Motherbase reads configuration from .env. The supported setup path is ./setup.sh, which writes the project and Console environment files and generates strong secrets.

For manual development, copy apps/server/.env.example to apps/server/.env and fill the required values. The Console has its own file, deploy/console/.env.example.

For the deployment-side view of the same variables — which file writes them, which stack consumes them — see self-hosting environment variables.

Generate secrets

# JWT secret
node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
 
# Config encryption key, base64-encoded 32 bytes
node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

Required to boot

CONFIG_ENCRYPTION_KEY is not required to boot, but it is required to save Studio-managed secrets such as edge secrets and encrypted provider settings. setup.sh generates it.

Server

Database

Auth

Passwords are hashed with argon2. Imported Supabase bcrypt hashes are accepted and migrated to argon2 after the user's first successful password login.

Google, Apple, OTP, SMTP, and password reset behavior are configured per project in Project Studio -> Settings with environment fallbacks for SMTP.

Rate limits

REST API

Note

This seeds the api.rest → rpcSecurityDefiner setting while no row has been saved for that group. Once it is saved, the stored value wins and this variable is no longer read — which is what makes clearing the allowlist from Studio actually clear it. Use Reset to .env on the group to hand control back to the environment.

Email / SMTP

Required for email OTP, password reset, and email verification.

Storage

S3 / MinIO / R2

Logical buckets are configured in Project Studio and map onto the physical public/private buckets.

Backups and imports

The Supabase importer writes a temporary dump file under BACKUP_DIR and removes it after the import.

Offsite upload happens only when STORAGE_DRIVER=s3 and offsite is enabled. See backups and restore.

Settings seeds

These are fallbacks, not live configuration. Each seeds a field in a settings group while no row has been saved for that group; once the group is saved in Studio the stored value wins and the variable is no longer read. Use Reset to .env on a group to hand control back. See settings system.

REST_MAX_ROWS, REST_RPC_SECURITY_DEFINER and EDGE_FUNCTION_LOG_RETENTION_DAYS above work the same way. Every field, with its full description, is in the settings reference.

Push notifications

Firebase

APNs

Project Studio and admin

Edge functions

The runtime sidecar

Functions execute in a separate Deno service (deploy/edge-runtime), reached over HTTP. These configure the API's half of that link.

And these are read by the sidecar process itself, not by the API:

See edge runtime for what each one changes.

AI assistant

These five are the organization-wide default, shaped exactly like a saved ai.assistant settings group and reported to Studio as source: 'org'. A project that saves its own ai.assistant overrides them entirely. A half-filled environment — a provider with no key, or a key with no provider — is treated as not configured rather than as a broken configuration. In a standalone deployment with no Platform Console, these are how an operator configures the assistant. See AI assistant.

Platform Console

Only needed when running the multi-project Platform Console.

UPDATE_CHECK_URL may return { "version": "1.2.3" }, { "tags": [...] }, or a Docker Hub-style { "results": [{ "name": "1.2.3" }] } payload. The Console only checks and displays availability; updates still use the supported setup path. See Updates.

setup.sh and the Console deployment files also use install-time values such as DOMAIN, CONSOLE_DOMAIN, ACME_EMAIL, and Traefik DNS challenge credentials.

CLI

Used by @motherbase/cli for non-interactive runs and CI.

SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD are read by the project seed script (npm run db:seed), not by the running server.

Console mode uses MOTHERBASE_CONSOLE_URL + MOTHERBASE_TOKEN + MOTHERBASE_PROJECT. Direct mode uses MOTHERBASE_URL + MOTHERBASE_ADMIN_TOKEN.