Configure environment variables
The tables below summarize common setup requirements. The complete per-runtime catalog is maintained in env-manifests/*.json and reviewed on Environment → Applications. Importing that catalog never provisions credentials. Follow the Env Manager Guide to regenerate both copied surfaces and apply reviewed catalog changes after deployment.
Shared runtime overrides
Trigger tasks import chat, document, and governance helpers also used by the web app. Configure their optional model overrides in the Trigger environment as well as Vercel when equivalent behavior is intended. The Trigger manifest includes the shared model-role settings, legacy model aliases, pro-chat viewer allowlist, and prompt-owner restriction. An unset override uses the code default; matching variable names on another platform do not configure this runtime.
Supabase Edge
| Name | Required | Notes |
|---|---|---|
SUPABASE_URL | yes | Project URL |
SUPABASE_SERVICE_ROLE_KEY | yes | Server-side DB access |
SUPABASE_ANON_KEY | yes | Public API key |
ANTHROPIC_API_KEY | yes for extraction/OCR | Used by fathom-sync, interview synthesis, and Drive OCR |
FATHOM_API_KEY | yes for Fathom | REST API |
FATHOM_WEBHOOK_SECRET | yes for webhook | Set in Supabase |
FATHOM_WEBHOOK_ORG_SLUG | optional | Required if multiple orgs exist |
SABLE_ORG_SLUG | optional | Fallback org slug |
ASANA_API_KEY | yes for Asana | REST API |
ASANA_ACT_WRITES_ENABLED | no by default | Set true only to arm writes |
TOGGL_API_KEY | yes for Toggl | Track and Reports API |
GDRIVE_SA_JSON / GOOGLE_DRIVE_JSON | yes for Drive/Calendar/Gmail | Google service account JSON |
GOOGLE_CALENDAR_SUBJECT | optional | Workspace subject to impersonate for Calendar domain-wide delegation |
GOOGLE_GMAIL_SUBJECT | yes for Gmail | Explicit mailbox impersonated with gmail.readonly domain-wide delegation |
GMAIL_INTERNAL_DOMAIN | optional | Direction classification |
GMAIL_SYNC_QUERY | yes for Gmail | Approved narrow, bounded mailbox search; sync fails closed when unset |
CALENDAR_ACT_WRITES_ENABLED | no by default | Set true only to arm approved Calendar writes |
HUBSPOT_SERVICE_KEY | yes for HubSpot | HubSpot connector |
VOYAGE_API_KEY | yes for knowledge indexing/search | Voyage voyage-4 embeddings and rerank-2.5 |
SPINE_MCP_TOKEN | yes | Interactive-agent bearer: reads and approval proposals, never board delivery |
SPINE_MCP_STAGE_TOKEN | yes | Prompt-staging bearer; derives the separate, two-tool scheduled-report bearer and rotation-specific vault name |
SPINE_MCP_LEARNING_TOKEN | yes | Independent reads + prompt_update proposal bearer |
SPINE_MCP_ORCHESTRATOR_TOKEN | yes | Independent Trigger-only persistence/delivery bearer |
SPINE_ORG_ID | multi-org only | Explicit organization UUID for service-role MCP calls |
REPORT_REQUIRED_CONNECTORS | optional | Trigger refresh + Spine readiness set; values must match. Defaults to Fathom, Granola, Asana, Email, Drive, Calendar, Toggl |
REPORT_READINESS_GRACE_SECONDS | optional | Coverage grace; default 900, maximum 3600 |
SABLE_WEB_URL | yes for portal delivery | Canonical SABLE origin used for portal links; set https://sable.indigotrigger.ai in production |
RESEND_API_KEY | yes for portal activity email | Resend provider key; secret value stays in Supabase Edge secrets |
RESEND_FROM | yes for portal activity email | Sender address on a Resend domain enabled for sending |
SABLE_PORTAL_EMAIL_DELIVERY_ENABLED | release gate | Keep false until health and controlled-recipient acceptance pass; set true to allow activity email claims |
CRON_SECRET | yes for portal worker | Must match the Trigger environment value used in x-cron-secret |
Trigger.dev Reports
| Name | Required | Notes |
|---|---|---|
SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY | yes | Edge invocation and trusted run state |
CRON_SECRET | yes | Fixed scheduled-action authentication |
SPINE_MCP_ORCHESTRATOR_TOKEN | yes | Governed readiness, draft, and delivery calls |
SABLE_REPORT_DELIVERY_MODE | yes | Must be exactly shadow or live; unset fails closed |
SABLE_ORG_SLUG | multi-org only | Explicit organization selection |
ASANA_WORKSPACE_GID | yes | Explicit scheduled-refresh workspace; no first-workspace fallback |
SABLE_INBOUND_DOMAIN | optional | Domain half of the SABLE inbound address, no local part. Keeps SABLE's own inbox out of email attribution in the shared draft and ingestion code |
SABLE_INBOUND_ADDRESS | optional | Full SABLE BCC inbox address. Leave unset in Trigger; SABLE_INBOUND_DOMAIN is enough, and the full address stays scoped to Supabase |
GMAIL_INTERNAL_DOMAIN | optional | Domain used to classify internal email; defaults to indigotrigger.com |
ANTHROPIC_API_KEY | recommended | Weekly-update drafts (sable.weekly-update.draft.project); without it the draft uses the template body and the run logs a warning |
Vercel Web
| Name | Required | Notes |
|---|---|---|
SABLE_MODE | yes for production | Set production to disable demo fallbacks |
PUBLIC_APP_ORIGIN | yes for production | Canonical shared app URL used by operators and smoke tests |
SUPABASE_URL | yes for live mode | API routes |
SUPABASE_SERVICE_ROLE_KEY | yes for live mode | API routes |
SUPABASE_ANON_KEY | yes for Edge execution | Also may use NEXT_PUBLIC_SUPABASE_ANON_KEY |
NEXT_PUBLIC_SUPABASE_URL | yes for production | Returned by /api/config; no hardcoded project refs |
NEXT_PUBLIC_SUPABASE_ANON_KEY | yes for production | Returned by /api/config; public anon key only |
ANTHROPIC_API_KEY | yes for chat/OCR | Messages API for /api/chat and upload OCR fallback |
APP_TOKEN | legacy demo | Token gate for non-Supabase fallback |
VOYAGE_API_KEY | yes for documents/search/chat retrieval | Voyage voyage-4 embeddings and rerank-2.5 |
SABLE_WEB_URL | yes for portal access | Canonical base for invitation, recovery, notification, and portal links |
SABLE_INBOUND_DOMAIN | optional | Domain half of the SABLE inbound address. Drives the Important emails domain match on the project page: when unset, that card falls back to the roster match only |
Configure portal Auth delivery
Portal invitation and recovery email use Supabase Auth rather than the activity-email Resend worker. Configure the production Site URL, allow /auth-callback.html on production and approved preview origins, and verify Supabase Auth Simple Mail Transfer Protocol delivery before inviting a customer.
The production Vercel and Supabase Edge SABLE_WEB_URL values must identify the same SABLE origin. Mismatched values create access or notification links for the wrong deployment.
Local Docs
Docusaurus does not need app secrets. Hosted docs search is optional and activates only when all three DocSearch values are present:
| Name | Required | Notes |
|---|---|---|
DOCSEARCH_APP_ID | optional | Algolia DocSearch app ID |
DOCSEARCH_API_KEY | optional | Public DocSearch search key, not an admin key |
DOCSEARCH_INDEX_NAME | optional | Index name for the docs site |