Environment variables
Environment values are the deployment boundary. Keep secrets in Cloudflare Worker secrets; do not commit them to the application or website repository.
Bindings such as D1, R2, KV, Durable Objects, Workflows, Workers AI, Browser Run, Containers, and email delivery are platform resources rather than string values. Environment variables configure how Discoflare uses those bindings; they do not create a missing binding.
Required values
| Variable | Setup | Purpose and verification |
|---|---|---|
AUTH_SECRET | Generated by the guided installer; required manually | Encrypts sessions and workspace-managed provider secrets. Use a random value of at least 32 characters and keep it stable. Verify by signing out and back in after setup. |
PUBLIC_ORIGIN | Usually derived; optional override | Exact external origin, with scheme and no path, when automatic request-origin detection is not appropriate. Verify that sign-in, API requests, and WebSockets work from that origin. |
ADMIN_EMAIL | Collected by the guided installer; required manually | Intended first owner. Before setup, /api/setup/health returns a masked owner hint. |
ADMIN_SETUP_TOKEN | Generated by the guided installer; required manually | Private owner claim. Use a random value of at least 32 characters and verify it completes setup once and cannot create another owner afterward. |
Rotating AUTH_SECRET invalidates sessions and makes provider secrets encrypted in D1 unreadable. Replace those stored provider secrets after an intentional rotation.
Initial workspace and branding
| Variable | Default | Behavior |
|---|---|---|
APP_NAME | Discoflare | Name beside the fixed Discoflare mark and in the browser title. |
APP_TITLE | Deployment-specific | Sign-in headline. Use \n for a deliberate line break. |
APP_SUBTITLE | Deployment-specific | Supporting sign-in copy. |
ADMIN_WORKSPACE | HQ | First workspace name for manual or unattended bootstrap. |
AUTH_REGISTRATION_MODE | invite_only | Initial policy. After the authentication settings row exists, the owner controls the policy in the UI. |
APP_NAME, APP_TITLE, APP_SUBTITLE, and the registration mode are configuration, not secrets.
Legacy unattended bootstrap
| Variable | Purpose |
|---|---|
ADMIN_PASSWORD | With ADMIN_EMAIL, creates the owner automatically when the database is empty. Prefer the setup claim for interactive installations. |
ADMIN_NAME | Display name for unattended bootstrap. |
ADMIN_HANDLE | Optional handle for unattended bootstrap. |
Both the guided installer and the manual GitHub method should use the private setup claim so the password is chosen on the workspace origin.
Authentication providers
| Variables | Provider |
|---|---|
GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET | GitHub |
TWITTER_CLIENT_ID, TWITTER_CLIENT_SECRET | X |
TELEGRAM_CLIENT_ID, TELEGRAM_CLIENT_SECRET | Telegram |
TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY | Cloudflare Turnstile |
The owner can normally configure these in Workspace Settings → Authentication. Values supplied by the deployment override the corresponding workspace values and cannot be revealed in the UI.
Provider callback URLs always use the deployed workspace origin, not discoflare.com:
https://chat.example.com/api/auth/callback/github
https://chat.example.com/api/auth/callback/twitter
https://chat.example.com/api/auth/callback/telegram
Verification and password-reset email
| Variable | Purpose |
|---|---|
EMAIL_FROM | Verified login-email sender. |
EMAIL_FROM_NAME | Human-readable sender name. |
On Cloudflare, a manual deployment additionally requires an onboarded Email Service domain and a restricted Worker send_email binding named EMAIL. Guided installations use the primary Worker's managed mail binding for authentication email unless a dedicated EMAIL binding is present.
New email signup requires the sender, delivery binding, Turnstile, email login, and either open registration or an Invite. Existing verified users can sign in without sending an email.
Workspace mail
| Variable or binding | Purpose |
|---|---|
MAIL_DOMAIN | Domain accepted by the workspace mailboxes, such as chat.example.com. |
MAIL_ZONE_ID | Cloudflare zone that owns the mail routing configuration. |
MAIL_APP_HOSTNAME | Public Discoflare hostname that receives routed mail. |
MAIL_DEFAULT_LOCAL_PART | First mailbox local part; defaults to inbox. |
MAIL_EMAIL | Restricted send_email binding used by a mail-enabled workspace. |
DISCOFLARE_PRIMARY | Marks the first managed workspace in the account. |
DISCOFLARE_MAIL_ROUTES | Reserved routing table; [] in the one-workspace base release. |
The guided installer supplies the domain variables and direct mail binding only when Workspace email is enabled. The primary Discoflare Worker owns the zone catch-all. Mailbox local parts remain D1 records: adding or disabling a Mailbox does not change DNS or redeploy the Worker.
A mail-enabled deployment must configure its Email Routing rule, Email Sending domain, and MAIL_EMAIL binding together. Omitting MAIL_EMAIL leaves workspace mail disabled without affecting text chat. The base installer rejects a second mail-enabled workspace in the same zone.
Web Push
| Variable | Purpose |
|---|---|
VAPID_SUBJECT | Contact URI, normally mailto:admin@example.com. |
VAPID_PUBLIC_KEY | Public half of one stable VAPID pair. |
VAPID_PRIVATE_KEY | Secret half of the same pair. |
Generate the pair once with pnpm vapid:generate from the application repository. Rotating either key invalidates existing browser subscriptions.
RealtimeKit huddles
Discoflare Admin creates the RealtimeKit app and Discoflare presets with its managed OAuth credential or Account Admin Token. The broad credential stays in Admin. An Admin-created workspace uses the DISCOFLARE_ADMIN service binding and a narrow DISCOFLARE_ADMIN_CAPABILITY for fixed meeting operations.
| Variable | Purpose |
|---|---|
REALTIMEKIT_ACCOUNT_ID | Cloudflare account containing RealtimeKit. |
REALTIMEKIT_APP_ID | RealtimeKit application. |
REALTIMEKIT_API_KEY | Direct API-token credential for repository deployments only. |
REALTIMEKIT_PRESET_VOICE | Voice preset; defaults to voice. |
REALTIMEKIT_PRESET_AV | Optional audio/video preset; defaults to group_call_host. |
REALTIMEKIT_API_SECRET | Legacy Basic Auth path only. |
The owner can instead configure RealtimeKit in Workspace Settings → Huddles. The saved token is encrypted with AUTH_SECRET. Deployment values override saved settings.
Agent model
AGENT_MODEL is an optional public Worker variable. Agent profiles may override it with another model ID supported by the deployment's Workers AI binding. The default Cloudflare Agent runtime does not require an OpenAI or OpenRouter key.
Website installer environment
These server-only values configure the guided installer running at discoflare.com; they are not copied into installed workspaces:
| Variable | Purpose |
|---|---|
NUXT_CLOUDFLARE_OAUTH_CLIENT_ID | Public identifier for the single PKCE OAuth client used by setup and Admin sign-in. |
NUXT_INSTALLER_SESSION_PASSWORD | Random 32-character-or-longer secret that encrypts temporary installer sessions. |
NUXT_INSTALLER_ORIGIN | Exact public installer origin, normally https://discoflare.com. |
NUXT_ADMIN_INSTALLER_MANIFEST_URL | Trusted Discoflare Admin release manifest used by the bootstrap. |
OAuth scopes are fixed in the website source because they must stay aligned with the registered Cloudflare OAuth client. The website repository can remain private. Publishing the rendered site and documentation does not expose these runtime values, provided secrets remain in Cloudflare Worker secrets rather than source control or client-side configuration.