Docs · Deploy
Environment variables
Full reference — every configuration variable, default values, and examples.
These variables configure the DriftGuard API. The seven required variables are enough to boot; the rest enable optional integrations. On managed hosts (Render, Cloud Run) set the required ones as secrets.
Required
SECRET_KEYApp signing key for JWTs and CSRF. Generate with openssl rand -hex 32.e.g. hex, 32 bytesDATABASE_URLPostgres connection string. Migrations run on startup.e.g. postgres://user:pass@host:5432/driftguardREDIS_URLRedis instance backing the analysis job queue.e.g. redis://host:6379/0GITHUB_APP_IDNumeric ID of your DriftGuard GitHub App.e.g. 123456GITHUB_APP_PRIVATE_KEYPEM private key for the GitHub App (multiline).e.g. -----BEGIN RSA PRIVATE KEY-----…GITHUB_WEBHOOK_SECRETShared secret used to verify the X-Hub-Signature-256 webhook HMAC.e.g. whsec_…ANTHROPIC_API_KEYPowers the AI review summary of each diff.e.g. sk-ant-…Optional
ANTHROPIC_MODELOverride the model used for AI review.e.g. claude-haiku-4-5-20251001INFRACOST_API_KEYEnables cost-delta analysis via Infracost.e.g. ico-…STRIPE_API_KEYBilling — checkout and customer portal.e.g. sk_live_…STRIPE_WEBHOOK_SECRETVerifies Stripe webhook signatures.e.g. whsec_…RESEND_API_KEYTransactional email (alerts, invites).e.g. re_…SENTRY_DSNError reporting to Sentry.e.g. https://…@sentry.io/…ENVIRONMENTDeployment environment name. Defaults to production.e.g. productionPORTPort the server binds to. Defaults to 8000.e.g. 8000Minimal .env
.env
# .env — minimum to boot the API SECRET_KEY=$(openssl rand -hex 32) DATABASE_URL=postgres://user:pass@localhost:5432/driftguard REDIS_URL=redis://localhost:6379/0 GITHUB_APP_ID=123456 GITHUB_APP_PRIVATE_KEY="$(cat app.pem)" GITHUB_WEBHOOK_SECRET=whsec_… ANTHROPIC_API_KEY=sk-ant-…
Never commit real secrets. DriftGuard is in early access; variable names may change.