Environment Variables
Supabase Edge
| Name | Required | Notes |
|---|---|---|
SUPABASE_URL | yes | Project URL |
SUPABASE_SERVICE_ROLE_KEY | yes | Server-side DB access |
SUPABASE_ANON_KEY | yes | Public API key |
ANTHROPIC_API_KEY | yes for extraction/OCR | Used by fathom-sync, interview synthesis, and Drive OCR |
FATHOM_API_KEY | yes for Fathom | REST API |
FATHOM_WEBHOOK_SECRET | yes for webhook | Set in Supabase |
FATHOM_WEBHOOK_ORG_SLUG | optional | Required if multiple orgs exist |
SABLE_ORG_SLUG | optional | Fallback org slug |
ASANA_API_KEY | yes for Asana | REST API |
ASANA_ACT_WRITES_ENABLED | no by default | Set true only to arm writes |
TOGGL_API_KEY | yes for Toggl | Track and Reports API |
GDRIVE_SA_JSON / GOOGLE_DRIVE_JSON | yes for Drive/Calendar/Gmail | Google service account JSON |
GOOGLE_CALENDAR_SUBJECT | optional | Workspace subject to impersonate for Calendar domain-wide delegation |
GOOGLE_GMAIL_SUBJECT | yes for Gmail | Explicit mailbox impersonated with gmail.readonly domain-wide delegation |
GMAIL_INTERNAL_DOMAIN | optional | Direction classification |
GMAIL_SYNC_QUERY | yes for Gmail | Approved narrow, bounded mailbox search; sync fails closed when unset |
CALENDAR_ACT_WRITES_ENABLED | no by default | Set true only to arm approved Calendar writes |
HUBSPOT_SERVICE_KEY | yes for HubSpot | HubSpot connector |
VOYAGE_API_KEY | yes for knowledge indexing/search | Voyage voyage-4 embeddings and rerank-2.5 |
SPINE_MCP_TOKEN | yes | Interactive-agent bearer: reads and approval proposals, never board delivery |
SPINE_MCP_STAGE_TOKEN | yes | Independent read-only report/staging bearer |
SPINE_MCP_LEARNING_TOKEN | yes | Independent reads + prompt_update proposal bearer |
SPINE_MCP_ORCHESTRATOR_TOKEN | yes | Independent Trigger-only persistence/delivery bearer |
SPINE_ORG_ID | multi-org only | Explicit organization UUID for service-role MCP calls |
REPORT_REQUIRED_CONNECTORS | optional | Trigger refresh + Spine readiness set; values must match. Defaults to Fathom, Granola, Asana, Email, Drive, Calendar, Toggl |
REPORT_READINESS_GRACE_SECONDS | optional | Coverage grace; default 900, maximum 3600 |
Trigger.dev Reports
| Name | Required | Notes |
|---|---|---|
SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY | yes | Edge invocation and trusted run state |
CRON_SECRET | yes | Fixed scheduled-action authentication |
SPINE_MCP_ORCHESTRATOR_TOKEN | yes | Governed readiness, draft, and delivery calls |
SABLE_REPORT_DELIVERY_MODE | yes | Must be exactly shadow or live; unset fails closed |
SABLE_ORG_SLUG | multi-org only | Explicit organization selection |
ASANA_WORKSPACE_GID | yes | Explicit scheduled-refresh workspace; no first-workspace fallback |
Vercel Web
| Name | Required | Notes |
|---|---|---|
SABLE_MODE | yes for client instances | Set production to disable demo fallbacks |
PUBLIC_APP_ORIGIN | yes for client instances | Canonical app URL used by operators and smoke tests |
SUPABASE_URL | yes for live mode | API routes |
SUPABASE_SERVICE_ROLE_KEY | yes for live mode | API routes |
SUPABASE_ANON_KEY | yes for Edge execution | Also may use NEXT_PUBLIC_SUPABASE_ANON_KEY |
NEXT_PUBLIC_SUPABASE_URL | yes for client instances | Returned by /api/config; no hardcoded project refs |
NEXT_PUBLIC_SUPABASE_ANON_KEY | yes for client instances | Returned by /api/config; public anon key only |
ANTHROPIC_API_KEY | yes for chat/OCR | Messages API for /api/chat and upload OCR fallback |
APP_TOKEN | legacy demo | Token gate for non-Supabase fallback |
VOYAGE_API_KEY | yes for documents/search/chat retrieval | Voyage voyage-4 embeddings and rerank-2.5 |
Local Docs
Docusaurus does not need app secrets. Hosted docs search is optional and activates only when all three DocSearch values are present:
| Name | Required | Notes |
|---|---|---|
DOCSEARCH_APP_ID | optional | Algolia DocSearch app ID |
DOCSEARCH_API_KEY | optional | Public DocSearch search key, not an admin key |
DOCSEARCH_INDEX_NAME | optional | Index name for the docs site |