Configuration
Environment variables for the API, runner and web app.
On this page
API and worker
| Variable | Purpose |
|---|---|
DATABASE_URL | Dedicated Postgres database. Hosted Supabase uses its session pooler with sslmode=verify-full. |
HOST | Bind address; loopback by default. |
PORT | HTTP port. |
SUPABASE_URL | Verifies real owner sessions. |
SUPABASE_ANON_KEY | Supabase public key for session verification. |
NODE_EXTRA_CA_CERTS | Path to Supabase’s CA certificate. |
DATABASE_SSL_CA_FILE | Same certificate for the database client. |
QLOO_API_KEY | Backend-only Qloo credential. |
OPENROUTER_API_KEY | Backend-only free Dots 3 Note Preview decision model credential. |
TASTECASE_PUBLIC_SAMPLE_PROJECT_ID | Server-only allowlist: dedicated synthetic sample project UUID. No default. |
TASTECASE_PUBLIC_SAMPLE_CASE_ID | Server-only allowlist: recorded case UUID in that project. Never a browser selector. |
TASTECASE_PUBLIC_SAMPLE_INPUTS_SYNTHETIC | Set to true only after reviewing the dedicated inputs as synthetic. All sample settings are required together. |
Runner
| Variable | Purpose |
|---|---|
TASTECASE_API_ORIGIN | HTTPS API origin, with no path, query or credentials. |
TASTECASE_RUNNER_TOKEN | Project-scoped token shown once at creation. |
OPENROUTER_API_KEY | Local provider key for the default free-only Nemotron 3.5 Super VL adapter. |
TASTECASE_MODEL_PROVIDER | Optional: openrouter (default), or explicit litellm. No automatic fallback. |
TASTECASE_ASSISTANT_VERSION | Exact release label, required for comparisons and replay. |
The default adapter pins nvidia/nemotron-3.5-super-vl:free, enforces zero-price routing and disables paid fallback. Free accounts with fewer than $10 in purchased credits have a shared limit of 50 free-model requests/day and 20/minute. Baseline and Candidate can use the same model, but their labels alone do not change its prompt. Never pass keys or tokens as command-line arguments.
Web app
| Variable | Purpose |
|---|---|
TASTECASE_API_ORIGIN | Server-only fixed API origin for the same-origin proxy: HTTPS, or loopback HTTP for local development. No path, query or credentials. |
NEXT_PUBLIC_SUPABASE_URL | Public Supabase Auth origin. Must match the API’s Supabase project. |
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY | Public publishable key; never a secret or service-role key. NEXT_PUBLIC_SUPABASE_ANON_KEY is supported as the legacy public-key fallback. |
NEXT_PUBLIC_TASTECASE_REPOSITORY_URL | Optional public repository URL. The footer shows a GitHub link only when this is set. |
Register the web app’s /auth/callback URL in Supabase Auth’s redirect allowlist. Production authentication uses verified sessions; a locally simulated test identity is not hosted sign-in proof. Unconfigured private requests fail closed, while the anonymous sample never consults owner authentication.
Limitation
Anything prefixed
NEXT_PUBLIC_ is visible to browsers. Never put secrets there.