.env file in the root of your project with the following variables.
Database
PostgreSQL database connection string. Used by Prisma to connect to your database.Format:
postgresql://USER:PASSWORD@HOST:PORT/DATABASE?schema=publicExample: postgresql://postgres:[email protected]:5432/postgresAuthentication
Secret key used to encrypt JWT tokens and session data. Generate a secure random string.Generate with:
openssl rand -base64 32The canonical URL of your site. Used by NextAuth for redirects and callbacks.Development:
http://localhost:3000Production: https://yourdomain.comOAuth 2.0 Client ID from Google Cloud Console. Required for Google Sign-In.Get this from Google Cloud Console
OAuth 2.0 Client Secret from Google Cloud Console. Keep this secure.
AI Services
API key for Google’s Gemini AI models. Used for document summarization, chat, flashcard generation, and evaluation.Models used:
gemini-2.5-flash- Chat, summarization, flashcardsgemini-1.5-pro- Answer evaluation
Hugging Face API key for text embeddings. Used to generate vector embeddings for document search.Model:
sentence-transformers/all-MiniLM-L6-v2Get your API key from Hugging Face SettingsVector Database
API key for Pinecone vector database. Used to store and query document embeddings.Index name:
uxieGet your API key from Pinecone ConsolePinecone environment/region where your index is hosted.Example:
us-east-1-aws or gcp-starterFile Storage
API token for UploadThing file storage. Used to handle PDF uploads.Max file size: 8MB per PDFMax file count: 1 per uploadGet your token from UploadThing Dashboard
Real-time Collaboration
Public API key for Liveblocks real-time collaboration features.Get your API key from Liveblocks Dashboard
This is a public key (prefixed with
NEXT_PUBLIC_) and will be exposed to the client. Use the public key, not the secret key.Application
Node.js environment mode.Options:
development- Local developmentproduction- Production deploymenttest- Testing environment
Example Configuration
.env
Security Best Practices
- Use strong, randomly generated secrets for
NEXTAUTH_SECRET - Rotate API keys regularly
- Use different credentials for development and production
- Store production secrets in a secure secrets manager
- Limit API key permissions to only what’s needed
