Environment variables

This page is for self-hosters and operators. On the managed cloud these are already set for you; you only need them if you’re running the backend yourself.

The backend reads configuration from environment variables (or a .env file) via backend/app/config/settings.py — the source of truth. Each variable below is the uppercased form of a settings field.

Core

Variable	Purpose	Default
`ENVIRONMENT`	`development` or `production`. Production enables strict checks.	`development`
`DEBUG`	Verbose error output. Turn off in production.	`true`
`RATE_LIMIT_ENABLED`	Per-IP rate limits on auth endpoints. Set `true` in production.	`false`
`TRIAL_DAYS`	Reverse trial: new workspaces start on Pro for this many days, then drop to Free. `0` disables trials.	`14`
`EXECUTION_MODE`	`playwright` (real) or `simulate` (fake, for dev).	`playwright`
`MAX_RUN_SECONDS`	Wall-clock ceiling per run; kills runaway runs. `0` = off.	`1800`
`MAX_CONCURRENT_BROWSERS`	Max live browsers per worker process; excess runs wait for a permit instead of risking out-of-memory. Size to instance RAM.	`8`
`FRONTEND_URL`	Base URL of the web app; used in email links and OAuth redirects.	`http://localhost:5173`
`CORS_ORIGINS`	Comma-separated allowed origins. Never `*` in production.	localhost dev origins

Storage and database

Variable	Purpose	Default
`STORAGE_MODE`	`memory` (ephemeral dev) or `database` (Postgres). Production uses `database`.	`memory`
`DATABASE_URL`	Async Postgres URL (`postgresql+asyncpg://…`).	local Postgres
`DATABASE_URL_SYNC`	Sync Postgres URL (`postgresql://…`) for the scheduler jobstore.	local Postgres
`DATABASE_POOL_SIZE`	SQLAlchemy pool size.	`5`
`DATABASE_MAX_OVERFLOW`	Extra connections beyond the pool.	`10`
`DATABASE_ECHO`	Log every SQL statement.	`false`

Scaling (multi-worker)

Variable	Purpose	Default
`REDIS_URL`	Enables shared state, cross-worker WebSocket broadcast, and the run watchdog. Empty = single-worker mode.	—
`WEB_CONCURRENCY`	Number of web-server worker processes.	server default

AI providers and routing

Each AI task picks a provider + model independently. Set the key for any provider you use.

Variable	Purpose	Default
`OPENAI_API_KEY`	OpenAI key (platform default for visual comparison).	—
`ANTHROPIC_API_KEY`	Anthropic key.	—
`GROQ_API_KEY`	Groq key.	—
`GEMINI_API_KEY`	Google Gemini key (platform default for parsing + translation).	—
`OLLAMA_BASE_URL`	Ollama server URL (local models).	`http://ollama:11434`
`OLLAMA_MODEL`	Default Ollama model.	`qwen3:8b`
`PARSING_PROVIDER` / `PARSING_MODEL`	Provider + model for English → steps.	`gemini` / `gemini-3.1-flash-lite`
`TRANSLATION_PROVIDER` / `TRANSLATION_MODEL`	Provider + model for non-English → English.	`gemini` / `gemini-3.1-flash-lite`
`VISUAL_COMPARISON_PROVIDER` / `VISUAL_COMPARISON_MODEL`	Provider + model for visual diffs.	`openai` / `gpt-4o-mini`
`OPENAI_MODEL`	Default OpenAI model.	`gpt-4o-mini`
`VISUAL_PIXEL_THRESHOLD`	Pixel-diff fraction below which a visual step passes without a vision call.	`0.005`
`BYOK_ENCRYPTION_KEY`	Fernet key that enables per-user BYOK. Empty = BYOK disabled (routes return `503`).	—

See BYOK for what BYOK_ENCRYPTION_KEY unlocks.

Auth and security

Variable	Purpose	Default
`JWT_SECRET_KEY`	Signs access tokens. Must change in production.	dev default (rejected in prod)
`SESSION_SECRET_KEY`	Signs sessions. Must change in production.	dev default (rejected in prod)
`JWT_ALGORITHM`	JWT signing algorithm.	`HS256`
`JWT_ACCESS_TOKEN_EXPIRE_MINUTES`	Access-token lifetime.	`30`
`JWT_REFRESH_TOKEN_EXPIRE_DAYS`	Refresh-token lifetime.	`7`
`AUTH_PROVIDER`	Auth backend.	`local`
`EMAIL_VERIFICATION_EXPIRE_MINUTES`	Verification-link lifetime.	`15`
`PASSWORD_RESET_EXPIRE_MINUTES`	Password-reset-link lifetime.	`30`

OAuth (optional)

Variable	Purpose
`GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET`	Google sign-in. Both required to enable it.
`GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`	GitHub sign-in. Both required to enable it.

Email

Configure either SMTP or Resend. Email powers verification, invites, and run-report notifications.

Variable	Purpose	Default
`RESEND_API_KEY`	Use Resend’s HTTP API for sending.	—
`SMTP_HOST` / `SMTP_PORT`	SMTP server.	`localhost` / `1025`
`SMTP_USERNAME` / `SMTP_PASSWORD`	SMTP auth.	—
`SMTP_TLS` / `SMTP_SSL`	SMTP transport security.	`false` / `false`
`EMAIL_FROM_ADDRESS` / `EMAIL_FROM_NAME`	Sender identity.	`noreply@marriska.dev` / `Marriska`

Payments (optional)

Variable	Purpose	Default
`PAYMENT_PROVIDER`	`dev` (self-confirm bypass, rejected in production), `stripe`, or `paddle`.	`dev`
`STRIPE_SECRET_KEY` / `STRIPE_WEBHOOK_SECRET`	Stripe credentials (both needed for Stripe).	—
`PADDLE_API_KEY` / `PADDLE_WEBHOOK_SECRET`	Paddle credentials.	—
`PADDLE_ENVIRONMENT`	`sandbox` or `production`.	`sandbox`
`PADDLE_PRICE_<TIER>_<CYCLE>`	Paddle price IDs, e.g. `PADDLE_PRICE_PRO_MONTHLY`.	—

Observability

Variable	Purpose
`SENTRY_DSN`	Enables Sentry error reporting (production).

CLI variables

The marriska-runner and marriska-agent CLIs read their own variables — MARRISKA_API_KEY, MARRISKA_API_URL, MARRISKA_WS_URL. They’re documented in the CLI reference.