---
title: "All environment variables"
description: "Configure your environment variables when self-hosting Infisical."
---

## Backend environment variables

Depending on your choosen self hosted deployment method, you may need to configured at least the required environment variable listed below. 
Other environment variables are listed below to increase the functionality of your self hosted instance based on your use case.

<Tabs>
  <Tab title="Required">
    <ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
    Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
  </ParamField>

  <ParamField query="JWT_SIGNUP_SECRET" type="string" default="none" required>
    Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
  </ParamField>

  <ParamField query="JWT_REFRESH_SECRET" type="string" default="none" required>
    Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
  </ParamField>

  <ParamField query="JWT_AUTH_SECRET" type="string" default="none" required>
    Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
  </ParamField>

  <ParamField query="JWT_MFA_SECRET" type="string" default="none" required>
    Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
  </ParamField>

  <ParamField query="JWT_SERVICE_SECRET" type="string" default="none" required>
    Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
  </ParamField>

  <ParamField query="MONGO_URL" type="string" default="none" required>
    *TLS based connection string is not yet supported
  </ParamField>
  </Tab>
  <Tab title="Email service">
    <Info>When email service is not configured, Infisical will have limited functionality</Info>

    <ParamField query="SMTP_HOST" type="string" default="none" optional>
      Hostname to connect to for establishing SMTP connections
    </ParamField>

    <ParamField query="SMTP_USERNAME" type="string" default="none" optional>
      Credential to connect to host (e.g. team@infisical.com)
    </ParamField>

    <ParamField query="SMTP_PASSWORD" type="string" default="587" optional>
      Credential to connect to host
    </ParamField>

    <ParamField query="SMTP_PORT" type="string" default="587" optional>
        Port to connect to for establishing SMTP connections
    </ParamField>

    <ParamField query="SMTP_SECURE" type="string" default="none" optional>
    If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported 
    </ParamField>

    <ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
      Email address to be used for sending emails
    </ParamField>

    <ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
      Name label to be used in From field (e.g. Team)
    </ParamField>
  </Tab>
  <Tab title="Secret Integrations">
    To sync secret to third party services, provide value for the related services 

    <ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
      OAuth2 client ID for Heroku integration
    </ParamField>

    <ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
      OAuth2 client secret for Heroku integration
    </ParamField>

    <ParamField query="CLIENT_ID_VERCEL" type="string" default="none" optional>
      OAuth2 client ID for Vercel integration 
    </ParamField>

    <ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
      OAuth2 client secret for Vercel integration
    </ParamField>

    <ParamField query="CLIENT_ID_NETLIFY" type="string" default="none" optional>
      OAuth2 client ID for Netlify integration  
    </ParamField>

    <ParamField query="CLIENT_SECRET_NETLIFY" type="string" default="none" optional>
      OAuth2 client secret for Netlify integration
    </ParamField>

    <ParamField query="CLIENT_ID_GITHUB" type="string" default="none" optional>
      OAuth2 client ID for GitHub integration         
    </ParamField>

    <ParamField query="CLIENT_SECRET_GITHUB" type="string" default="none" optional>
      OAuth2 client secret for GitHub integration
    </ParamField>

    <ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
      OAuth2 slug for Netlify integration
    </ParamField>
  </Tab>
  <Tab title="Auth Integrations">
    To integrate with external auth providers, provide value for the related keys
    <ParamField query="JWT_PROVIDER_AUTH_SECRET" type="string" required>
      Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
    </ParamField>
    <ParamField query="CLIENT_ID_GOOGLE" type="string" default="none" optional>
      OAuth2 client ID for Google auth integration         
    </ParamField>
    <ParamField query="CLIENT_SECRET_GOOGLE" type="string" default="none" optional>
      OAuth2 client secret for Google auth integration         
    </ParamField>
  </Tab>
  <Tab title="Others">
    #### JWT
    <ParamField query="JWT_SIGNUP_LIFETIME" type="string" default="15m" optional>
      JWT token lifetime expressed in seconds or a string describing a time span 
    </ParamField>

    <ParamField query="JWT_REFRESH_LIFETIME" type="string" default="90d" optional>
      JWT token lifetime expressed in seconds or a string describing a time span
    </ParamField>

    <ParamField query="JWT_AUTH_LIFETIME" type="string" default="10d" optional>
      JWT token lifetime expressed in seconds or a string describing a time span
    </ParamField>

    <ParamField query="JWT_MFA_LIFETIME" type="string" default="5m" optional>
      JWT token lifetime expressed in seconds or a string describing a time span
    </ParamField>

    <ParamField query="JWT_PROVIDER_AUTH_LIFETIME" type="string" default="5m" optional>
      JWT token lifetime expressed in seconds or a string describing a time span
    </ParamField>

  <ParamField query="MONGO_USERNAME" type="string" default="none" optional></ParamField>

  <ParamField query="MONGO_PASSWORD" type="string" default="none" optional></ParamField>

  #### Error logging 
  Infisical uses Sentry to report error logs 
  <ParamField query="SENTRY_DSN" type="string" default="none" optional></ParamField>

  #### Settings
  <ParamField query="INVITE_ONLY_SIGNUP" type="string" default="false" optional>
    Only allow users who are invited to sign up
  </ParamField>

  <ParamField query="SITE_URL" type="string" default="none" optional>
    Site URL - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
  </ParamField>
  <ParamField query="TELEMETRY_ENABLED" type="string" default="true" optional></ParamField>
  </Tab>
</Tabs>


## Frontend environment variables
<ParamField query="TELEMETRY_ENABLED" type="string" default="true" optional></ParamField>
