Environment variables

OrbitDocs keeps secrets out of orbitdocs.config.ts and out of the build. The config only names a variable (clientSecretEnv, apiKeyEnv, …). The server that serves the docs reads its value at request time.

This page lists every variable, grouped by who reads it. A name in angle brackets, such as <ai.apiKeyEnv>, means "the variable whose name you set in that config key".

Where secrets are readCopy Anchor Link

Private docs and Ask AI run on whatever serves the docs. That process needs the variables in the next section:

Private docs and Ask AICopy Anchor Link

Read by @orbitdocs/auth and @orbitdocs/ai on the serving process.

Errors when one is missing:

The docs MCP server and the API MCP servers need no key. The API MCP server forwards the credentials the MCP client sends to your API.

Extraction (NestJS integration)Copy Anchor Link

Read when orbitdocs extract, dev or build loads your Nest module in preview mode.

source: {
  nest: {
    module: 'dist/app.module.js',
    build: 'nest build',
    env: { DATABASE_URL: 'postgres://placeholder', STRIPE_KEY: 'sk_test_placeholder' },
  },
},

Docs app build and runtimeCopy Anchor Link

Read by @orbitdocs/next in the docs app.

The config file is TypeScript, so it can read your own variables. The sample app switches modes this way:

output: { mode: process.env.ORBITDOCS_MODE === 'server' ? 'server' : 'static', basePath: '/docs' },

ORBITDOCS_MODE is the sample's own name, not something OrbitDocs reads.

CLICopy Anchor Link

orbitdocs deploy --target vercel runs the Vercel CLI, which has its own login and variables. OrbitDocs reads none of them.

Generated SDK samples in the reference read the credential from an environment variable named after the operation's security scheme, such as API_KEY for a scheme named apiKey or BEARER_TOKEN for bearer (process.env.… in TypeScript, os.environ[…] in Python). See SDK samples. Those lines are sample code for your readers; OrbitDocs doesn't read them.

PlatformCopy Anchor Link

Read by the self-hosted platform (apps/platform). With Docker Compose, put them in apps/platform/.env: Compose reads it, and the platform container loads the whole file. See Install.

Hosted sites don't read this environment. Each project sets the private docs and Ask AI variables its site needs under Settings → Environment; see Site environment variables.

Docker Compose onlyCopy Anchor Link

Given to Git sync buildsCopy Anchor Link

Install and build commands don't get the platform's environment. They get an allowlist of it (PATH, HOME, temp folders, locale, TLS certificates, package-manager caches and registries, proxies), the project's Build Environment Variables from Settings → Git, and these. PLATFORM_SECRET, DATABASE_URL, SSO secrets and NODE_ENV are never passed. See Git sync for the full list.