3. Configure

The app reads its settings from two .env files, plain text files of NAME=value lines: backend/.env and frontend/.env. They hold secrets, so Git ignores them and they are never committed.

Generate both with one command, run from backend/:

cd backend
npm run setup
cd ..

It copies each half's .env.example to .env and fills in three random secrets: AUTH_SECRET (signs sign-in sessions), INTERNAL_API_TOKEN (lets the frontend call the backend's private sign-in endpoints) and ADMIN_MCP_API_KEY (the key an AI agent uses to operate the app, see Admin MCP Server). The first two must match between the files, and the script writes the same value to both. It never overwrites an existing .env, so running it again is safe.

What can wait

Everything already works locally, including the database address. These matter later:

• GitHub and Google sign-in (AUTH_GITHUB_*, AUTH_GOOGLE_* in frontend/.env): off until you add credentials. Magic-link email works without them. See OAuth providers.
• Billing (STRIPE_* in backend/.env): empty means billing is off and its pages hide. See Billing.
• Real email delivery (SMTP_* and EMAIL_SERVER_*): they point at the local mail inbox, which is right for development.
• Production values: public URLs, rotated secrets. The deploy guide covers them.

Every variable is described in Environment Variables.

Next: Start the database and the app