Configuration — Zansify Docs

Environment variables

Kasify uses a single .env file at the root of the monorepo. All apps read from it via process.env.

Security note: Never commit your .env file. It contains database credentials and JWT secrets. The .gitignore already excludes it, but double-check before pushing.

Required variables

These must be set or Kasify will refuse to start in production.

Database

DATABASE_URL=postgresql://user:password@host:5432/dbname

Full PostgreSQL connection string. Supports connection pooling URLs (e.g. PgBouncer, Neon, Supabase).

Authentication secrets

JWT_SECRET=min-32-character-random-string
JWT_REFRESH_SECRET=different-min-32-character-random-string

Generate secure values with:

openssl rand -base64 32

Both secrets must be at least 32 characters and must be different from each other. In production, missing or weak secrets will throw a fatal error on startup.

Application URLs

NEXT_PUBLIC_API_URL=https://api.yourstore.com
NEXT_PUBLIC_DASHBOARD_URL=https://dashboard.yourstore.com
NEXT_PUBLIC_STOREFRONT_URL=https://yourstore.com

Used by the frontend apps to know where the API lives. Prefix NEXT_PUBLIC_ variables are exposed to the browser.

CORS

ALLOWED_ORIGINS=https://dashboard.yourstore.com,https://yourstore.com

A comma-separated list of origins the API will accept requests from. In development, localhost origins are automatically allowed. In production, only the origins listed here will be permitted.

Email (SMTP)

SMTP_HOST=smtp.mailgun.org
SMTP_PORT=587
SMTP_USER=postmaster@mg.yourdomain.com
SMTP_PASS=your-smtp-password
SMTP_FROM=noreply@yourdomain.com

Kasify sends transactional emails for order confirmations, shipping updates, and customer notifications. Any SMTP provider works — Mailgun, Postmark, SendGrid, Gmail, or your own mail server.

AI providers

You can configure one or more AI providers. The merchant chooses which provider to use per-store in the dashboard.

# Anthropic (Claude)
ANTHROPIC_API_KEY=sk-ant-...

# OpenAI
OPENAI_API_KEY=sk-...

For Gemini or custom OpenAI-compatible providers (Groq, Mistral, Ollama, Together AI), the API key is stored per-store in the database — not in .env.

Storage (optional)

# AWS S3 or S3-compatible (Cloudflare R2, MinIO, etc.)
S3_BUCKET=kasify-uploads
S3_REGION=us-east-1
S3_ACCESS_KEY_ID=AKIA...
S3_SECRET_ACCESS_KEY=...
S3_ENDPOINT=https://your-r2-account.r2.cloudflarestorage.com  # optional, for S3-compatible

When configured, product images are uploaded to S3. Without it, images are stored locally in public/uploads/ — fine for development, not recommended for production.

Full reference

| Variable | Required | Default | Description | |---|---|---|---| | DATABASE_URL | ✓ | — | PostgreSQL connection string | | JWT_SECRET | ✓ | — | Access token signing key | | JWT_REFRESH_SECRET | ✓ | — | Refresh token signing key | | NEXT_PUBLIC_API_URL | ✓ | — | API base URL | | NEXT_PUBLIC_DASHBOARD_URL | ✓ | — | Dashboard base URL | | NEXT_PUBLIC_STOREFRONT_URL | ✓ | — | Storefront base URL | | ALLOWED_ORIGINS | — | — | CORS allowed origins (comma-separated) | | SMTP_HOST | — | — | SMTP server hostname | | SMTP_PORT | — | 587 | SMTP port | | SMTP_USER | — | — | SMTP username | | SMTP_PASS | — | — | SMTP password | | SMTP_FROM | — | — | Sender email address | | ANTHROPIC_API_KEY | — | — | Claude AI API key | | OPENAI_API_KEY | — | — | OpenAI API key | | S3_BUCKET | — | — | S3 bucket name for file uploads | | S3_REGION | — | us-east-1 | S3 region | | S3_ACCESS_KEY_ID | — | — | S3 access key | | S3_SECRET_ACCESS_KEY | — | — | S3 secret key | | S3_ENDPOINT | — | — | Custom S3 endpoint (for R2/MinIO) | | NODE_ENV | — | development | Set to production in prod deployments |