> ## Documentation Index
> Fetch the complete documentation index at: https://docs.risklegion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> Complete reference for all environment variables

## Backend Variables

### Required

| Variable                    | Description                  | Example                   |
| --------------------------- | ---------------------------- | ------------------------- |
| `SUPABASE_URL`              | Supabase project URL         | `https://xxx.supabase.co` |
| `SUPABASE_ANON_KEY`         | Supabase anonymous key       | `eyJhbGciOiJIUzI1...`     |
| `SUPABASE_SERVICE_ROLE_KEY` | Supabase service role key    | `eyJhbGciOiJIUzI1...`     |
| `DATABASE_URL`              | PostgreSQL connection string | `postgresql://...`        |
| `SECRET_KEY`                | Application secret (256-bit) | `abc123...`               |

### Application

| Variable      | Description         | Default       |
| ------------- | ------------------- | ------------- |
| `ENVIRONMENT` | Environment name    | `development` |
| `DEBUG`       | Enable debug mode   | `false`       |
| `APP_VERSION` | Application version | `1.0.0`       |
| `LOG_LEVEL`   | Logging level       | `INFO`        |

### Redis

| Variable    | Description          | Default                  |
| ----------- | -------------------- | ------------------------ |
| `REDIS_URL` | Redis connection URL | `redis://localhost:6379` |

### Security

| Variable              | Description          | Default                 |
| --------------------- | -------------------- | ----------------------- |
| `ALLOWED_ORIGINS`     | CORS allowed origins | `http://localhost:5173` |
| `RATE_LIMIT_REQUESTS` | Requests per window  | `100`                   |
| `RATE_LIMIT_WINDOW`   | Window in seconds    | `60`                    |

### Monitoring

| Variable     | Description           | Default |
| ------------ | --------------------- | ------- |
| `SENTRY_DSN` | Sentry error tracking | (none)  |

## Frontend Variables

All frontend variables must be prefixed with `VITE_`.

| Variable                 | Description            | Example                      |
| ------------------------ | ---------------------- | ---------------------------- |
| `VITE_SUPABASE_URL`      | Supabase project URL   | `https://xxx.supabase.co`    |
| `VITE_SUPABASE_ANON_KEY` | Supabase anonymous key | `eyJhbGciOiJIUzI1...`        |
| `VITE_API_URL`           | Backend API URL        | `https://api.risklegion.com` |
| `VITE_ENVIRONMENT`       | Environment name       | `production`                 |
| `VITE_SENTRY_DSN`        | Sentry DSN (optional)  | `https://...`                |

## Example Files

### backend/.env.example

```bash theme={null}
# Supabase
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
DATABASE_URL=postgresql://postgres:password@db.your-project.supabase.co:5432/postgres

# Application
SECRET_KEY=generate-a-secure-256-bit-key
ENVIRONMENT=development
DEBUG=true
APP_VERSION=1.0.0

# Redis
REDIS_URL=redis://localhost:6379

# CORS
ALLOWED_ORIGINS=http://localhost:5173

# Rate Limiting
RATE_LIMIT_REQUESTS=100
RATE_LIMIT_WINDOW=60

# Monitoring (optional)
SENTRY_DSN=
```

### frontend/.env.example

```bash theme={null}
VITE_SUPABASE_URL=https://your-project.supabase.co
VITE_SUPABASE_ANON_KEY=your-anon-key
VITE_API_URL=http://localhost:8000
```

## Environment-Specific Values

### Development

```bash theme={null}
ENVIRONMENT=development
DEBUG=true
ALLOWED_ORIGINS=http://localhost:5173
VITE_API_URL=http://localhost:8000
```

### Staging

```bash theme={null}
ENVIRONMENT=staging
DEBUG=false
ALLOWED_ORIGINS=https://staging.risklegion.com
VITE_API_URL=https://api-test.risklegion.com
```

### Production

```bash theme={null}
ENVIRONMENT=production
DEBUG=false
ALLOWED_ORIGINS=https://app.risklegion.com
VITE_API_URL=https://api.risklegion.com
```

## Generating Secret Key

```bash theme={null}
# Python
python -c "import secrets; print(secrets.token_hex(32))"

# OpenSSL
openssl rand -hex 32

# Node.js
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
```

## Security Best Practices

<Warning>
  Never commit `.env` files to version control. Always use `.env.example` as a template.
</Warning>

<AccordionGroup>
  <Accordion title="Key Management">
    * Store secrets in environment variables, not code
    * Use different keys for each environment
    * Rotate keys periodically
    * Never log secret values
  </Accordion>

  <Accordion title="Access Control">
    * Limit who has access to production secrets
    * Use secret management tools (AWS Secrets Manager, Vault)
    * Audit secret access
  </Accordion>

  <Accordion title="CI/CD">
    * Use GitHub Secrets for CI/CD
    * Don't echo secrets in logs
    * Mask secrets in output
  </Accordion>
</AccordionGroup>

## Validating Configuration

### Backend

The application validates required variables on startup:

```python theme={null}
from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    SUPABASE_URL: str
    SUPABASE_ANON_KEY: str
    SECRET_KEY: str
    
    class Config:
        env_file = ".env"

# Raises ValidationError if missing
settings = Settings()
```

### Frontend

Check Vite loads variables correctly:

```typescript theme={null}
console.log('API URL:', import.meta.env.VITE_API_URL);
```