Overview
CheckThat AI uses environment variables to configure API keys, database connections, and application settings. This page provides a comprehensive reference for all available environment variables.Quick Setup
Model Provider API Keys
Configure API keys for the AI model providers you plan to use. At least one provider is required.OpenAI
OpenAI API key for GPT models (GPT-4, GPT-4o, GPT-4.1).How to get:
- Sign up at platform.openai.com
- Navigate to API Keys section
- Create a new secret key
sk-proj-... or sk-...Supported Models:gpt-4gpt-4ogpt-4-turbogpt-4-32kgpt-3.5-turbo
Anthropic (Claude)
Anthropic API key for Claude models (Claude 3.7 Sonnet, Claude 3.5 Sonnet).How to get:
- Sign up at console.anthropic.com
- Navigate to API Keys
- Create a new API key
sk-ant-api03-...Supported Models:claude-3-7-sonnet-20250219claude-3-5-sonnet-20241022claude-3-opus-20240229claude-3-sonnet-20240229
Google Gemini
Google API key for Gemini models (Gemini 2.5 Pro, Gemini 2.5 Flash).How to get:
- Visit ai.google.dev
- Get API key from Google AI Studio
- Enable Gemini API in Google Cloud Console
AIzaSy...Supported Models:gemini-2.0-flash-expgemini-1.5-progemini-1.5-flash
xAI (Grok)
xAI API key for Grok models.How to get:
- Sign up at x.ai
- Access the developer console
- Generate an API key
xai-...Supported Models:grok-3grok-betagrok-vision-beta
Together.ai (Llama)
Together.ai API key for Llama models.How to get:
- Sign up at together.ai
- Navigate to API section
- Create a new API key
meta-llama/Llama-3.3-70B-Instruct-Turbo-Free(Free tier available)meta-llama/Llama-3.1-70B-Instruct-Turbometa-llama/Llama-3.1-8B-Instruct-Turbo
Together.ai offers free tier models that don’t require an API key for basic usage.
Database Configuration (Supabase)
Supabase is used for authentication and storing conversation history.Supabase URL
Your Supabase project URL.How to get:
- Create project at supabase.com
- Go to Project Settings → API
- Copy the Project URL
https://xxxxxxxxxxxxx.supabase.coSupabase Anonymous Key
Public anonymous key for client-side authentication.How to get:
- Supabase Project Settings → API
- Copy the
anonpublickey
eyJhbGc...Supabase Service Key
Server-side service key with admin privileges.How to get:
- Supabase Project Settings → API
- Copy the
service_rolesecretkey
eyJhbGc...Supabase JWT Secret
JWT secret for verifying authentication tokens.How to get:
- Supabase Project Settings → API
- Copy the JWT Secret
Application Configuration
Environment Type
Application environment type.Values:
dev- Development mode with verbose logging and permissive CORSprod- Production mode with optimized settings
- Logging verbosity (DEBUG vs INFO)
- CORS origin configuration
- Error message detail level
CORS Origins
Comma-separated list of allowed CORS origins.Values:
*- Allow all origins (public API)- Specific domains:
https://www.checkthat-ai.com,https://checkthat-ai.com
- Use
*for public APIs - Specify domains for private APIs
Logging Level
Application logging level.Values:
DEBUG- Verbose logging (development)INFO- Standard logging (production)WARNING- Warnings and errors onlyERROR- Errors only
Frontend-Specific Variables
Frontend environment variables must be prefixed withVITE_ to be accessible in the browser.
Backend API URL
URL of the backend API server.Development:
http://localhost:8000Production: Your deployed backend URLEnvironment Variable Summary
Required Variables
| Variable | Component | Description |
|---|---|---|
| At least one of: | Backend | Model provider API key |
OPENAI_API_KEY | Backend | OpenAI GPT models |
ANTHROPIC_API_KEY | Backend | Anthropic Claude models |
GEMINI_API_KEY | Backend | Google Gemini models |
GROK_API_KEY | Backend | xAI Grok models |
SUPABASE_URL | Both | Supabase project URL |
SUPABASE_SERVICE_KEY | Backend | Admin access to Supabase |
SUPABASE_JWT_SECRET | Backend | JWT verification |
VITE_SUPABASE_URL | Frontend | Supabase URL for client |
VITE_SUPABASE_ANON_KEY | Frontend | Public authentication key |
VITE_BACKEND_URL | Frontend | Backend API endpoint |
Optional Variables
| Variable | Default | Description |
|---|---|---|
ENV_TYPE | dev | Environment type |
CORS_ORIGINS | * | Allowed CORS origins |
LOG_LEVEL | INFO | Logging verbosity |
TOGETHER_API_KEY | - | Together.ai Llama models |
Security Best Practices
Local Development
Local Development
- Use
.envfiles: Create a.envfile in the root directory - Never commit
.env: Add to.gitignore - Use
.env.example: Template without actual values - Rotate keys regularly: Generate new keys periodically
.gitignore
Production Deployment
Production Deployment
- Use secrets management: GitHub Secrets, Railway Variables, etc.
- Different keys per environment: Separate dev/prod keys
- Principle of least privilege: Only grant necessary permissions
- Monitor usage: Track API calls and costs
- Set spending limits: Configure budget alerts
Key Management
Key Management
- Never hardcode keys: Always use environment variables
- Never log keys: Exclude from logs and error messages
- Never share keys: Use separate keys per team member
- Revoke compromised keys: Immediately rotate exposed keys
- Use key rotation: Change keys on a regular schedule
Frontend vs Backend
Frontend vs Backend
- Backend Only:
- Model provider API keys
- Supabase service key
- JWT secret
- Frontend Safe (with
VITE_prefix):- Supabase URL
- Supabase anonymous key
- Backend URL
- Never expose in frontend:
- Service keys
- Model provider API keys
- JWT secrets
Configuration Files
.env.example (Template)
Create this file in your repository root:.env.example
.env (Local Development)
Copy.env.example and fill in actual values:
Troubleshooting
Variables Not Loading
Variables Not Loading
Symptoms: Application can’t find API keysSolutions:
- Verify
.envfile location (project root) - Restart development server after changes
- Check for typos in variable names
- Ensure no extra spaces or quotes
- Use correct prefix (
VITE_for frontend)
CORS Errors
CORS Errors
Symptoms: Frontend can’t connect to backendSolutions:
- Set
CORS_ORIGINS=*for development - Add frontend URL to
CORS_ORIGINSin production - Verify
VITE_BACKEND_URLis correct - Check backend CORS configuration
Authentication Errors
Authentication Errors
Symptoms: Supabase authentication failingSolutions:
- Verify all Supabase variables are set
- Check Supabase project is active
- Ensure JWT secret matches project
- Verify Row Level Security policies
- Check service key is not exposed in frontend
Model API Errors
Model API Errors
Symptoms: AI model requests failingSolutions:
- Verify API key is valid and active
- Check API key has sufficient credits/quota
- Ensure correct key format (no extra spaces)
- Test key directly with provider’s API
- Check for rate limiting or spending limits
Verification Script
Create a script to verify your environment configuration:check_env.py
Next Steps
Local Setup
Set up your local development environment
Production Deployment
Deploy to production with proper configuration
Model Configuration
Configure and use different AI models
Security Guide
Advanced security best practices