.env.example

# Configuration reference: http://docs.postiz.com/configuration/reference

# === Required Settings
DATABASE_URL="postgresql://postiz-user:postiz-password@localhost:5432/postiz-db-local"
REDIS_URL="redis://localhost:6379"
JWT_SECRET="random string for your JWT secret, make it long"

# === This needs to be exactly the URL you're accessing Postiz on
FRONTEND_URL="http://localhost:4200"
NEXT_PUBLIC_BACKEND_URL="http://localhost:3000"
BACKEND_INTERNAL_URL="http://localhost:3000"

## Remember to set your public internet IP address in the allow-list for the API token.
##
## Cloudflare is currently required to save things like social media avatars for accounts.
CLOUDFLARE_ACCOUNT_ID="your-account-id"
CLOUDFLARE_ACCESS_KEY="your-access-key"
CLOUDFLARE_SECRET_ACCESS_KEY="your-secret-access-key"
CLOUDFLARE_BUCKETNAME="your-bucket-name"
CLOUDFLARE_BUCKET_URL="https://your-bucket-url.r2.cloudflarestorage.com/"
CLOUDFLARE_REGION="auto"
## Optional media normalization (postiz-uploader on RunPod Serverless). Requires STORAGE_PROVIDER="cloudflare".
## When set, web uploads are transcoded to 1080p h264 mp4 / downsized images in the background;
## the media record reports status "processing" until the normalized file replaces the original.
#RUNPOD_API_KEY=""
#RUNPOD_ENDPOINT_ID=""
## Optional video clipping (YouTube video -> captioned vertical clips -> draft posts). Requires STORAGE_PROVIDER="cloudflare",
## RUNPOD_API_KEY (with access to both endpoints below) and OPENAI_API_KEY. Ingest jobs go to the CPU endpoint, clip jobs to the
## GPU endpoint of postiz-uploader (which needs its own Oxylabs account to fetch from YouTube); Deepgram transcribes videos
## that have no usable captions.
#RUNPOD_INGEST_ENDPOINT_ID=""
#RUNPOD_CLIPPER_ENDPOINT_ID=""
#DEEPGRAM_API_KEY=""

# === Common optional Settings

## This is a dummy key, you must create your own from Resend.
## If this variable exists, user activation is required.
## If it is commented out, users are activated automatically.
#RESEND_API_KEY="RzeTwHijvxvPUerScFcenUZUALuQJzSaGSMJ"
#EMAIL_FROM_ADDRESS=""
#EMAIL_FROM_NAME=""
#DISABLE_REGISTRATION=false

# Where will social media icons be saved - local or cloudflare.
STORAGE_PROVIDER="local"

# Your upload directory path if you host your files locally, otherwise Cloudflare will be used.
#UPLOAD_DIRECTORY=""

# Your upload directory path if you host your files locally, otherwise Cloudflare will be used.
#NEXT_PUBLIC_UPLOAD_STATIC_DIRECTORY=""

# Only needed if you run your own Postiz Canva app: its origin from the Canva
# Developer Portal (Security -> Credentials), allowed by CORS on the backend.
#CANVA_APP_ORIGIN="https://app-xxxxxxxxxxx.canva-apps.com"

# Sign in with Apple (login provider)
# APPLE_BUNDLE_ID: iOS app bundle id (native mobile sign-in)
# APPLE_SERVICE_ID / TEAM_ID / KEY_ID / PRIVATE_KEY: web sign-in (Services ID + .p8 key)
APPLE_BUNDLE_ID=""
APPLE_SERVICE_ID=""
APPLE_TEAM_ID=""
APPLE_KEY_ID=""
APPLE_PRIVATE_KEY=""

# Social Media API Settings
X_URL=""
X_API_KEY=""
X_API_SECRET=""
LINKEDIN_CLIENT_ID=""
LINKEDIN_CLIENT_SECRET=""
REDDIT_CLIENT_ID=""
REDDIT_CLIENT_SECRET=""
GITHUB_CLIENT_ID=""
GITHUB_CLIENT_SECRET=""
# Sign in with Apple, client id is the Services ID identifier
APPLE_CLIENT_ID=""
APPLE_TEAM_ID=""
APPLE_KEY_ID=""
APPLE_PRIVATE_KEY=""
# --- Sign in with Farcaster (Neynar)
#NEYNAR_CLIENT_ID="" # still gates the Farcaster login button in the UI
#NEYNAR_SECRET_KEY=""
#NEYNAR_APP_FID="" # Farcaster id of the account that represents your app (the one users see requesting access)
#NEYNAR_APP_MNEMONIC="" # recovery phrase of that account's custody wallet, used only to sign managed-signer key requests
#NEYNAR_SPONSOR_SIGNERS="false" # "true" lets Neynar pay the on-chain signer fee (billed to your Neynar credits); otherwise the user pays in Warpcast
BEEHIIVE_API_KEY=""
BEEHIIVE_PUBLICATION_ID=""
LISTMONK_DOMAIN=""
LISTMONK_USER=""
LISTMONK_API_KEY=""
LISTMONK_LIST_ID=""
THREADS_APP_ID=""
THREADS_APP_SECRET=""
FACEBOOK_APP_ID=""
FACEBOOK_APP_SECRET=""
YOUTUBE_CLIENT_ID=""
YOUTUBE_CLIENT_SECRET=""
TIKTOK_CLIENT_ID=""
TIKTOK_CLIENT_SECRET=""
TIKTOK_BUSINESS_CLIENT_ID=""
TIKTOK_BUSINESS_CLIENT_SECRET=""
PINTEREST_CLIENT_ID=""
PINTEREST_CLIENT_SECRET=""
DRIBBBLE_CLIENT_ID=""
DRIBBBLE_CLIENT_SECRET=""
TUMBLR_CLIENT_ID=""
TUMBLR_CLIENT_SECRET=""
DISCORD_CLIENT_ID=""
DISCORD_CLIENT_SECRET=""
DISCORD_BOT_TOKEN_ID=""
SLACK_ID=""
SLACK_SECRET=""
SLACK_SIGNING_SECRET=""
MASTODON_URL="https://mastodon.social"
MASTODON_CLIENT_ID=""
MASTODON_CLIENT_SECRET=""

# Chrome Extension Settings (for cookie-based platform integrations like Skool)
EXTENSION_ID=""

# Misc Settings
OPENAI_API_KEY=""
# OAuth client configured for the ChatGPT app. Only this client can receive
# verified user email claims for ChatGPT Enterprise domain restrictions.
OPENAI_OAUTH_CLIENT_ID=""
# MCP OAuth Dynamic Client Registration (RFC 7591) redirect-domain allowlist.
# When set (comma separated), POST /oauth/register only accepts redirect_uris
# whose host matches a listed domain or one of its subdomains; unset or empty
# means any client can self-register. Only https callbacks are checked:
# loopback (http://localhost:8787/callback - Grok, Claude Code) and
# private-use scheme callbacks (cursor://...) stay on the user's machine
# and are always accepted. Example locks web callbacks to the claude.ai
# connector; add cursor.com for Cursor.
# DCR_VERIFIED_DOMAINS="claude.ai,claude.com"
# Postiz Cloud only: lets people connect a self-hosted Postiz on the MCP
# consent screen ("Use self-hosted"). The MCP tool calls of that connection
# are relayed to the instance with its API key. Leave unset on self-hosted
# installs; set it on both the API and the MCP backend.
# MCP_SELF_HOSTED_RELAY=true
# EVOLINK_API_KEY="" # EvoLink API key for Seedance AI video generation (https://evolink.ai)
NEXT_PUBLIC_DISCORD_SUPPORT=""
NEXT_PUBLIC_POLOTNO=""
# NOT_SECURED=false
API_LIMIT=30 # The limit of the public API hour limit

# When connecting providers that take a self-hosted URL (WordPress, Mastodon,
# Lemmy, Listmonk, Bluesky PDS, etc.) Postiz fetches that URL server-side and
# blocks requests that resolve to private/internal/loopback/link-local IPs to
# prevent SSRF. Set to true ONLY if your Postiz instance must reach those
# services on a trusted private network (e.g. same Docker network or VPC).
# DISABLE_SSRF_PROTECTION=false

# Payment settings
FEE_AMOUNT=0.05
STRIPE_PUBLISHABLE_KEY=""
STRIPE_SECRET_KEY=""
STRIPE_SIGNING_KEY=""
STRIPE_SIGNING_KEY_CONNECT=""
# RevenueCat (App Store / Google Play subscriptions from the mobile app)
# Webhook URLs: {BACKEND_URL}/payment/stripe and {BACKEND_URL}/payment/revenuecat, Authorization header value = REVENUECAT_WEBHOOK_SECRET
REVENUECAT_SECRET_KEY=""
REVENUECAT_WEBHOOK_SECRET=""
# IN_APP_PURCHASE_REJECT_SANDBOX=true

# Developer Settings
NX_ADD_PLUGINS=false
IS_GENERAL="true" # required for now
NEXT_PUBLIC_POSTIZ_OAUTH_DISPLAY_NAME="Authentik"
NEXT_PUBLIC_POSTIZ_OAUTH_LOGO_URL="https://raw.githubusercontent.com/walkxcode/dashboard-icons/master/png/authentik.png"
POSTIZ_GENERIC_OAUTH="false"
POSTIZ_OAUTH_URL="https://auth.example.com"
POSTIZ_OAUTH_AUTH_URL="https://auth.example.com/application/o/authorize"
POSTIZ_OAUTH_TOKEN_URL="https://auth.example.com/application/o/token"
POSTIZ_OAUTH_USERINFO_URL="https://authentik.example.com/application/o/userinfo"
POSTIZ_OAUTH_CLIENT_ID=""
POSTIZ_OAUTH_CLIENT_SECRET=""
# POSTIZ_OAUTH_SCOPE="openid profile email" # default values

# Short Link Service Settings
# DUB_TOKEN="" # Your self-hosted Dub API token
# DUB_API_ENDPOINT="https://api.dub.co" # Your self-hosted Dub API endpoint
# DUB_SHORT_LINK_DOMAIN="dub.sh" # Your self-hosted Dub domain

# SHORT_IO_SECRET_KEY="" # Your Short.io API secret key

# KUTT_API_KEY="" # Your Kutt.it API key
# KUTT_API_ENDPOINT="https://kutt.it/api/v2" # Your self-hosted Kutt API endpoint
# KUTT_SHORT_LINK_DOMAIN="kutt.it" # Your self-hosted Kutt domain

# LINK_DRIP_API_KEY="" # Your LinkDrip API key
# LINK_DRIP_API_ENDPOINT="https://api.linkdrip.com/v1/" # Your self-hosted LinkDrip API endpoint
# LINK_DRIP_SHORT_LINK_DOMAIN="dripl.ink" # Your self-hosted LinkDrip domain

# reCAPTCHA Settings (invisible v2 on anonymous preview comments, optional; unset = no captcha)
# RECAPTCHA_SITE_KEY="" # Your reCAPTCHA v2 invisible site key
# RECAPTCHA_SECRET_KEY="" # Your reCAPTCHA v2 invisible secret key

# Provider visibility / migration
# HIDDEN_PROVIDERS="tiktok" # comma-separated identifiers hidden from the add-channel screen
# MIGRATE_PROVIDERS="tiktok:tiktok-business" # comma-separated "old:new" pairs, a reconnect of "old" goes through "new" and the channel is migrated in place