Environment‐Variables

Environment Variables

All of these live in .env (copy from .env.example). See Setup for step-by-step instructions on obtaining each one.

Variable	Required?	Purpose
VITE_GOOGLE_CLIENT_ID	Yes	Google Identity Services client ID, used browser-side for sign-in.
GOOGLE_CLIENT_ID	Yes	Same OAuth client's ID, used server-side for the Calendar OAuth exchange.
GOOGLE_CLIENT_SECRET	Yes	Same OAuth client's secret — used to exchange/refresh Google Calendar tokens server-side (api/google.ts, api/_lib/googleOAuth.ts). Required for Calendar sync; not needed for sign-in alone.
ALLOWED_EMAILS	Yes	Comma-separated list of Google account emails allowed to sign in. Nobody can sign in until this is set.
LOGIN_PIN	Optional	Shared passcode enabling the email+PIN fallback sign-in (api/pinSession.ts) — lets an allowed email sign in without the Google popup. Unset = that fallback is disabled and Google is the only sign-in method.
SESSION_SECRET	Yes	Random secret used to sign app session tokens (HMAC). Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
KV_REST_API_URL	Yes	Upstash Redis REST URL. Set automatically when you connect the Upstash Redis integration to your Vercel project (Storage → Create Database).
KV_REST_API_TOKEN	Yes	Upstash Redis REST token. Set alongside KV_REST_API_URL.
ANTHROPIC_API_KEY	Yes, for the agent	Powers the AI scheduling agent (api/agent.ts). The rest of the app works without it.
SPOTIFY_CLIENT_ID	Optional	Spotify app client ID (api/spotify.ts) — used for now-playing/playback control and the in-tab player on the Pomodoro page.
SPOTIFY_CLIENT_SECRET	Optional	Spotify app client secret, paired with SPOTIFY_CLIENT_ID.
SCHOOLOGY_CONSUMER_KEY	Optional	App-level Schoology API consumer key (api/_lib/schoologyApi.ts) — only needed if you want points-possible/full descriptions from Schoology instead of just the ICS feed's due dates. Create one at app.schoology.com/api; each user then pastes their own personal API key/secret in Settings → School. Canvas and Google Classroom don't need server-level app credentials — Canvas uses a per-user personal access token, and Classroom reuses the Google OAuth client above.
SCHOOLOGY_CONSUMER_SECRET	Optional	Paired with SCHOOLOGY_CONSUMER_KEY.

Notes

• KV_REST_API_URL / KV_REST_API_TOKEN use the legacy "Vercel KV" naming rather than Upstash's own UPSTASH_REDIS_REST_* names — this is what the Vercel-Upstash integration sets, and what api/data.ts and friends read directly (not Redis.fromEnv()).
• GOOGLE_CLIENT_ID/VITE_GOOGLE_CLIENT_ID should be the same OAuth client — one is read server-side, one is inlined into the client bundle by Vite (anything prefixed VITE_ is exposed to the browser; the non-prefixed vars are server-only).
• Redirect URIs for Google/Spotify OAuth are fixed by vercel.json's rewrites (/api/googleOAuthCallback → /api/google?action=oauthCallback, etc.) — register those external-facing paths with each provider, not the internal /api/google / /api/spotify paths. See Architecture for why the routes are consolidated like this.