---
title: "Environment variables | FoxAuth"
description: "The only process environment the server reads. Everything else is a setting in the database."
canonical: "https://foxauth.dev/docs/reference/environment/"
lastmod: "2026-09-29T12:22:55+03:00"
---
Environment variables

Documents unreleased changes made after v1.1.0 (commit 16f191bb)

This page is generated from the main branch. The published image
ghcr.io/redfox-soft/oauth-server-ts:latest is v1.1.0
and may not have everything listed here.

VariableRequirementDescriptionExample
ISSUERrequiredCanonical public URL of this authorization server. It is the `iss` of every token, the base of every endpoint advertised in discovery, and the redirect target of the admin console client.https://auth.example.com
MONGODB_URIrequiredMongoDB connection string, and the setting that selects MongoDB as the datastore. Required when MongoDB is the chosen backend; leave it unset to run on PostgreSQL. Setting it together with `POSTGRES_URL` is refused at startup — a deployment uses exactly one datastore, and silently preferring one of two configured databases is indistinguishable from total data loss. Not read when NODE_ENV is `test`, where the in-memory adapter is used instead.mongodb://localhost:27017
DATABASE_NAMErequiredName of the MongoDB database holding every collection. Required alongside `MONGODB_URI`; PostgreSQL takes its database name from the connection URL instead, so this is unused there. Not read when NODE_ENV is `test`.OAuth
POSTGRES_URLoptionalPostgreSQL connection string, and the setting that selects PostgreSQL as the datastore instead of MongoDB. The database name is part of the URL, so `DATABASE_NAME` is not used. Setting it together with `MONGODB_URI` is refused at startup. Named `POSTGRES_URL` rather than the conventional `DATABASE_URL` deliberately: a name that generic is eventually set by something else in a container, and it would then select a backend nobody chose.postgres://user:password@localhost:5432/oauth
NODE_ENVoptional`test` selects the in-memory storage adapter and the capturing mail transport, and disables outbound Sentry delivery. Any other value is reported to Sentry as the environment label; the Docker image sets `production`.production
Signing keys, SMTP, the DPoP nonce secret and the pairwise salt are not environment variables: they live in the database and are provisioned by bun run db:setup or generated on first boot.

PreviousAddon seams