Skip to main content
Reference for environment variables relevant to self-hosting Inbox Zero. Hosted-only billing, analytics, and internal operations variables are intentionally omitted unless they affect common self-hosted deployments.

​
Self-Hosting Environment Variables

* Conditional requirements:
  • DIRECT_URL is required only when Prisma migrations need a direct/unpooled database URL that differs from DATABASE_URL.
  • API_KEY_SALT is required only when external API keys are enabled with NEXT_PUBLIC_EXTERNAL_API_ENABLED=true.
  • TELEGRAM_BOT_SECRET_TOKEN is required only when TELEGRAM_BOT_TOKEN is set.
  • RECALL_API_KEY and RECALL_WEBHOOK_SECRET are both required when Meeting Recorder is enabled.
  • GOOGLE_PUBSUB_VERIFICATION_TOKEN is required when Gmail Pub/Sub push is enabled. If your deployment authenticates /api/google/webhook upstream, you can set it to an empty string to intentionally disable query-parameter verification.

​
Setup Guides

For detailed setup instructions, see the Setup Guides:

​
Notes

  • If running the app in Docker and Ollama locally, use http://host.docker.internal:11434/api as the OLLAMA_BASE_URL.
  • If running the app in Docker and an OpenAI-compatible server locally, replace localhost with host.docker.internal in OPENAI_COMPATIBLE_BASE_URL.
  • CLI LLM providers are experimental and depend on third-party community AI SDK provider packages that spawn local CLI tools. Review their source, pin exact versions, and only enable them on trusted self-hosted deployments.
  • When using Docker Compose with --profile all, database and Redis URLs are auto-configured. See the Docker/VPS Deployment Guide for details.
  • For image privacy, you can deploy the optional proxy separately and point NEXT_PUBLIC_IMAGE_PROXY_BASE_URL at it. See the Image Proxy guide.
  • For Azure OpenAI, set AZURE_RESOURCE_NAME and either AZURE_API_KEY or LLM_API_KEY when using azure as a default or fallback provider.
  • For Google Vertex, set GOOGLE_VERTEX_PROJECT when using vertex as a provider. For auth, use either GOOGLE_APPLICATION_CREDENTIALS (recommended for Node.js) or both GOOGLE_VERTEX_CLIENT_EMAIL and GOOGLE_VERTEX_PRIVATE_KEY. You do not need to set all three auth variables. See AI SDK Google Vertex documentation.
  • AUTH_ALLOWED_EMAILS and AUTH_ALLOWED_EMAIL_DOMAINS only restrict creation of new auth users. They do not retroactively block existing users, and they do not replace invitation-based organization access control.
  • If both auth allowlist variables are unset, sign-up remains open.
  • You can combine exact email allowlisting with domain allowlisting. For example, allow company.com broadly while also permitting a few personal addresses such as founders or contractors.