Environment & Tooling
Complete reference for all environment variables used across the monorepo. Variables are split between the web app (Next.js) and the functions backend (Firebase Cloud Functions).
System requirements
| Tool | Version | Purpose |
|---|---|---|
| Node.js | 22 | Runtime (enforced via engines in root package.json) |
| pnpm | 9.12.2+ | Package manager (specified via packageManager field) |
| Firebase CLI | Latest | Functions deployment and emulators |
| gcloud CLI | Latest | Cloud Tasks queue management |
| Turbo | 2.5+ | Monorepo task runner (installed as devDependency) |
Web app variables (apps/web/.env.local)
Firebase (client-side)
These are exposed to the browser via the NEXT_PUBLIC_ prefix.
NEXT_PUBLIC_FIREBASE_API_KEY=
NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=
NEXT_PUBLIC_FIREBASE_PROJECT_ID=
NEXT_PUBLIC_FIREBASE_APP_ID=
NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=
NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID= # Optional, for Google Analytics
Firebase Admin (server-side)
FIREBASE_SERVICE_ACCOUNT_BASE64=
Base64-encode your service account JSON:
base64 -i service-account.json. Used byfirebase-adminin Next.js API routes for session cookie management.
Stripe
STRIPE_SECRET_KEY=sk_test_...
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...
STRIPE_STARTER_PRICE_ID=price_...
STRIPE_PRO_PRICE_ID=price_...
Important notes
- Never expose secret keys on the client. Only
NEXT_PUBLIC_*variables are bundled into client-side code. NEXT_PUBLIC_FIREBASE_STORAGE_BUCKETshould match the bucket name in Firebase Console (e.g.,my-project.firebasestorage.app).- You can verify env variable presence at runtime using the
/api/debug-envendpoint (shows presence, not values).
Functions backend variables
These are set in the Cloud Functions runtime environment. For local development, use apps/functions/.env or Firebase's environment configuration.
Storage and orchestration
MEDIA_BUCKET= # Cloud Storage bucket name
MEDIA_PUBLIC_BASE_URL=https://storage.mysoku.io # Public media proxy base URL
FUNCTION_REGION=us-central1 # Must match Cloud Tasks queue region
Social platform credentials
Facebook / Instagram / Threads (Meta)
FACEBOOK_APP_ID=
FACEBOOK_APP_SECRET=
FACEBOOK_CALLBACK_URL= # Optional override
INSTAGRAM_APP_ID=
INSTAGRAM_APP_SECRET=
INSTAGRAM_CALLBACK_URL= # Optional override
THREADS_APP_ID=
THREADS_APP_SECRET=
THREADS_CALLBACK_URL= # Optional override
X (Twitter)
X_CLIENT_ID=
X_CLIENT_SECRET=
X_CALLBACK_URL= # Optional override
# OAuth 1.0a credentials (for v1.1 API endpoints)
X_CONSUMER_KEY=
X_CONSUMER_SECRET=
X_OAUTH1_CALLBACK_URL= # Optional override
TikTok
TIKTOK_CLIENT_KEY=
TIKTOK_CLIENT_SECRET=
TIKTOK_CALLBACK_URL= # Optional override
# Optional: TikTok content verification
TIKTOK_VERIFY_FILENAME=
TIKTOK_VERIFY_CONTENT=
YouTube
YOUTUBE_CLIENT_ID=
YOUTUBE_CLIENT_SECRET=
YOUTUBE_CALLBACK_URL= # Optional override
LinkedIn
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=
LINKEDIN_CALLBACK_URL= # Optional override
Snapchat
SNAPCHAT_CLIENT_ID=
SNAPCHAT_CLIENT_SECRET=
SNAPCHAT_CALLBACK_URL= # Optional override
Payments and AI
STRIPE_WEBHOOK_SECRET= # Stripe webhook signing secret
OPENAI_API_KEY= # For transcription and caption generation
Optional
APIFY_TOKEN= # TikTok polling helper (optional)
Notes
MEDIA_PUBLIC_BASE_URLmaps to themediaCloud Function domain; returned URLs use this base for public access.FUNCTION_REGIONmust match the region where your Cloud Tasks queues are created.- Callback URL overrides are optional. If not set, callbacks default to the deployed Cloud Function URL. Use overrides when running behind a proxy or custom domain.
Turbo global environment
These variables are declared in turbo.json under globalEnv so Turborepo's cache correctly invalidates when they change:
{
"globalEnv": [
"NEXT_PUBLIC_FIREBASE_API_KEY",
"NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN",
"NEXT_PUBLIC_FIREBASE_PROJECT_ID",
"NEXT_PUBLIC_FIREBASE_APP_ID"
]
}
Related docs
- Firebase Setup — Firebase project configuration
- Stripe Setup — Products, webhooks, and credits
- Vercel Environment Variables — Production deployment config
- Secrets & Configuration — Secret management practices