Alchemist: Environment Variables
Configure secrets and environment variables for your deployed Alchemist app.
The platform pre-injects a small set of credentials into every project so that storage, transactional email, and session signing work out of the box. You don’t need to provision these yourself, and you should not hardcode alternative credentials in your code.
Pre-injected variables
| Variable | Purpose |
|---|---|
JWT_SECRET | Per-project secret for signing session cookies. Used by the auth middleware. |
R2_ENDPOINT, R2_BUCKET, R2_KEY_PREFIX, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY | Cloudflare R2 (S3-compatible) credentials for uploads. Multi-tenant; every object key MUST start with R2_KEY_PREFIX. |
SMTP_HOST, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORD, EMAIL_FROM | SMTP2GO transactional email credentials. Use EMAIL_FROM verbatim for the From header. |
The agent knows about these and reaches for them automatically when you ask for features that need storage or email — image upload, password reset emails, signup confirmations, etc.
Auth providers (opt-in)
Email OTP login is always on. OAuth providers register themselves when both halves of their credential pair are present:
| Provider | Variables |
|---|---|
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET | |
| Microsoft | MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET |
| GitHub | GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET |
Add the pair in your project Settings and the login page picks up the new button on the next deploy. No code change required.
Your own variables
For anything else — a Stripe key, a third-party API token, a feature flag — set the variable in your project Settings. It’s mounted into the running app’s environment on the next deploy. Removing a variable takes effect on the next deploy as well; live pods are not patched in place.
What NOT to commit
Never commit secrets to the repo. The platform-injected variables above are
read from the environment, not from a checked-in .env file, and your own
variables should follow the same pattern.