,606,608],"note",{},"Upgrades that change adjudication prompt semantics bump an internal prompt version folded into the pair-decision cache key: previously cached pairs are re-adjudicated once, so expect temporarily elevated AI-dedupe usage after such an upgrade until the cache refills (bounded by ",[14,607,571],{},").",[26,610,612],{"id":611},"integrations-limits","Integrations & limits",[31,614,615,625],{},[34,616,617],{},[37,618,619,621,623],{},[40,620,42],{},[40,622,45],{},[40,624,51],{},[53,626,627,643,658],{},[37,628,629,634,636],{},[58,630,631],{},[14,632,633],{},"GITHUB_WEBHOOK_SECRET",[58,635,70],{},[58,637,638,639,642],{},"Optional: enables ",[14,640,641],{},"POST \u002Fv1\u002Fwebhooks\u002Fgithub"," (PR → incremental campaign).",[37,644,645,650,655],{},[58,646,647],{},[14,648,649],{},"RATE_LIMIT_CAPACITY",[58,651,652],{},[14,653,654],{},"120",[58,656,657],{},"Per-org token-bucket default capacity.",[37,659,660,665,670],{},[58,661,662],{},[14,663,664],{},"RATE_LIMIT_REFILL_PER_SEC",[58,666,667],{},[14,668,669],{},"4",[58,671,672],{},"Per-org token-bucket refill. (Per-bucket overrides: `RATE_LIMIT_\u003CCLAIM",[26,674,676],{"id":675},"next-steps","Next steps",[678,679,680,689],"ul",{},[681,682,683,688],"li",{},[684,685,687],"a",{"href":686},"\u002Fdocs\u002Fdeploy\u002Fdeployment-modes","Deployment modes"," — how these vars compose per mode.",[681,690,691,695],{},[684,692,694],{"href":693},"\u002Fdocs\u002Fdeploy\u002Fonprem","On-prem deploy"," — a worked example.",{"title":697,"searchDepth":698,"depth":698,"links":699},"",2,[700,701,702,703,704,705,706,707],{"id":28,"depth":698,"text":29},{"id":140,"depth":698,"text":141},{"id":248,"depth":698,"text":249},{"id":303,"depth":698,"text":304},{"id":398,"depth":698,"text":399},{"id":477,"depth":698,"text":478},{"id":611,"depth":698,"text":612},{"id":675,"depth":698,"text":676},"Every TheSpider server environment variable","md",null,{},{"icon":713},"i-lucide-sliders-horizontal","\u002Fdocs\u002Freference\u002Fenv-vars",{"title":5,"description":708},"docs\u002F4.reference\u002F2.env-vars","bAjIR5XfavFt85yqNeeKR9kSIsN9chIB0SozA8-6oHk",[719,710],{"title":720,"path":721,"stem":722,"description":723,"icon":724,"children":-1},"API reference","\u002Fdocs\u002Freference\u002Fapi","docs\u002F4.reference\u002F1.api","The client ↔ server API surface","i-lucide-code-xml",1783955419458]