Environment Variables

Operator reference for Critique deployment env vars — core stack, v4.0 change control flags, and v4.1 connections secrets.

This page lists deployment environment variables for self-hosted or Vercel operators. End users configure OpenRouter, agents, and Linear in the product UI — not via env.

The canonical template is .env.example in the repository. Copy it for local development and mirror the same names in production secrets.

Required for a working deployment

Variable	Purpose
`DATABASE_URL`	PostgreSQL connection for Prisma
`BETTER_AUTH_SECRET`	Session signing (`openssl rand -base64 32`)
`BETTER_AUTH_URL`	Public origin for auth callbacks (local: `http://localhost:3000`)
`NEXT_PUBLIC_APP_URL`	Public site URL (links, metadata, MCP base)
`GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY`, `GITHUB_WEBHOOK_SECRET`	GitHub App reviews and webhooks
`QSTASH_TOKEN`, `QSTASH_CURRENT_SIGNING_KEY`, `QSTASH_NEXT_SIGNING_KEY`	Async review and worker queue
`OPENROUTER_API_KEY`	Managed review/chat when users do not use BYOK

OAuth sign-in is optional but typical: GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET, VERCEL_CLIENT_ID / VERCEL_CLIENT_SECRET.

Secrets and connections (v4.1+)

Variable	Required when	Purpose
`CRITIQUE_SECRETS_ENCRYPTION_KEY`	Users save any encrypted secret	32-byte key, base64-encoded. Encrypts: OpenRouter/Crof/BYOA keys, repository secrets, app connections (Linear, …), and stores hashes for `crt_` API keys

Generate:

node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

Rotation

If you rotate CRITIQUE_SECRETS_ENCRYPTION_KEY without re-encrypting existing rows, saved secrets will not decrypt. Have users re-save keys from Settings and Connections after rotation.

No additional env vars are required for the connections platform v1 beyond this key. Linear, MCP, and REST v1 use the same encryption path as BYOK.

Optional URL overrides (unchanged from earlier releases):

Variable	Default
`OPENROUTER_BASE_URL`	`https://openrouter.ai/api/v1`
`CROF_BASE_URL`	`https://crof.ai/v1`

AI change control platform (v4.0)

All flags below default to true when unset (v4 change control is on out of the box). Set any flag to false to turn off that slice during rollout or debugging.

Variable	Enables
`CRITIQUE_CHANGE_PASSPORT_ENABLED`	Change Passport as PR system of record
`CRITIQUE_RISK_SCORING_ENABLED`	Risk scoring on passports
`CRITIQUE_EVIDENCE_CONTRACT_ENABLED`	Evidence contract fields and gates
`CRITIQUE_MERGE_POLICY_ENABLED`	Merge policy evaluation (advisory)
`CRITIQUE_MERGE_POLICY_ENFORCEMENT_ENABLED`	Enforced merge policy (requires merge policy enabled)
`CRITIQUE_REMEDY_PROOF_ENABLED`	Remedy proof artifacts on passports
`CRITIQUE_FINDING_MEMORY_ENABLED`	Finding memory promotion paths
`CRITIQUE_INCIDENT_FEEDBACK_ENABLED`	Incident → policy feedback loop

Incident webhook secrets (v4.0)

Used by /api/integrations/incidents/:provider when verifying inbound webhooks:

Variable	Provider
`CRITIQUE_INCIDENT_WEBHOOK_SECRET`	Generic shared secret (where supported)
`CRITIQUE_LINEAR_WEBHOOK_SECRET`	Linear
`CRITIQUE_SENTRY_WEBHOOK_SECRET`	Sentry
`CRITIQUE_JIRA_WEBHOOK_SECRET`	Jira
`CRITIQUE_VERCEL_WEBHOOK_SECRET`	Vercel

Leave unset to disable provider-specific verification for that route.

Product behavior for change control is documented in Change control.

Chat documentation tools (optional)

Variable	Purpose
`FIRECRAWL_API_KEY`	`searchDocs` / `fetchDocPage` in chat
`CONTEXT7_API_KEY`	`searchLibraryDocs` version-aware library docs

If unset, those chat tools return a clear “not configured” message.

Review, Remedy, and embeddings (common)

See .env.example for the full list. Frequently tuned:

Variable	Notes
`CRITIQUE_REVIEW_PROVIDER`, `CRITIQUE_REVIEW_MODEL`	Default review model routing
`CRITIQUE_REMEDY_EXECUTION`, `CRITIQUE_REMEDY_MODEL_ID`	Remedy sandbox execution
`CRITIQUE_CODE_EMBEDDING_MODEL`	Repository embedding model
`CRITIQUE_BETA_MODE`	Product beta gates

What users configure in the UI (not env)

User action	UI location	Operator prerequisite
OpenRouter / Crof BYOK	Settings	`CRITIQUE_SECRETS_ENCRYPTION_KEY`
Cursor / Anthropic / OpenAI BYOA	Settings	Same
Linear connection	Settings → Connections	Same
Critique API key (`crt_…`)	Connections → API keys	Same
Repository secrets	Dashboard → Automation	Same

Quick checklist by release

Shipping v4.0 change control

Run database migrations (prisma migrate deploy).
Set incident webhook secrets if using Control Board ingest.
Flags are on by default — no env required. To disable a feature, set its flag to false and redeploy.

Shipping v4.1 connections / MCP

Run migrations including user_connection and critique_api_key.
Set CRITIQUE_SECRETS_ENCRYPTION_KEY before exposing Connections in production.
Smoke-test: save Linear key → chat searchIssuesAndRoadmap; create crt_ key → GET /api/v1/passports and MCP tools/list.

Environment Variables

On this page