Environment Variables

Operator reference for Critique deployment environment variables, including the core stack, hosted CritiqueCode, Change Passports, connections, reviews, and merge policy.

This page lists deployment environment variables for self-hosted or Vercel operators. End users configure OpenRouter, agents, and Linear in the product UI — not via env.

The canonical template is .env.example in the repository. Copy it for local development and mirror the same names in production secrets.

Required for a working deployment

Variable	Purpose
`DATABASE_URL`	PostgreSQL connection for Prisma
`BETTER_AUTH_SECRET`	Session signing (`openssl rand -base64 32`)
`CRITIQUE_COMPLIANCE_EXPORT_SIGNING_KEY`	Optional dedicated HMAC key for passport compliance bundles and anonymized model-feedback export batches (falls back to `BETTER_AUTH_SECRET` when unset)
`BETTER_AUTH_URL`	Public origin for auth callbacks (local: `http://localhost:3000`)
`NEXT_PUBLIC_APP_URL`	Public site URL (links, metadata, MCP base)
`GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`	GitHub OAuth sign-in and delegated repository access for hosted `/code`
`OPENROUTER_API_KEY`	Managed review/chat when users do not use BYOK

OAuth sign-in is optional for the site, but GitHub OAuth is required for new hosted /code sessions: configure GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET, then users connect GitHub with repository access from the Code workspace. VERCEL_CLIENT_ID / VERCEL_CLIENT_SECRET remains optional. The retired GitHub App and its webhook secrets are not required by /code.

QSTASH_* and GITHUB_APP_* variables remain in .env.example only for archived compatibility modules. They are not prerequisites for the current /code workspace or the local CritiqueCode author.

Early hosted CritiqueCode runtime

The hosted /code runtime is capability-gated. Production does not start a session unless the required model, sandbox, and a user's delegated GitHub repository authorization are present. Outbound access is enabled by default and can be narrowed with an optional CIDR allowlist. Private storage is optional and only enables image attachments.

Variable	Purpose
`E2B_API_KEY`	Creates and reconnects hosted author sandboxes
`CRITIQUE_CODE_CLOUD_E2B_TEMPLATE_ID`	Pinned hosted author template (default `critique-code-author-v1`)
`CRITIQUE_CODE_CLOUD_PUBLIC_ORIGIN`	Public origin the worker uses for authenticated control-plane callbacks
`OPENROUTER_API_KEY`	Server-side OpenRouter credential for hosted author inference on All In and Inference API-credit sessions
`CRITIQUE_CODE_CLOUD_PROVIDER_ALLOWLIST`	Hosted provider allowlist; use `openrouter` for the supported hosted route
`CRITIQUE_CODE_ALL_IN_CAPACITY_MODELS_ENABLED`	Enables the capacity-dependent All In frontier routes while capacity is available
`CRITIQUE_CODE_CLOUD_STORAGE_BACKEND`	`http` in production; `memory` is local/test only
`CRITIQUE_CODE_CLOUD_STORAGE_ENDPOINT`	Private object-storage adapter endpoint
`CRITIQUE_CODE_CLOUD_STORAGE_SIGNING_SECRET`	Signs short-lived object access and adapter requests
`CRITIQUE_CODE_CLOUD_EGRESS_ALLOW_CIDRS`	Optional comma-separated outbound IPv4/IPv6 addresses or CIDRs; omitted means outbound internet access is enabled; `/0` entries are rejected
`CRITIQUE_CODE_CLOUD_IDLE_PAUSE_MS`	Pause unused hosted sandboxes after this idle window (default `300000`, five minutes)

Hosted author inference is brokered through the authenticated control plane. All In and Inference-credit sessions use Critique's OpenRouter account; hosted BYOK sessions can use an encrypted OpenRouter, LLM Gateway, or OpenAI key selected on /code. Raw keys are decrypted only for the upstream request and are never injected into the sandbox worker. Inference-credit and BYOK routes share 10 cloud sessions per calendar month with no separate session fee. Local CritiqueCode remains free and supports BYOK separately.

Usage policy variables include cumulative per-turn model-request allocations, session/user admission thresholds, reported-cost thresholds, CRITIQUE_CODE_CLOUD_MAX_ACTIVE_SESSIONS_PER_USER, CRITIQUE_CODE_CLOUD_MAX_SESSION_CONCURRENT_TURNS, CRITIQUE_CODE_CLOUD_MAX_USER_CONCURRENT_TURNS, and the per-command reservation values shown in .env.example. All In's monthly session and inference balances are separate Autumn features. Inference-credit and BYOK sessions share the 10-session standard calendar-month allowance. Requested output is hard-capped; input allocation uses a provider-neutral estimate. Listed managed models use Critique's published routed rates; BYOK model tokens bill the provider directly.

Billing variable	Purpose
`AUTUMN_ALL_IN_10_PLAN_ID`	Monthly $10 plan; defaults to `critiquecode_all_in_10`
`AUTUMN_ALL_IN_30_PLAN_ID`	Monthly $30 plan; defaults to `critiquecode_all_in_30`
`AUTUMN_ALL_IN_FOUNDERS_PLAN_ID`	Monthly $150 Founders Edition plan; defaults to `critiquecode_all_in_founders`
`AUTUMN_ALL_IN_SESSIONS_FEATURE_ID`	Consumable monthly cloud-session balance
`AUTUMN_ALL_IN_INFERENCE_FEATURE_ID`	Consumable monthly provider-cost inference balance, denominated in USD cents

Secrets and connections

Variable	Required when	Purpose
`CRITIQUE_SECRETS_ENCRYPTION_KEY`	Users save any encrypted secret	32-byte key, base64-encoded. Encrypts: OpenRouter/Crof/BYOA keys, repository secrets, app connections (Linear, …), and stores hashes for `crt_` API keys

Generate:

node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

Rotation

If you rotate CRITIQUE_SECRETS_ENCRYPTION_KEY without re-encrypting existing rows, saved secrets will not decrypt. Have users re-save keys from Settings and Connections after rotation.

No additional env vars are required for the connections platform v1 beyond this key. Linear, MCP, and REST v1 use the same encryption path as BYOK.

Optional URL overrides (unchanged from earlier releases):

Variable	Default
`OPENROUTER_BASE_URL`	`https://openrouter.ai/api/v1`
`CROF_BASE_URL`	`https://crof.ai/v1`
`LLMGATEWAY_BASE_URL`	`https://api.llmgateway.io/v1`

AI change control

All flags below default to true when unset. Set any flag to false to turn off that slice during rollout or debugging.

Variable	Enables
`CRITIQUE_CHANGE_PASSPORT_ENABLED`	Change Passport as PR system of record
`CRITIQUE_RISK_SCORING_ENABLED`	Risk scoring on passports
`CRITIQUE_EVIDENCE_CONTRACT_ENABLED`	Evidence contract fields and gates
`CRITIQUE_MERGE_POLICY_ENABLED`	Merge policy evaluation (advisory)
`CRITIQUE_MERGE_POLICY_ENFORCEMENT_ENABLED`	Enforced merge policy (requires merge policy enabled)
`CRITIQUE_REMEDY_PROOF_ENABLED`	Remedy proof artifacts on passports
`CRITIQUE_FINDING_MEMORY_ENABLED`	Finding memory promotion paths
`CRITIQUE_INCIDENT_FEEDBACK_ENABLED`	Incident → policy feedback loop

Incident webhook secrets

Used by /api/integrations/incidents/:provider when verifying inbound webhooks:

Variable	Provider
`CRITIQUE_INCIDENT_WEBHOOK_SECRET`	Generic shared secret (where supported)
`CRITIQUE_LINEAR_WEBHOOK_SECRET`	Linear
`CRITIQUE_SENTRY_WEBHOOK_SECRET`	Sentry
`CRITIQUE_JIRA_WEBHOOK_SECRET`	Jira
`CRITIQUE_VERCEL_WEBHOOK_SECRET`	Vercel

Leave unset to disable provider-specific verification for that route.

Product behavior for change control is documented in Change control.

Chat documentation tools (optional)

Variable	Purpose
`FIRECRAWL_API_KEY`	`searchDocs` / `fetchDocPage` in chat
`CONTEXT7_API_KEY`	`searchLibraryDocs` version-aware library docs

If unset, those chat tools return a clear “not configured” message.

Review, Remedy, and embeddings (common)

Hosted protocol rollout

These flags control additive hosted/native protocol consumers. They do not control the bundled CLI reviewer runtime: local task continuity, the Critique evidence plugin, specialist isolation, and strict repair verification are part of the CLI path. Trust checks remain fail-closed regardless of flag state.

Variable	Enables
`CRITIQUE_PROTOCOL_V1`	Native request, handoff, event, evidence, and completion protocol
`CRITIQUE_HANDOFF_V1`	Structured agent handoff ingestion
`CRITIQUE_EVIDENCE_V1`	Hosted/native protocol evidence and verifier-independence gates
`CRITIQUE_LIVE_EVENTS_V1`	Content event consumers and live session streaming
`CRITIQUE_SPECIALISTS_V1`	Parallel canonical specialist lanes and adjudication
`CRITIQUE_WORKSPACE_POOL_V1`	Local Git mirror and disposable worktree leases
`CRITIQUE_DAEMON_V1`	Bounded persistent read-only second-brain daemon
`CRITIQUE_ASSETS_V1`	State-keyed repository indexes and test/dependency metadata
`CRITIQUE_CLOUD_SNAPSHOTS_V1`	Tenant/repository/state-isolated cloud base snapshots

Cloud snapshots also require E2B_API_KEY; CRITIQUE_FINISH_CLOUD_SANDBOX_TEMPLATE_ID selects the credential-free base template. See Independent verification protocol and Local verification threat model.

See .env.example for the full list. Frequently tuned:

Variable	Notes
`CRITIQUE_REVIEW_PROVIDER`, `CRITIQUE_REVIEW_MODEL`	Default review model routing
`CRITIQUE_REMEDY_EXECUTION`, `CRITIQUE_REMEDY_MODEL_ID`	Remedy sandbox execution
`CRITIQUE_CODE_EMBEDDING_MODEL`	Repository embedding model
`CRITIQUE_BETA_MODE`	Product beta gates

What users configure in the UI (not env)

User action	UI location	Operator prerequisite
OpenRouter / Crof BYOK	Settings	`CRITIQUE_SECRETS_ENCRYPTION_KEY`
Cursor / Anthropic / OpenAI BYOA	Settings	Same
Linear connection	Settings → Connections	Same
Critique API key (`crt_…`)	Connections → API keys	Same
Repository secrets	Dashboard → Automation	Same

Quick deployment checklist

Change Passports, Control Board, and merge policy

Run database migrations (prisma migrate deploy).
Set incident webhook secrets if using Control Board ingest.
Flags are on by default — no env required. To disable a feature, set its flag to false and redeploy.

Connections and MCP

Run migrations including user_connection and critique_api_key.
Set CRITIQUE_SECRETS_ENCRYPTION_KEY before exposing Connections in production.
Smoke-test: save Linear key → chat searchIssuesAndRoadmap; create crt_ key → GET /api/v1/passports and MCP tools/list.

Merge Gate API and webhooks

Run migrations including outbound_webhook_endpoint if not already applied.
Create crt_ key → smoke-test POST /api/v1/reviews and GET /api/v1/review-runs/:id?findings=all.
Register installation webhook → confirm review.run.completed delivers findings[].
Document agent loop for your team: Merge Gate API.

Merge Gate API — agent integrator reference
Connections, MCP & Platform API
BYOK
Event-driven pipeline

Environment Variables

On this page