Skip to Content
DeploymentEnvironment Variables

Environment Variables

Each application in the Siyahfy platform requires its own set of environment variables. This page documents every variable used across all apps. Never commit real secrets to version control — use .env.local files (which are git-ignored) for sensitive values.

app.siyahfy.com (Vendor Dashboard)

File: app.siyahfy.com/.env.local

VariableRequiredDescription
WEBSITE_NAMEYesDisplay name for the platform (e.g., Siyahfy)
ADMINURLYesURL of the backend API server
DOCS_WEBSITE_NAMENoDisplay name for the documentation site
FRONTEND_URLYesPublic-facing URL of the vendor dashboard
COMPANY_EMAILYesContact email shown to users
BACKBLAZE_URLYesBackblaze B2 public bucket URL for file storage
PG_USERYesPostgreSQL database username
PG_HOSTYesPostgreSQL database host
PG_DATABASEYesPostgreSQL database name
PG_PASSWORDYesPostgreSQL database password
PG_PORTYesPostgreSQL database port (default: 5432)
NEXT_PUBLIC_APP_URLYesPublic URL of the vendor dashboard (client-side)
NEXT_PUBLIC_COOKIE_DOMAINYesCookie domain scope (e.g., .siyahfy.com for cross-subdomain auth)
NEXT_PUBLIC_STORE_URLYesPublic URL of the storefront app
NEXT_PUBLIC_GOOGLE_CLIENT_IDYesGoogle OAuth client ID for social login
NEXT_PUBLIC_EDITOR_URLYesPublic URL of the theme editor
NEXT_PUBLIC_STUDIO_URLYesPublic URL of the developer studio
RAZORPAY_KEY_IDYesRazorpay test/sandbox API key
LIVE_RAZORPAY_KEY_IDYesRazorpay live/production API key
FREE_TRIAL_DAYSYesNumber of free trial days for new signups

backend.siyahfy.com (Backend API)

File: backend.siyahfy.com/.env

Core Settings

VariableRequiredDescription
PORTYesPort the backend server listens on (default: 3003)
SECRET_KEYYesJWT signing secret for authentication tokens
DB_SECRET_KEYYesEncryption key for sensitive data stored in the database
BACKEND_URLYesPublic URL of the backend API
FREE_TRIAL_DAYSYesNumber of free trial days for new vendor accounts

Database

VariableRequiredDescription
DB_USERYesPostgreSQL database username
DB_HOSTYesPostgreSQL database host
DB_DATABASEYesPostgreSQL database name
DB_PASSWORDYesPostgreSQL database password
DB_PORTYesPostgreSQL database port (default: 5432)
REDIS_URLNoRedis connection URL for caching and sessions (e.g., redis://localhost:6379)

Google Services

VariableRequiredDescription
GOOGLE_CLIENT_IDYesGoogle OAuth client ID for social login
GOOGLE_PLACES_API_KEYNoGoogle Places API key for address autocomplete
GEMINI_API_KEYNoGoogle Gemini API key for AI-powered features

WhatsApp Integration

VariableRequiredDescription
WHATSAPP_TOKENNoWhatsApp Business API access token
WHATSAPP_BUSINESS_IDNoWhatsApp Business account ID

Backblaze B2 Storage

VariableRequiredDescription
BACKBLAZE_KEY_IDYesBackblaze B2 application key ID
BACKBLAZE_APP_KEYYesBackblaze B2 application key secret
BACKBLAZE_BUCKET_NAMEYesBackblaze B2 bucket name for file uploads
BACKBLAZE_PRODUCTS_FOLDERYesFolder prefix for product images in the bucket
BACKBLAZE_REGIONYesBackblaze B2 region (e.g., us-east-005)
BACKBLAZE_BUCKET_IDYesBackblaze B2 bucket identifier

Cloudflare R2 Storage

VariableRequiredDescription
CLOUDFLARE_ACCOUNT_IDNoCloudflare account ID for R2 storage
CLOUDFLARE_ACCESS_KEY_IDNoCloudflare R2 access key ID
CLOUDFLARE_SECRET_ACCESS_KEYNoCloudflare R2 secret access key
CLOUDFLARE_BUCKET_NAMENoCloudflare R2 bucket name
R2_PUBLIC_URLNoPublic URL for Cloudflare R2 assets

Payment Gateway

VariableRequiredDescription
RAZORPAY_KEY_IDYesRazorpay test/sandbox API key ID
RAZORPAY_SECRET_KEYYesRazorpay test/sandbox secret key
LIVE_RAZORPAY_KEY_IDYesRazorpay production API key ID
LIVE_RAZORPAY_KEY_SECRETYesRazorpay production secret key
CLIENT_IDNoCashfree payment gateway client ID
CLIENT_SECRETNoCashfree payment gateway client secret

Email

VariableRequiredDescription
MAIL_HOSTYesSMTP server host (e.g., smtp.gmail.com)
MAIL_PORTYesSMTP server port (e.g., 587 for TLS)
MAIL_USERNAMEYesSMTP authentication email address
MAIL_PASSWORDYesSMTP authentication password or app password

WonEstop Integration

VariableRequiredDescription
WONESTOP_API_URLNoWonEstop shipping API base URL
WONESTOP_API_TOKENNoWonEstop API authentication token
WONESTOP_ORDER_TEMPLATE_IDNoWonEstop order notification template ID

editor.siyahfy.com (Theme Editor)

File: editor.siyahfy.com/.env.local

VariableRequiredDescription
NEXT_PUBLIC_BACKEND_URLYesBackend API URL for editor API calls
NEXT_PUBLIC_APP_URLYesVendor dashboard URL for cross-app navigation

studio.siyahfy.com (Developer Studio)

File: studio.siyahfy.com/.env.local

VariableRequiredDescription
ADMINURLYesBackend API URL for studio API calls
NEXT_PUBLIC_API_URLYesPublic API URL for client-side requests
NEXT_PUBLIC_THEME_URLYesTheme preview/store URL

siyahfy.com (Marketing Website)

File: siyahfy.com/.env.local

VariableRequiredDescription
NEXT_PUBLIC_APP_DOMAINYesPublic URL of the marketing site
NEXT_PUBLIC_APP_NAMEYesApplication display name
NEXT_PUBLIC_GOOGLE_CLIENT_IDYesGoogle OAuth client ID for social login
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEYYesClerk authentication publishable key
CLERK_SECRET_KEYYesClerk authentication secret key (server-side only)
BACKENDYesBackend API URL for server-side calls
NEXT_PUBLIC_LOCALEYesDefault locale/URL for the main app
NEXT_PUBLIC_FREE_TRIAL_DAYSYesFree trial duration displayed on pricing pages

siyahfy-theme-2502 (Default Store Theme)

File: siyahfy-theme-2502/.env.local

VariableRequiredDescription
NEXT_PUBLIC_BACKEND_URLYesBackend API URL for storefront data fetching

Environment-Specific Values

Development (Local)

# All apps typically point to localhost
BACKEND_URL=http://localhost:3003
NEXT_PUBLIC_APP_URL=http://localhost:3003
NEXT_PUBLIC_STORE_URL=http://localhost:3002
NEXT_PUBLIC_EDITOR_URL=http://localhost:3001
NEXT_PUBLIC_STUDIO_URL=http://localhost:3012

Production

# All apps point to their production subdomains
BACKEND_URL=https://backend.siyahfy.com
NEXT_PUBLIC_APP_URL=https://app.siyahfy.com
NEXT_PUBLIC_STORE_URL=https://store.siyahfy.com
NEXT_PUBLIC_EDITOR_URL=https://editor.siyahfy.com
NEXT_PUBLIC_STUDIO_URL=https://studio.siyahfy.com

Security Notes

  • Always use strong, unique values for SECRET_KEY and DB_SECRET_KEY in production
  • Use app-specific passwords for MAIL_PASSWORD (never your primary email password)
  • Rotate API keys and tokens periodically
  • Never expose server-side secrets in NEXT_PUBLIC_ prefixed variables
  • Set NEXT_PUBLIC_COOKIE_DOMAIN to .siyahfy.com in production for cross-subdomain session sharing
Customer JourneyServer Setup