Environment Variables

Most environment variables consumed by the public site and workspace are declared in packages/lib/src/config/env.ts as a Zod schema that validates at boot — missing required vars cause loud startup failures rather than silent runtime ones. A handful of vars are still read directly via process.env (e.g. FRASE_WEBHOOK_API_KEY in proxy.ts); these are called out below. The Partner Portal (apps/partners) keeps its own vars entirely outside this schema.

Re-export shims live at lib/config/env.ts (legacy @/lib/config/env imports). Prefer importing via either path over reading process.env.X directly — direct access bypasses validation and produces unknown-typed values.

Public vs server#

• NEXT_PUBLIC_* — bundled into the browser. Safe for anything the client must see.
• everything else — server-only. Never references these in Client Components or you'll leak secrets into the JS bundle.

Reference#

Application environment#

Authentication (Clerk)#

All three are .optional() in the schema — "required" here is an operational requirement on workspace, not a boot-time constraint enforced by Zod.

Workspace cross-app linkage#

Database (MongoDB)#

Content (WordPress)#

Email#

Slack notifications#

Salesforce (lead capture)#

Mux (video)#

Upstash Redis#

Observability#

MailerLite#

Crons / scheduled jobs#

Other#

---

Partner Portal (apps/partners)#

The Partner Portal is a fully separate Next.js app (pinned next@^16.2.9) with its own Clerk app, its own Neon database project, and its own Salesforce integration user. None of these vars are shared with workspace or memo. All are declared directly via process.env (no shared lib schema).

Auth (Clerk — Partners Clerk app)#

Database (Neon — dedicated Partners project)#

Salesforce — JWT Bearer (server-to-server)#

Storage (Cloudflare R2)#

Email#

Rate limiting (Upstash Redis)#

Observability#

Cron#

App#

The middleware host gate is not env-driven — the accepted hostnames are hardcoded (new Set(["partners.matters.ai"])) in apps/partners/middleware.ts, so there is no ALLOWED_HOSTS env var. Likewise NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and SENTRY_AUTH_TOKEN are consumed implicitly by the Clerk and Sentry SDKs respectively, not read via process.env in app code.

---

Where each app needs them#

• Public website (matters.ai): all of the above except CLERK_WEBHOOK_SECRET and the workspace-only RBAC config (which is reading the codebase, not env vars). Needs the Clerk publishable/secret keys for shared SSO once cookie domain is set.
• Workspace (workspace.matters.ai): same set; Clerk + Mongo + WordPress are the critical ones.
• Partner Portal (partners.matters.ai): the dedicated Partners section above — none shared with workspace. Minimum to boot: NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY, PARTNERS_NEON_DATABASE_URL. Cron + SF needed for full functionality.
• Webdocs (webdocs.matters.ai): essentially nothing. The docs site doesn't authenticate or read external state. Set NODE_ENV=production and you're done.