> ## Documentation Index
> Fetch the complete documentation index at: https://vendo-mintlify-54d109e7.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Environment variables
> Every environment variable a Vendo host sets, what each one does, and where it belongs: the host process and the auth presets.
Every variable a host developer sets. Keys are credentials; config selects.
`VENDO_API_KEY` is the one variable that fills an adapter slot you left unset. Every other key here authenticates something you already chose in `createVendo`.
## Host process
| Variable | What it does | Set where |
| ----------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `VENDO_API_KEY` | Authenticates Vendo Cloud; fills any adapter slot you left unset. | `.env.local`, written by init |
| `VENDO_BASE_URL` | The origin this process answers on: the dev origin locally, the deployment's full public URL, path prefix included, in production. | deploy platform · `.env.local` in dev, written by init from its dev-URL question |
| `VENDO_MCP_BROKER_URL` | Your tenant's broker endpoint; setting it turns on broker mode. | deploy platform |
| `VENDO_MCP_FEDERATION_SECRET` | Secret a broker signs its login-federation handshake with. | deploy platform |
| `VENDO_CLOUD_URL` | Overrides the Vendo Cloud base URL for runtime and CLI. Default `https://console.vendo.run`. | deploy platform |
| `VENDO_TELEMETRY_DISABLED=1` | Disables build and development telemetry. | shell or CI |
| `VENDO_TICK_SECRET` | The secret `POST /tick` checks both its credentials against. Overrides the one a Cloud key derives; required without a key. | deploy platform |
| `VENDO_HOST_API_URL` | The host API's base when it answers on another origin. | deploy platform |
| `VENDO_LOGIN_URL` | Where a sessionless caller is sent to sign in. | deploy platform |
| `VENDO_SERVICE_KEY` | The docs' name for an MCP service key you pass explicitly. | `.env.local`, generated by init |
| `VENDO_URL` | Base URL `vendo sync` probes. Default `http://localhost:3000/api/vendo`. | shell · `--url` per run |
| `VENDO_POSTHOG_KEY` `VENDO_POSTHOG_HOST` | Override the telemetry project key and capture host. | shell or CI |
| `DO_NOT_TRACK=1` | Disables telemetry; also honored by Scarf. | shell or CI |
| `CI` | Disables telemetry. | set by your CI |
| `NODE_ENV` | Two separate gates, and they behave differently when it is unset. Dev-server telemetry collection: unset counts as production, so collection stays off. The local store's plaintext-secret allowance: unset counts as *not* production, so plaintext is allowed — see the warning below. | deploy platform |
| `E2B_API_KEY` | Credential the E2B SDK reads. Selects nothing. | deploy platform |
| `VENDO_BOX_TEMPLATE` | Base template an e2b box boots from. The Cloud pool ships its own image. | deploy platform |
| `VENDO_BOX_EDIT_TIMEOUT_MS` | Long-poll budget for one in-box agent edit. Default 8 minutes. | deploy platform |
| `VENDO_BOX_EDIT_POLL_MS` | Poll interval while an in-box agent edit runs. | deploy platform |
| `VENDO_E2B_TIMEOUT_MS` | E2B machine lifetime. Unset, a raised edit budget implies a matching lifetime. | deploy platform |
| `VENDO_INFERENCE_URL` `VENDO_INFERENCE_KEY` | The in-box agent's model endpoint and key. Both halves or neither. | deploy platform |
| `VENDO_INFERENCE_MODEL` | Optional model choice passed through to the box harness. | deploy platform |
| `VENDO_APP_BUILD_WATCHDOG_MS` | How long one app build may run. Default 4 minutes. | deploy platform |
| `VENDO_KNOWLEDGE_MAX_CALLS_PER_MINUTE` | Knowledge-search calls one principal may make per minute. Default 60. | deploy platform |
| `VENDO_STORE_ENCRYPTION_KEY` | 32-byte base64 key the default local store encrypts secrets with. | `.env.local` |
| `VENDO_AWAY_TOKEN_SECRET` | Default shared secret for the away-token preset. | deploy platform |
| `VENDO_MODEL` `VENDO_MODEL_APPS` `VENDO_MODEL_REVIEW` `VENDO_MODEL_JUDGE` `VENDO_MODEL_EXTRACT` | Model name pins, one per seat plus the CLI's extraction engine. They never select a provider. | deploy platform |
| `VENDO_DEV_CREDENTIAL` | Pins a dev-mode credential ladder rung. | internal · not a host knob |
| `ANTHROPIC_API_KEY` `OPENAI_API_KEY` `GOOGLE_GENERATIVE_AI_API_KEY` | Credentials for the provider you pass in `models`. Select nothing. | `.env.local` · deploy platform |
| `VERCEL` `CF_PAGES` `AWS_LAMBDA_FUNCTION_NAME` | Block the default PGlite store on an ephemeral filesystem. | set by the platform |
| `RAILWAY_ENVIRONMENT` `RENDER` `FLY_APP_NAME` `DYNO` | Mark the PGlite data directory ephemeral, so boot says so once. | set by the platform |
| `NEXT_RUNTIME` | How the boot event learns this deployment runs on Next. | set by the platform |
**An unset `NODE_ENV` stores secrets in plaintext.** On the default local
store, the plaintext allowance is `NODE_ENV !== "production"` — so unset, or
any value other than `production`, **allows** it. The only signal is one
`console.warn` the first time a secret is written.
Set both on any real deployment:
```bash .env theme={null}
NODE_ENV=production
VENDO_STORE_ENCRYPTION_KEY=… # 32-byte base64
```
Either one alone is enough to stop plaintext: with the key set, secrets are
encrypted whatever `NODE_ENV` says; with `NODE_ENV=production` and no key, the
store refuses to write a secret rather than writing it in the clear. Vendo
Cloud's hosted store is unaffected — this is the local store only.
## Auth presets
Each preset reads its vendor's own variables rather than a Vendo-named one.
| Preset | Variables |
| ------------ | ------------------------------------------------------------------------- |
| `authJs()` | `AUTH_SECRET`, or `NEXTAUTH_SECRET` |
| `clerk()` | `CLERK_JWT_KEY`, `CLERK_SECRET_KEY`, `NEXT_PUBLIC_CLERK_SIGN_IN_URL` |
| `supabase()` | `SUPABASE_JWT_SECRET`, `SUPABASE_URL` |
| `auth0()` | `AUTH0_DOMAIN` or `AUTH0_ISSUER_BASE_URL`, plus `AUTH0_AUDIENCE` when set |
| `jwt()` | none; it takes an explicit `secret` |
`vendo init` writes the local ones. `VENDO_API_KEY` and `VENDO_SERVICE_KEY` land in `.env.local`. Every other value is yours to set, production ones on your deploy platform.
Vendo also reads internal test seams and harness markers. They are not contract and can change without notice.