Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

All runtime configuration is loaded from a .env file that sits in the project root — the same directory as package.json, one level above src/. The application uses the dotenv package to read this file on startup and exposes each value through src/config.js. If a variable is absent, the config falls back to an empty string (or the hard-coded default shown below), which will cause the feature that depends on it to fail silently — so it is important to populate every variable before starting the server.
Never commit .env to version control. Add .env to your .gitignore before your first commit. The file contains secrets (JWT signing key, OAuth credentials, email password) that must never be exposed publicly. If any secret is accidentally pushed, rotate it immediately.

​
Complete .env Example

.env
# ── Server ────────────────────────────────────────────────
PORT=3000

# ── JWT ───────────────────────────────────────────────────
SECRET=replace_with_a_long_random_string_at_least_32_chars

# ── MongoDB ───────────────────────────────────────────────
MONGODB_URL=mongodb://localhost:27017/ecommerce

# ── Nodemailer / Gmail ────────────────────────────────────
USER_EMAIL=your-gmail-address@gmail.com
PASS_EMAIL=xxxx xxxx xxxx xxxx

# ── Google Cloud Storage ──────────────────────────────────
NAMEGOOGLECLOUD=your-gcs-bucket-name

# ── Google OAuth 2.0 ──────────────────────────────────────
CLIENT_ID=123456789-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com
CLIENT_SECRET=GOCSPX-your-client-secret
CLIENT_URL=http://localhost:3000/auth/google/callback

​
Environment Variable Reference

​
PORT
number
default:"3000"
The HTTP port the Express server listens on. If omitted, the server defaults to 3000 (defined in src/index.js). When deploying behind a reverse proxy (nginx, Caddy, etc.) this is the internal port — the proxy handles the public-facing port.
​
SECRET
string
required
The secret key used to sign and verify JWTs via jsonwebtoken. Every token issued at login is signed with this value; every protected route validates tokens against it. Use a long, random string (minimum 32 characters). You can generate one with:
node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"
Changing this value invalidates all existing tokens, requiring every user to log in again.
​
MONGODB_URL
string
required
Full MongoDB connection URI. Two common forms:
  • Local: mongodb://localhost:27017/ecommerce
  • MongoDB Atlas: mongodb+srv://<user>:<password>@cluster0.example.mongodb.net/ecommerce?retryWrites=true&w=majority
The database name at the end of the URI (ecommerce) will be created automatically by Mongoose on first write.
​
USER_EMAIL
string
required
The Gmail address used as the sender for all transactional emails (account verification codes and password recovery codes). This must be a real Gmail account with App Passwords enabled (see Email Setup below).
​
PASS_EMAIL
string
required
A Google App Password — a 16-character code generated specifically for this application. This is not your regular Gmail login password. App Passwords work even when 2-Step Verification is enabled and allow you to revoke access per-app without changing your main password. See Email Setup for generation steps.
​
NAMEGOOGLECLOUD
string
required
The name of your Google Cloud Storage bucket where product images are uploaded after being processed by Sharp. The bucket must exist before the server starts — images upload to the root of this bucket. See Google Cloud Storage Setup below.
​
CLIENT_ID
string
required
Your Google OAuth 2.0 Client ID, obtained from the Google Cloud Console. It ends with .apps.googleusercontent.com and identifies your application to Google’s OAuth servers. See Google OAuth Setup below.
​
CLIENT_SECRET
string
required
Your Google OAuth 2.0 Client Secret, paired with CLIENT_ID. Keep this value private — anyone with the Client ID + Secret can impersonate your OAuth application.
​
CLIENT_URL
string
required
The OAuth redirect/callback URL that Google sends users to after they grant consent. This must exactly match one of the “Authorised redirect URIs” configured in Google Cloud Console.
  • Development: http://localhost:3000/auth/google/callback
  • Production: https://yourdomain.com/auth/google/callback

​
MongoDB Setup

The Ecommerce API uses Mongoose 6 to connect to MongoDB. You have two options:

​
Local MongoDB

1

Install MongoDB Community Edition

Follow the official installation guide for your OS. After installation, start the service:
# macOS (Homebrew)
brew services start mongodb-community

# Linux (systemd)
sudo systemctl start mongod
2

Set MONGODB_URL

MONGODB_URL=mongodb://localhost:27017/ecommerce
Mongoose creates the ecommerce database automatically on first write.

​
MongoDB Atlas (Cloud)

1

Create a free cluster

Sign up at cloud.mongodb.com, create an M0 (free) cluster, and wait for it to provision.
2

Create a database user

In Database Access, add a user with Read and write to any database permissions. Note the username and password.
3

Whitelist your IP

In Network Access, add your server’s IP address (or 0.0.0.0/0 to allow all IPs during development).
4

Copy the connection string

Click Connect → Drivers, choose Node.js, and copy the URI. Replace <password> with your database user’s password and append /ecommerce as the database name:
MONGODB_URL=mongodb+srv://myuser:mypassword@cluster0.abcde.mongodb.net/ecommerce?retryWrites=true&w=majority

​
Google Cloud Storage Setup

Product images are uploaded to GCS after Sharp resizes and optimises them. You need a bucket and a service account with write permissions.
1

Create a Google Cloud project

Visit console.cloud.google.com, create a new project (or select an existing one), and enable the Cloud Storage API.
2

Create a storage bucket

Go to Cloud Storage → Buckets → Create. Choose a globally unique name — this is your NAMEGOOGLECLOUD value. Select a region close to your users and leave default storage class as Standard.
3

Create a service account

Go to IAM & Admin → Service Accounts → Create Service Account. Grant it the Storage Object Admin role so it can upload and manage objects in your bucket.
4

Download the JSON key

On the service account, go to Keys → Add Key → Create new key → JSON. Download the file and place it in your project (outside src/, and add it to .gitignore). The @google-cloud/storage client automatically picks up credentials from the GOOGLE_APPLICATION_CREDENTIALS environment variable:
.env (addition)
GOOGLE_APPLICATION_CREDENTIALS=./your-service-account-key.json
5

Set NAMEGOOGLECLOUD

NAMEGOOGLECLOUD=your-globally-unique-bucket-name
For local development you can also use the Google Cloud CLI (gcloud auth application-default login) to authenticate without a key file.

​
Google OAuth 2.0 Setup

The API supports Sign in with Google via passport-google-oauth20. To get your CLIENT_ID and CLIENT_SECRET:
1

Open the Google Cloud Console

Navigate to console.cloud.google.com and select your project.
2

Configure the OAuth consent screen

Go to APIs & Services → OAuth consent screen. Choose External (for any Google account) or Internal (G Suite only). Fill in the application name, support email, and developer contact email. Save and continue through the scopes screen (no special scopes needed — the app requests email and profile).
3

Create OAuth 2.0 credentials

Go to APIs & Services → Credentials → Create Credentials → OAuth client ID. Select Web application as the application type. Give it a name.
4

Add authorised redirect URIs

Under Authorised redirect URIs, click Add URI and enter:
http://localhost:3000/auth/google/callback
For production, add your live URL as well (e.g. https://yourdomain.com/auth/google/callback). This value must exactly match CLIENT_URL in your .env.
5

Copy Client ID and Client Secret

After saving, Google displays your Client ID and Client Secret. Copy them into your .env:
CLIENT_ID=123456789-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com
CLIENT_SECRET=GOCSPX-your-client-secret
CLIENT_URL=http://localhost:3000/auth/google/callback

​
Email Setup (Nodemailer / Gmail)

The API uses Nodemailer to send account verification codes and password recovery codes. Gmail requires an App Password — not your regular account password — when authenticating via SMTP from an application.
1

Enable 2-Step Verification on your Google account

App Passwords require 2-Step Verification to be active. Visit myaccount.google.com/security and enable it if you have not already.
2

Generate an App Password

On the same Security page, find App passwords (search for it if it is not visible). Select Mail as the app and Other (Custom name) as the device — type Ecommerce API. Click Generate.Google displays a 16-character password in the format xxxx xxxx xxxx xxxx.
3

Add to .env

USER_EMAIL=your-gmail-address@gmail.com
PASS_EMAIL=xxxx xxxx xxxx xxxx
Use the App Password exactly as shown (spaces included, or remove them — both work). Never use your real Gmail password here; it will not work with SMTP and would be a serious security risk if exposed.
If emails are not sending, verify that “Less secure app access” restrictions aren’t blocking SMTP on your account, and confirm the App Password was generated for the correct Google account matching USER_EMAIL.

Build docs developers (and LLMs) love

Get started for freeTalk to us