Skip to main content
The API is configured entirely through environment variables. Copy .env.example to .env and fill in the values before starting the server.

​
.env.example

.env.example
# Server
PORT=3000
NODE_ENV=development

# Database
DB_HOST=localhost
DB_PORT=5432
DB_NAME=mais_habito
DB_USER=postgres
DB_PASSWORD=your_password_here

# JWT
JWT_SECRET=your_super_secret_key_here

FRONTEND_URL=http://localhost:PORT_HERE

​
Variable reference

VariableDefaultRequiredDescription
PORT3000NoPort the HTTP server listens on
NODE_ENVdevelopmentNoRuntime environment (development or production)
DB_HOSTlocalhostYesPostgreSQL host
DB_PORT5432YesPostgreSQL port
DB_NAMEmais-habito-dbYesDatabase name
DB_USERpostgresYesDatabase user
DB_PASSWORD(empty)YesDatabase password
JWT_SECRETchange-this-secretYesSecret key used to sign JWT tokens
FRONTEND_URL—YesAllowed CORS origin for the frontend app

​
Variable details

​
env.PORT
number
default:"3000"
Port the Express server binds to. Override this when running multiple services on the same host or deploying behind a reverse proxy.
​
env.NODE_ENV
string
default:"development"
Controls runtime behavior: logging verbosity, .env file loading, SSL enforcement, and migration file extension. Accepted values are development and production.
​
env.DB_HOST
string
default:"localhost"
required
Hostname or IP address of the PostgreSQL server.
​
env.DB_PORT
number
default:"5432"
required
TCP port PostgreSQL is listening on.
​
env.DB_NAME
string
default:"mais-habito-db"
required
Name of the PostgreSQL database. The .env.example uses mais_habito; make sure the value matches the database you created.
​
env.DB_USER
string
default:"postgres"
required
PostgreSQL role used to connect to the database.
​
env.DB_PASSWORD
string
required
Password for the PostgreSQL role specified in DB_USER.
​
env.JWT_SECRET
string
required
Secret string used to sign and verify JWT access tokens. Must be kept private — never commit it to version control.
​
env.FRONTEND_URL
string
required
Full origin URL of the frontend application (e.g. http://localhost:5173). This value is passed directly to the CORS middleware as the allowed origin.
In production, JWT_SECRET must be a long, randomly generated string. Using a weak or guessable secret allows attackers to forge valid tokens and authenticate as any user.
Generate a cryptographically secure secret with:
openssl rand -base64 32
When NODE_ENV is set to development, the API automatically loads variables from a .env file at the project root via dotenv. In production, environment variables must be injected by the host environment (e.g. Docker, Railway, or a process manager) — the .env file is not read. SSL for the database connection is also enabled automatically in production.

Build docs developers (and LLMs) love

Get started for freeTalk to us