VENDO_API_KEY is the one variable that fills an adapter slot you left unset. Every other key here authenticates something you already chose in createVendo.
Host process
| Variable | What it does | Set where |
|---|---|---|
VENDO_API_KEY | Authenticates Vendo Cloud; fills any adapter slot you left unset. | .env.local, written by init |
VENDO_BASE_URL | The origin this process answers on: the dev origin locally, the deployment’s full public URL, path prefix included, in production. | deploy platform · .env.local in dev, written by init from its dev-URL question |
VENDO_MCP_BROKER_URL | Your tenant’s broker endpoint; setting it turns on broker mode. | deploy platform |
VENDO_MCP_FEDERATION_SECRET | Secret a broker signs its login-federation handshake with. | deploy platform |
VENDO_CLOUD_URL | Overrides the Vendo Cloud base URL for runtime and CLI. Default https://console.vendo.run. | deploy platform |
VENDO_TELEMETRY_DISABLED=1 | Disables build and development telemetry. | shell or CI |
VENDO_TICK_SECRET | The secret POST /tick checks both its credentials against. Overrides the one a Cloud key derives; required without a key. | deploy platform |
VENDO_HOST_API_URL | The host API’s base when it answers on another origin. | deploy platform |
VENDO_LOGIN_URL | Where a sessionless caller is sent to sign in. | deploy platform |
VENDO_SERVICE_KEY | The docs’ name for an MCP service key you pass explicitly. | .env.local, generated by init |
VENDO_URL | Base URL vendo sync probes. Default http://localhost:3000/api/vendo. | shell · --url per run |
VENDO_POSTHOG_KEY VENDO_POSTHOG_HOST | Override the telemetry project key and capture host. | shell or CI |
DO_NOT_TRACK=1 | Disables telemetry; also honored by Scarf. | shell or CI |
CI | Disables telemetry. | set by your CI |
NODE_ENV | Two separate gates, and they behave differently when it is unset. Dev-server telemetry collection: unset counts as production, so collection stays off. The local store’s plaintext-secret allowance: unset counts as not production, so plaintext is allowed — see the warning below. | deploy platform |
E2B_API_KEY | Credential the E2B SDK reads. Selects nothing. | deploy platform |
VENDO_BOX_TEMPLATE | Base template an e2b box boots from. The Cloud pool ships its own image. | deploy platform |
VENDO_BOX_EDIT_TIMEOUT_MS | Long-poll budget for one in-box agent edit. Default 8 minutes. | deploy platform |
VENDO_BOX_EDIT_POLL_MS | Poll interval while an in-box agent edit runs. | deploy platform |
VENDO_E2B_TIMEOUT_MS | E2B machine lifetime. Unset, a raised edit budget implies a matching lifetime. | deploy platform |
VENDO_INFERENCE_URL VENDO_INFERENCE_KEY | The in-box agent’s model endpoint and key. Both halves or neither. | deploy platform |
VENDO_INFERENCE_MODEL | Optional model choice passed through to the box harness. | deploy platform |
VENDO_APP_BUILD_WATCHDOG_MS | How long one app build may run. Default 4 minutes. | deploy platform |
VENDO_KNOWLEDGE_MAX_CALLS_PER_MINUTE | Knowledge-search calls one principal may make per minute. Default 60. | deploy platform |
VENDO_STORE_ENCRYPTION_KEY | 32-byte base64 key the default local store encrypts secrets with. | .env.local |
VENDO_AWAY_TOKEN_SECRET | Default shared secret for the away-token preset. | deploy platform |
VENDO_MODEL VENDO_MODEL_APPS VENDO_MODEL_REVIEW VENDO_MODEL_JUDGE VENDO_MODEL_EXTRACT | Model name pins, one per seat plus the CLI’s extraction engine. They never select a provider. | deploy platform |
VENDO_DEV_CREDENTIAL | Pins a dev-mode credential ladder rung. | internal · not a host knob |
ANTHROPIC_API_KEY OPENAI_API_KEY GOOGLE_GENERATIVE_AI_API_KEY | Credentials for the provider you pass in models. Select nothing. | .env.local · deploy platform |
VERCEL CF_PAGES AWS_LAMBDA_FUNCTION_NAME | Block the default PGlite store on an ephemeral filesystem. | set by the platform |
RAILWAY_ENVIRONMENT RENDER FLY_APP_NAME DYNO | Mark the PGlite data directory ephemeral, so boot says so once. | set by the platform |
NEXT_RUNTIME | How the boot event learns this deployment runs on Next. | set by the platform |
An unset Either one alone is enough to stop plaintext: with the key set, secrets are
encrypted whatever
NODE_ENV stores secrets in plaintext. On the default local
store, the plaintext allowance is NODE_ENV !== "production" — so unset, or
any value other than production, allows it. The only signal is one
console.warn the first time a secret is written.Set both on any real deployment:.env
NODE_ENV=production
VENDO_STORE_ENCRYPTION_KEY=… # 32-byte base64
NODE_ENV says; with NODE_ENV=production and no key, the
store refuses to write a secret rather than writing it in the clear. Vendo
Cloud’s hosted store is unaffected — this is the local store only.Auth presets
Each preset reads its vendor’s own variables rather than a Vendo-named one.| Preset | Variables |
|---|---|
authJs() | AUTH_SECRET, or NEXTAUTH_SECRET |
clerk() | CLERK_JWT_KEY, CLERK_SECRET_KEY, NEXT_PUBLIC_CLERK_SIGN_IN_URL |
supabase() | SUPABASE_JWT_SECRET, SUPABASE_URL |
auth0() | AUTH0_DOMAIN or AUTH0_ISSUER_BASE_URL, plus AUTH0_AUDIENCE when set |
jwt() | none; it takes an explicit secret |
vendo init writes the local ones. VENDO_API_KEY and VENDO_SERVICE_KEY land in .env.local. Every other value is yours to set, production ones on your deploy platform.