Environment Variables

Backend Variables

Required

Variable	Description	Example
`SUPABASE_URL`	Supabase project URL	`https://xxx.supabase.co`
`SUPABASE_ANON_KEY`	Supabase anonymous key	`eyJhbGciOiJIUzI1...`
`SUPABASE_SERVICE_ROLE_KEY`	Supabase service role key	`eyJhbGciOiJIUzI1...`
`DATABASE_URL`	PostgreSQL connection string	`postgresql://...`
`SECRET_KEY`	Application secret (256-bit)	`abc123...`

Application

Variable	Description	Default
`ENVIRONMENT`	Environment name	`development`
`DEBUG`	Enable debug mode	`false`
`APP_VERSION`	Application version	`1.0.0`
`LOG_LEVEL`	Logging level	`INFO`

Redis

Variable	Description	Default
`REDIS_URL`	Redis connection URL	`redis://localhost:6379`

Security

Variable	Description	Default
`ALLOWED_ORIGINS`	CORS allowed origins	`http://localhost:5173`
`RATE_LIMIT_REQUESTS`	Requests per window	`100`
`RATE_LIMIT_WINDOW`	Window in seconds	`60`

Monitoring

Variable	Description	Default
`SENTRY_DSN`	Sentry error tracking	(none)

Frontend Variables

All frontend variables must be prefixed with VITE_.

Variable	Description	Example
`VITE_SUPABASE_URL`	Supabase project URL	`https://xxx.supabase.co`
`VITE_SUPABASE_ANON_KEY`	Supabase anonymous key	`eyJhbGciOiJIUzI1...`
`VITE_API_URL`	Backend API URL	`https://api.risklegion.com`
`VITE_ENVIRONMENT`	Environment name	`production`
`VITE_SENTRY_DSN`	Sentry DSN (optional)	`https://...`

Example Files

backend/.env.example

# Supabase
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
DATABASE_URL=postgresql://postgres:password@db.your-project.supabase.co:5432/postgres

# Application
SECRET_KEY=generate-a-secure-256-bit-key
ENVIRONMENT=development
DEBUG=true
APP_VERSION=1.0.0

# Redis
REDIS_URL=redis://localhost:6379

# CORS
ALLOWED_ORIGINS=http://localhost:5173

# Rate Limiting
RATE_LIMIT_REQUESTS=100
RATE_LIMIT_WINDOW=60

# Monitoring (optional)
SENTRY_DSN=

frontend/.env.example

VITE_SUPABASE_URL=https://your-project.supabase.co
VITE_SUPABASE_ANON_KEY=your-anon-key
VITE_API_URL=http://localhost:8000

Environment-Specific Values

Development

ENVIRONMENT=development
DEBUG=true
ALLOWED_ORIGINS=http://localhost:5173
VITE_API_URL=http://localhost:8000

Staging

ENVIRONMENT=staging
DEBUG=false
ALLOWED_ORIGINS=https://staging.risklegion.com
VITE_API_URL=https://api-test.risklegion.com

Production

ENVIRONMENT=production
DEBUG=false
ALLOWED_ORIGINS=https://app.risklegion.com
VITE_API_URL=https://api.risklegion.com

Generating Secret Key

# Python
python -c "import secrets; print(secrets.token_hex(32))"

# OpenSSL
openssl rand -hex 32

# Node.js
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

Security Best Practices

Never commit .env files to version control. Always use .env.example as a template.

Key Management

Store secrets in environment variables, not code
Use different keys for each environment
Rotate keys periodically
Never log secret values

Access Control

Limit who has access to production secrets
Use secret management tools (AWS Secrets Manager, Vault)
Audit secret access

CI/CD

Use GitHub Secrets for CI/CD
Don’t echo secrets in logs
Mask secrets in output

Validating Configuration

Backend

The application validates required variables on startup:

from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    SUPABASE_URL: str
    SUPABASE_ANON_KEY: str
    SECRET_KEY: str
    
    class Config:
        env_file = ".env"

# Raises ValidationError if missing
settings = Settings()

Frontend

Check Vite loads variables correctly:

console.log('API URL:', import.meta.env.VITE_API_URL);

​Backend Variables

​Required

​Application

​Redis

​Security

​Monitoring

​Frontend Variables

​Example Files

​backend/.env.example

​frontend/.env.example

​Environment-Specific Values

​Development

​Staging

​Production

​Generating Secret Key

​Security Best Practices

​Validating Configuration

​Backend

​Frontend

Backend Variables

Required

Application

Redis

Security

Monitoring

Frontend Variables

Example Files

backend/.env.example

frontend/.env.example

Environment-Specific Values

Development

Staging

Production

Generating Secret Key

Security Best Practices

Validating Configuration

Backend

Frontend