# Configure Environment (/en/docs/nextjs/configure-environment)

Configure your local app, Supabase, database, and email here. Add payment settings
from the [Stripe](/en/docs/billing/stripe/environment-variables) or
[Polar](/en/docs/billing/polar/environment-variables) environment reference.

## Local environment

Run `./coremvp env sync` after local Supabase starts. The CLI writes the local
app URL, Supabase URL, publishable key, secret key, and database connection to
`.env.local`. Do not copy those values from another checkout or maintain them
by hand.

For a concurrent checkout, first configure its
separate project, ports and app origin through **Run another project** in
[Run Locally](/en/docs/nextjs/run-locally).
Export `COREMVP_WEB_PORT` before env sync so the generated app origin matches
the port where Next.js is listening.

Local OAuth is optional and has a separate startup prerequisite. To test Google,
follow [Configure OAuth Providers](/en/docs/authentication/oauth-providers)
before starting Supabase. `env sync` derives app connection values; it does not
configure OAuth providers or supply their client credentials.

### Inspect redacted env

Check redacted env presence with:

```bash
./coremvp env list
```

Use this command for troubleshooting because it reports `set` or `missing` without printing secret values.

Key presence does not prove connectivity. Start your app and follow the
[local Auth checks](/en/docs/authentication/test-authentication) to check the
running application.

### Local env example

Keep the app, Supabase, and database values written by `env sync`. This example
shows the shared settings; configure billing separately below.

```bash title=".env.local"
# App origin
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Supabase Auth and database
NEXT_PUBLIC_SUPABASE_URL=http://127.0.0.1:54321
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=...
SUPABASE_SECRET_KEY=...
DATABASE_URL=postgresql://postgres:<password>@127.0.0.1:54322/postgres

# Email delivery
EMAIL_DELIVERY_MODE=mock

# Optional: protected email capture tests
# TEST_EMAIL_CAPTURE_TOKEN=... # only for test_capture

# Optional: real email delivery
# RESEND_API_KEY=... # only for real email
# RESEND_FROM_EMAIL=onboarding@example.com # only for real email
```

### Local variables

#### App and Supabase

| Variable                               | Required locally | Runtime        | Description                                                                                   |
| -------------------------------------- | ---------------- | -------------- | --------------------------------------------------------------------------------------------- |
| `NEXT_PUBLIC_APP_URL`                  | Yes              | Browser/server | Local app origin, usually `http://localhost:3000`.                                            |
| `NEXT_PUBLIC_SUPABASE_URL`             | Yes              | Browser/server | Local Supabase API URL from `bunx supabase status`.                                           |
| `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` | Yes              | Browser/server | Local Supabase publishable key generated by `./coremvp env sync`.                             |
| `SUPABASE_SECRET_KEY`                  | Yes (generated)  | Server only    | Local Supabase secret key generated by `./coremvp env sync`; never expose it to browser code. |
| `DATABASE_URL`                         | Yes              | Server only    | Local Supabase Postgres connection string.                                                    |

#### Email delivery

| Variable                   | Required locally  | Runtime     | Description                                                                                                                                                         |
| -------------------------- | ----------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `EMAIL_DELIVERY_MODE`      | No                | Server only | Use `mock` for the normal local path. Use `real` only when you intentionally want local code to send real email. See [Email Testing](/en/docs/email/test-delivery). |
| `TEST_EMAIL_CAPTURE_TOKEN` | Test capture only | Server only | Secret token for protected local or hosted capture lookup.                                                                                                          |
| `RESEND_API_KEY`           | Real email only   | Server only | Resend API key when `EMAIL_DELIVERY_MODE=real`; this sends real email even locally.                                                                                 |
| `RESEND_FROM_EMAIL`        | Real email only   | Server only | Sender address when `EMAIL_DELIVERY_MODE=real`.                                                                                                                     |

## Add billing settings

Choose your provider's guide for credentials, catalog IDs, webhook secrets,
payment mode, and restart or build requirements:

* **Stripe:** [Environment Variables](/en/docs/billing/stripe/environment-variables),
  with [lifetime](/en/docs/billing/stripe/lifetime/configure) or
  [subscription configuration](/en/docs/billing/stripe/subscription/configure).
* **Polar:** [Environment Variables](/en/docs/billing/polar/environment-variables),
  with [lifetime](/en/docs/billing/polar/lifetime/configure) or
  [subscription configuration](/en/docs/billing/polar/subscription/configure).

## Production environment

Preview and Production use the same variable names with environment-specific
values. See [Hosted Environment Variables](/en/docs/deployment/environment-variables)
for the shared copyable block and hosted requirements.

## Security rules

| Rule                                        | Reason                                     |
| ------------------------------------------- | ------------------------------------------ |
| Never commit `.env` or `.env.local`         | These files contain secrets.               |
| Never expose server keys as `NEXT_PUBLIC_*` | Browser bundles can read public variables. |
| Do not print setup links or secret values   | Keeps test artifacts safe for sharing.     |

## What's next

<Cards>
  <Card title="Run Locally" href="/en/docs/nextjs/run-locally" description="Start the app with the configured local values." />

  <Card title="Email" href="/en/docs/email" description="Choose mock, hosted capture, or real email delivery." />

  <Card title="Deployment" href="/en/docs/deployment/environment-variables" description="Copy the shared Preview and Production inputs." />
</Cards>