Environment Variables

Complete reference for all environment variables and secrets.

Required Secrets

These must be set via wrangler secret put:

ENCRYPTION_KEY

256-bit AES encryption key for protecting tenant provider API keys (Gemini and OpenAI) at rest.

# Generate
openssl rand -hex 32

# Set
wrangler secret put ENCRYPTION_KEY

Property	Value
Required	Yes
Format	64 hex characters
Used for	Encrypting tenant provider API keys (Gemini, OpenAI) in D1

ADMIN_TOKEN

Authentication token for admin API endpoints.

# Generate
openssl rand -hex 32

# Set
wrangler secret put ADMIN_TOKEN

Property	Value
Required	Yes (for admin features)
Format	Any secure string
Used for	/admin/* endpoint authentication

SESSION_SECRET

Secret for signing session cookies in the web console.

# Generate
openssl rand -hex 32

# Set
wrangler secret put SESSION_SECRET

Property	Value
Required	Yes (for web console)
Format	Any secure string
Used for	Cookie signing

Configuration Variables

Set in wrangler.jsonc under vars:

ENVIRONMENT

Deployment environment identifier.

{
  "vars": {
    "ENVIRONMENT": "production"
  }
}

Property	Value
Required	No
Default	development
Values	development, staging, production
Used for	Environment-specific behavior

LOG_LEVEL

Logging verbosity level.

{
  "vars": {
    "LOG_LEVEL": "info"
  }
}

Property	Value
Required	No
Default	info
Values	debug, info, warn, error
Used for	Controlling log output

R2_PUBLIC_URL

Public URL prefix for R2 bucket access.

{
  "vars": {
    "R2_PUBLIC_URL": "https://pub-xxx.r2.dev"
  }
}

Property	Value
Required	Yes
Format	HTTPS URL
Used for	Generating public image URLs

CORS_ORIGINS

Allowed origins for CORS requests.

{
  "vars": {
    "CORS_ORIGINS": "https://console.example.com,https://app.example.com"
  }
}

Property	Value
Required	No
Default	* (all origins)
Format	Comma-separated URLs
Used for	CORS header configuration

MAX_UPLOAD_SIZE_MB

Maximum file size for image uploads.

{
  "vars": {
    "MAX_UPLOAD_SIZE_MB": "20"
  }
}

Property	Value
Required	No
Default	20
Format	Integer (MB)
Used for	Upload validation

DEFAULT_RATE_LIMIT

Default rate limit for new tenants.

{
  "vars": {
    "DEFAULT_RATE_LIMIT": "60"
  }
}

Property	Value
Required	No
Default	60
Format	Integer (requests/minute)
Used for	New tenant defaults

DEFAULT_QUOTA_MB

Default monthly storage quota for new tenants.

{
  "vars": {
    "DEFAULT_QUOTA_MB": "10240"
  }
}

Property	Value
Required	No
Default	10240 (10 GB)
Format	Integer (MB)
Used for	New tenant defaults

Binding References

D1 Database

{
  "d1_databases": [
    {
      "binding": "DB",
      "database_name": "go-bananas-db",
      "database_id": "your-database-id"
    }
  ]
}

Code reference: env.DB

R2 Bucket

{
  "r2_buckets": [
    {
      "binding": "R2_IMAGES",
      "bucket_name": "go-bananas-images"
    }
  ]
}

Code reference: env.R2_IMAGES

KV Namespaces

{
  "kv_namespaces": [
    {
      "binding": "API_KEYS",
      "id": "your-kv-id"
    },
    {
      "binding": "TENANT_CONFIG",
      "id": "your-kv-id"
    }
  ]
}

Code references: env.API_KEYS, env.TENANT_CONFIG

Durable Objects

{
  "durable_objects": {
    "bindings": [
      {
        "name": "MCP_OBJECT",
        "class_name": "GoBananasMcpAgent"
      }
    ]
  }
}

Code reference: env.MCP_OBJECT

Environment-Specific Configuration

Development

// wrangler.jsonc
{
  "vars": {
    "ENVIRONMENT": "development",
    "LOG_LEVEL": "debug",
    "R2_PUBLIC_URL": "http://localhost:8787/r2"
  }
}

Staging

// wrangler.jsonc
{
  "env": {
    "staging": {
      "vars": {
        "ENVIRONMENT": "staging",
        "LOG_LEVEL": "info",
        "R2_PUBLIC_URL": "https://staging-pub-xxx.r2.dev"
      }
    }
  }
}

Production

// wrangler.jsonc
{
  "env": {
    "production": {
      "vars": {
        "ENVIRONMENT": "production",
        "LOG_LEVEL": "warn",
        "R2_PUBLIC_URL": "https://pub-xxx.r2.dev"
      }
    }
  }
}

Local Development

.dev.vars

For local development, create .dev.vars:

# .dev.vars (not committed to git)
ENCRYPTION_KEY=your-64-char-hex-key
ADMIN_TOKEN=local-admin-token
SESSION_SECRET=local-session-secret

.env (for scripts)

# .env
ENCRYPTION_KEY=your-64-char-hex-key

Environment Variable Validation

At startup, Go Bananas! validates required variables:

function validateEnv(env: Env): void {
  if (!env.ENCRYPTION_KEY || env.ENCRYPTION_KEY.length !== 64) {
    throw new Error('ENCRYPTION_KEY must be 64 hex characters');
  }

  if (!env.R2_PUBLIC_URL) {
    throw new Error('R2_PUBLIC_URL is required');
  }
}

Security Best Practices

Never Commit Secrets

Add to .gitignore:

.dev.vars
.env
*.pem
*.key

Rotate Secrets Regularly

# Generate new key
NEW_KEY=$(openssl rand -hex 32)

# Update secret
wrangler secret put ENCRYPTION_KEY

# Re-encrypt existing data (if applicable)
npm run rotate-encryption-key

Use Different Keys Per Environment

# Development
wrangler secret put ENCRYPTION_KEY --env development

# Staging
wrangler secret put ENCRYPTION_KEY --env staging

# Production
wrangler secret put ENCRYPTION_KEY --env production

Next Steps

• Configuration Guide →
• Troubleshooting →
• Reference Index →