---
title: Environment
description: Every environment variable Gitupcms reads.
---

Variables are read at runtime, so the same build works on any server.

| Variable | Required | What it does |
| --- | --- | --- |
| `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET` | Yes | GitHub OAuth app. Callback: `<BETTER_AUTH_URL>/api/auth/callback/github` |
| `BETTER_AUTH_SECRET` | Yes | Random 32+ characters (`openssl rand -base64 32`). Also encrypts integration and SMTP credentials |
| `BETTER_AUTH_URL` | Yes | The public URL of the CMS |
| `DB_PATH` | | SQLite file. Default `data/gitupcms.db` |
| `HOST`, `PORT` | | Where the Node server listens |
| `SMTP_URL`, `EMAIL_FROM` | | Sign-in code and comment emails through any SMTP server: `smtps://user:pass@host:465` or `smtp://user:pass@host:587`. Unset: emails go to the server log |
| `AI_BASE_URL`, `AI_API_KEY`, `AI_MODEL` | | Any OpenAI-compatible endpoint (OpenRouter, OpenAI, 9router). Powers Fix with AI, the AI Editor, translation and Gitupcms SEO |
| `AI_REASONING_EFFORT` | `high` | `low`, `medium` or `high`, sent as `reasoning_effort`; `none` sends nothing (for endpoints that reject it) |
| `PREVIEW_RUNNER` | | `1` runs `astro dev` for sites without a preview URL. It runs the site's own code on your server |
| `PLANS` | | `1` turns on the Preview, Solo, Team and Agency plans (Settings → Plan). Unset: every workspace has every feature |
| `SCRAPER_URL` | | The Google Maps scraper engine (`scraper/` in the repo), e.g. `http://127.0.0.1:8080`. Turns on **Create sites from Google Maps** |
| `SCRAPER_API_KEY` | | The engine's `SCRAPER_API_KEY`, sent as `X-API-Key` |
| `PREVIEW_DOCKER` | | A Node image, e.g. `node:24-bookworm-slim`: previews install and run in locked-down Docker containers (1 GB, 1 CPU, read-only root, only the site's folder mounted) instead of on the host |
| `PREVIEW_HOST` | | e.g. `https://*.preview.example.com`: the AI Editor shows pages with their scripts running (menus, carousels), each site on its own subdomain so its code can't reach the CMS. Point the wildcard DNS name at the server and have the reverse proxy send it, with a wildcard certificate, to `PREVIEW_PROXY_PORT`. Needs a preview URL or `PREVIEW_RUNNER`, and the instant preview off |
| `PREVIEW_PROXY_PORT` | | Where the live preview proxy listens (on `127.0.0.1`). Default `4322` |
| `PREVIEW_DIR` | | Where preview clones live. Default `~/.cache/gitupcms/previews` |
| `COMMENTS_GOOGLE_CLIENT_ID`, `COMMENTS_GOOGLE_CLIENT_SECRET` | | Commenter sign-in with Google (falls back to `GOOGLE_CLIENT_*`) |
| `COMMENTS_GITHUB_CLIENT_ID`, `COMMENTS_GITHUB_CLIENT_SECRET` | | Commenter sign-in with a second GitHub OAuth app |

:::warning
Changing `BETTER_AUTH_SECRET` signs everyone out, and S3/R2 integrations and SMTP passwords must be entered again.
:::

:::tip
The AI endpoint must be reachable from the server. A `localhost` URL on your laptop will not work in production.
:::