# Tinybird

TINYBIRD_HOST=http://localhost:7181

TINYBIRD_TOKEN=your-tinybird-token

# Required only when raw SQL is routed to Tinybird. These values mint scoped,

# per-org read JWTs and are intentionally independent from the API token.

# TINYBIRD_SIGNING_KEY=your-tinybird-jwt-signing-key

# TINYBIRD_WORKSPACE_ID=your-tinybird-workspace-id

# Optional Tinybird-side ceiling shared by raw SQL from the API and alerting,

# with an independent rate-limit bucket for each org. Unset means no JWT RPS limit.

# TINYBIRD_RAW_SQL_JWT_RPS_LIMIT=100

# ClickHouse

CLICKHOUSE_URL=http://localhost:9000

# tinybird is the default for compatibility with existing gateway deployments.

# Set clickhouse when CLICKHOUSE_URL points at a vanilla/self-managed server so

# raw SQL preserves CLICKHOUSE_PASSWORD instead of substituting a scoped JWT.

# Env-level vanilla ClickHouse raw SQL is allowed only in single-org self-hosted mode.

CLICKHOUSE_PROVIDER=clickhouse

CLICKHOUSE_USER=maple

CLICKHOUSE_DATABASE=default

CLICKHOUSE_PASSWORD=maple

# Local dev only: route every org to the managed warehouse even when it has a BYO

# ClickHouse row in org_clickhouse_settings (the row normally wins over the vars

# above). Ignored unless MAPLE_ENVIRONMENT=development, so it cannot reach a deploy.

# Off by default: with it on, an org whose data lives in its BYO cluster shows nothing.

# MAPLE_IGNORE_ORG_CLICKHOUSE=1

# Database

# Local non-worker entrypoints + tests use embedded PGlite. MAPLE_DB_URL is the

# PGlite data dir: blank = apps/api/.data/pglite (persistent), or `memory://`

# for ephemeral. The Workers under `alchemy dev` ignore this and dial the

# docker-compose Postgres through the dev Hyperdrive origin in

# apps/api/alchemy.run.ts (`bun run db:up && bun run db:migrate:local` to set it up).

MAPLE_DB_URL=

# Deployed stages (set in Infisical, not here): the PlanetScale Postgres connection

# string for the `main` branch (direct port 5432), used by the CI `drizzle-kit

# migrate` step and the import scripts. prd binds its Hyperdrive by dashboard

# config ID and never reads this at deploy time; only dev stages have alchemy parse

# it into a Hyperdrive origin. PR previews bind no database at all. NB the connect-time database is `postgres` (the cluster default),

# NOT the PlanetScale resource name `maple` (that's only for `pscale` commands).

# MAPLE_PG_URL=postgres://user:pass@host.pg.psdb.cloud:5432/postgres?sslmode=verify-full

# Base64-encoded 32-byte key (AES-256-GCM) used to encrypt private ingest keys at rest

MAPLE_INGEST_KEY_ENCRYPTION_KEY=

# HMAC key used to derive non-reversible ingest key lookup hashes

MAPLE_INGEST_KEY_LOOKUP_HMAC_KEY=

# Auth mode: clerk | self_hosted

MAPLE_AUTH_MODE=self_hosted

MAPLE_ROOT_PASSWORD=change-me

# Required when MAPLE_AUTH_MODE=clerk

# CLERK_SECRET_KEY=sk_test_xxx

# CLERK_PUBLISHABLE_KEY=pk_test_xxx

# Optional: networkless JWT verification

# CLERK_JWT_KEY=-----BEGIN PUBLIC KEY-----...

# Svix signing secret of the Clerk webhook endpoint pointing at POST /webhooks/clerk

# (user.created → signup_completed product event). Route answers 503 while unset.

# CLERK_WEBHOOK_SECRET=whsec_xxx

# Required when MAPLE_AUTH_MODE=self_hosted

MAPLE_DEFAULT_ORG_ID=default

# Web app overrides (auto-derived from above if not set)

# When running `bun dev:portless`, VITE_API_BASE_URL / VITE_INGEST_URL /

# VITE_CHAT_AGENT_URL are auto-set to https://<worktree>-<app>.localhost so

# multiple worktrees can run side by side. Values set here still win.

VITE_API_BASE_URL=http://localhost:3472

# Origin of the standalone ElectricSQL shape-proxy worker (apps/electric-sync).

VITE_ELECTRIC_SYNC_URL=http://localhost:3476

VITE_MAPLE_AUTH_MODE=self_hosted

VITE_CLERK_SIGN_IN_URL=/sign-in

VITE_CLERK_SIGN_UP_URL=/sign-up

# Ingest endpoint the browser SDK posts traces/sessions to. Auto-derived under

# portless; falls back to https://ingest.maple.dev.

# VITE_INGEST_URL=http://localhost:3474

# "off" disables rrweb self-recording in the web app.

# VITE_MAPLE_REPLAY=off

# Self-observability: the *public* ingest key the browser SDKs ship in the

# client bundle (web reads it as VITE_MAPLE_INGEST_KEY, landing as

# PUBLIC_MAPLE_INGEST_KEY). Unset means no client telemetry is sent.

# MAPLE_OTEL_PUBLIC_INGEST_KEY=maple_pk_xxx

# Landing app (Astro)

# PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_xxx

# Forces the visitor-id cookie's Domain=. Only needed locally: browsers make

# *.localhost cookies host-only, so landing.localhost and web.localhost would

# otherwise never resolve to the same visitor.

# PUBLIC_MAPLE_COOKIE_DOMAIN=localhost

# Ingest service

INGEST_PORT=3474

INGEST_FORWARD_OTLP_ENDPOINT=http://127.0.0.1:4318

# Required. The org the gateway's own traces/logs/metrics are filed under

# (`maple_org_id` on the resource, which the collector writes into `OrgId`).

# There is no default: an unset value used to mean a full self-telemetry stream

# landing under the literal "internal", an id no org has and no UI can read.

MAPLE_INTERNAL_ORG_ID=default

# INGEST_WRITE_MODE=tinybird

INGEST_FORWARD_TIMEOUT_MS=10000

INGEST_MAX_REQUEST_BODY_BYTES=20971520

INGEST_REQUIRE_TLS=false

# Ingest key store backend:

# - In single-tenant local dev (MAPLE_SELF_HOSTED_MODE=single_tenant +

# MAPLE_ORG_ID_OVERRIDE set), ingest auto-selects a no-DB static KeyStore

# that resolves any well-formed key to the override org. No CF creds needed.

# - In multi-tenant / production, ingest reads org_ingest_keys from

# PlanetScale Postgres — set MAPLE_PG_URL below (PSBouncer port 6432 is

# fine here; ingest is not behind Hyperdrive).

# - Force a backend with INGEST_KEY_STORE_BACKEND=static|postgres (overrides

# the mode-based default).

# INGEST_KEY_STORE_BACKEND=

# `bun dev` needs it too: the dev stage's Hyperdrive config is a real account resource

# and wants a reachable origin, even though the Workers dial the docker Postgres locally.

# MAPLE_PG_URL=

# Billing (Autumn)

# AUTUMN_SECRET_KEY=am_sk_test_xxx

# Svix signing secret of the Autumn webhook endpoint pointing at POST /webhooks/autumn

# (billing.updated → plan_started / plan_changed / plan_cancelled). 503 while unset.

# AUTUMN_WEBHOOK_SECRET=whsec_xxx

# A configured Autumn account is authoritative for ingest entitlements. Checks

# fail open when Autumn is unavailable.

# Stripe key for Settings → Billing → Billing details (company name, address, tax

# IDs on the Stripe customer Autumn links). A restricted key with Customers

# read/write is enough. Unset → that card reports billing as not configured.

# STRIPE_SECRET_KEY=rk_test_xxx

# Email (Cloudflare Email Service)

# Delivery is via the EMAIL worker binding (no API key). EMAIL_FROM must be on an

# onboarded sending domain. Quote the value — the display-name form contains a

# space and angle brackets, which an unquoted dotenv value can't hold.

# EMAIL_FROM="Maple <notifications@noreply.maple.dev>"

# Hazel integration (OAuth)

# Maple acts as an OIDC client against Hazel's Clerk-hosted OAuth provider.

# Register Maple as an OAuth Application in Hazel's Clerk dashboard, then drop

# the credentials here. Defaults target https://clerk.hazel.sh + https://api.hazel.sh.

# HAZEL_API_BASE_URL=https://api.hazel.sh

# HAZEL_OAUTH_DISCOVERY_URL=https://clerk.hazel.sh/.well-known/openid-configuration

# HAZEL_OAUTH_CLIENT_ID=

# HAZEL_OAUTH_CLIENT_SECRET=

# HAZEL_OAUTH_SCOPES=openid email profile organizations:read channels:read channel-webhooks:write

# GitHub integration (GitHub App)

# Maple connects to GitHub via a GitHub App for repo access, OAuth sign-in, and

# webhooks. Create one at https://github.com/settings/apps (or your org's

# settings), then drop the credentials here. All values are optional — the

# integration stays disabled until they are set.

# --- Apple Push Notifications (iOS app) ---------------------------------------

# All three required for push to be live; device registration works without them.

# APNS_TEAM_ID= # Apple Developer team id (10 chars)

# APNS_KEY_ID= # The .p8 key id from Certificates, IDs & Profiles → Keys

# APNS_PRIVATE_KEY= # The .p8 file contents, PEM. Multi-line: quote or use \n

# GITHUB_APP_ID= # Numeric App ID from the app's settings page

# GITHUB_APP_SLUG= # App URL slug (e.g. "maple"); used to build the install URL

# GITHUB_APP_PRIVATE_KEY= # PEM private key. Multi-line: wrap in quotes or use \n escapes

# GITHUB_APP_CLIENT_ID= # OAuth client ID (for user sign-in)

# GITHUB_APP_CLIENT_SECRET= # OAuth client secret

# GITHUB_APP_WEBHOOK_SECRET= # Shared secret used to verify inbound webhook signatures

# GITHUB_API_BASE_URL=https://api.github.com # Override for GitHub Enterprise Server

# Cloudflare integration (account OAuth — Authorization Code + PKCE)

# Maple connects a user's Cloudflare account via OAuth to poll edge analytics and

# push Workers observability. Register an OAuth client in the Cloudflare dashboard,

# then drop the credentials here. All values are optional — the integration stays

# disabled until CLOUDFLARE_OAUTH_CLIENT_ID is set. The client may only request

# scopes it was created with, so keep CLOUDFLARE_OAUTH_SCOPES in sync with the

# registered client's granted set. NOTE: account-analytics.read authorizes Workers

# (account-scoped) analytics; analytics.read authorizes zone (HTTP) analytics; zone.read

# only lists zones. All three are required — omit analytics.read and zone traffic

# collection is rejected "not authorized" while Workers still works.

# CLOUDFLARE_OAUTH_CLIENT_ID= # OAuth client ID (required to enable the integration)

# CLOUDFLARE_OAUTH_CLIENT_SECRET= # OAuth client secret (omit for PKCE-only public clients)

# CLOUDFLARE_OAUTH_SCOPES=account-settings.read account-analytics.read analytics.read zone.read workers-observability.write workers-observability-telemetry.write workers-scripts.read workers-scripts.write

# The URL/base vars default to production Cloudflare. Only set them to point at

# scripts/mock-cloudflare-oauth.ts for local end-to-end testing (see its header).

# CLOUDFLARE_OAUTH_AUTHORIZE_URL=https://dash.cloudflare.com/oauth2/auth

# CLOUDFLARE_OAUTH_TOKEN_URL=https://dash.cloudflare.com/oauth2/token

# CLOUDFLARE_OAUTH_REVOKE_URL=https://dash.cloudflare.com/oauth2/revoke

# MAPLE_CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4

# OpenTelemetry (API self-observability) — read by @maple-dev/effect-sdk

# MAPLE_ENVIRONMENT=local # "local" = no export; any other value enables OTLP

# MAPLE_ENDPOINT=http://127.0.0.1:3474 # Ingest gateway endpoint (enriches with org_id)

# MAPLE_INGEST_KEY= # Ingest key (maple_pk_* or maple_sk_*) for self-observability

# MAPLE_PRODUCT_EVENTS_INGEST_KEY= # Optional override for server-side product events (defaults to MAPLE_INGEST_KEY)

# COMMIT_SHA= # Git commit SHA for service version

# Scraper internal token

SD_INTERNAL_TOKEN=dev-internal-service-token

# ElectricSQL sync (read-path). The standalone apps/electric-sync worker's

# /api/sync/shape proxy forwards authenticated, org-scoped shape requests here.

# Locally this is the docker `electric` service; in prod it's the self-hosted

# service on ECS (apps/electric), reached at https://electric.maple.dev. Leave

# ELECTRIC_URL empty to disable sync — the proxy 503s and the web app stays on

# its existing effect-atom fetches.

ELECTRIC_URL=http://localhost:3473

# ELECTRIC_SECRET= # Electric's HTTP API secret. Deployed stages set it on BOTH

# # ends of the hop: the ECS service requires it, and the sync

# # worker appends it as `?secret=`. Local docker runs

# # ELECTRIC_INSECURE=true instead, so leave it unset.

# ELECTRIC_SOURCE_ID= # Electric CLOUD source id. Dead — nothing sets it since the

# # move to self-hosting. A source id without a matching secret

# # is treated as "not configured" and 503s (ElectricClient.ts).

# MAPLE_PG_ELECTRIC_URL= # Deploy-only: DIRECT (5432, never PSBouncer/Hyperdrive) URL

# # for a role carrying the REPLICATION attribute. Read by

# # apps/electric/alchemy.run.ts into Secrets Manager as the

# # ECS service's DATABASE_URL.

# LLM provider for AI chat + triage. Both paths stay wired in apps/api/src/platform/Llm.ts, so

# switching is this one var: "openrouter" (default) or "workers-ai". Model overrides are

# provider-scoped so both can stay set across a flip.

# MAPLE_LLM_PROVIDER=openrouter

# OPENROUTER_API_KEY= # required when the provider is openrouter

# MAPLE_TRIAGE_MODEL_OPENROUTER=openai/gpt-5.6-luna

# MAPLE_TRIAGE_MODEL_WORKERS_AI=@cf/moonshotai/kimi-k2.6

# Decision model (Cloudflare's Clef): bounded choice/rating/probability answers, on Workers AI

# through the AI Gateway binding, or the REST endpoint with CLOUDFLARE_API_KEY where there is none.

# MAPLE_DECISION_MODEL=@cf/cloudflare/clef-flash

INTERNAL_SERVICE_TOKEN=dev-internal-service-token