Environment Variables - Streamly

Never commit .env.local or .dev.vars. Never expose SUPABASE_SERVICE_ROLE_KEY, TENANT_SECRETS_MASTER_KEY, or STREAMLY_CRON_SECRET to the browser.

Copy templates:

cp .env.example .env.local          # local Next.js
cp .dev.vars.example .dev.vars      # Cloudflare preview

Core URLs

Variable	Required	Description
`NEXT_PUBLIC_APP_URL`	Yes	Canonical public URL
`NEXT_PUBLIC_PLATFORM_HOST`	Yes	Platform host (no scheme)
`NEXT_PUBLIC_STREAMLY_API_BASE`	Yes	Usually `{APP_URL}/api/v1`

Supabase

Variable	Required	Description
`NEXT_PUBLIC_SUPABASE_URL`	Yes	Project URL
`NEXT_PUBLIC_SUPABASE_ANON_KEY`	Yes	Anon key
`SUPABASE_SERVICE_ROLE_KEY`	Yes	Server-only

Server secrets

Variable	Required	Description
`TENANT_SECRETS_MASTER_KEY`	Yes	32-byte key (`openssl rand -base64 32`)
`STREAMLY_CRON_SECRET`	Yes	Authenticates `/api/internal/jobs/run`

Variable	Required in prod	Description
`RESEND_API_KEY`	Yes (unless demo gate)	Sends operator magic-link email
`STREAMLY_FROM_EMAIL`	Recommended	From header (default mentions `streamly.watch`)
`ENVATO_PERSONAL_TOKEN`	Yes	Purchase-code verification
`ENVATO_ITEM_ID`	Optional	Restrict activation to one Envato item

Optional product

Variable	Description
`TMDB_API_TOKEN`	Server-side metadata (never expose to Flutter/browsers)
`ENABLE_DEMO` / `ADMIN_ALLOW_DEMO_LICENSE`	Demo license UX — off in production
`PUBLIC_CATALOG_TENANT_SLUG` / `DEV_TENANT_SLUG`	Pin default tenant
`STREAMLY_LIVE_TMDB_HYDRATE`	Live title hydrate (off by default)
`STREAMLY_IMAGE_PROXY` / `NEXT_PUBLIC_STREAMLY_IMAGE_PROXY`	Poster proxy via `/api/v1/media/tmdb`

Cloudflare preview (`.dev.vars`)

Variable	Description
`NEXTJS_ENV`	Set to `development` for `pnpm run preview:cloudflare` (see `.dev.vars.example`)

Cloudflare for SaaS (optional)

Variable	Description
`CLOUDFLARE_ACCOUNT_ID`	Account
`CLOUDFLARE_ZONE_ID`	Zone
`CLOUDFLARE_CUSTOM_HOSTNAMES_API_TOKEN`	API token
`CLOUDFLARE_SAAS_FALLBACK_HOST`	Default `customers.streamly.watch`

Payments

Configured through /admin/plugins → Stripe fields (publishableKey, secretKey, webhookSecret, optional Connect fields) — not as core Stripe keys in .env.example. See Stripe.