Environment Variables

All of this is read by Settings in app/core/config.py, from .env locally or from Codespaces secrets anywhere else — see Using This Template for why secrets don’t belong in .env. Postgres variables have their own page: Database Setup.

Domain & environment

Variable	What it’s for
DOMAIN	The production domain — Traefik uses it to route traffic and get a TLS cert. Leave as localhost for dev.
FRONTEND_HOST	The frontend’s public URL — used to build links inside emails (password reset, etc.)
ENVIRONMENT	local, staging, or production — changes how strictly secrets are enforced (see below)
PROJECT_NAME	Shows up in email subjects and API docs

Security

Variable	What it’s for
SECRET_KEY	Signs JWTs — anyone with this can forge a valid login token
FIRST_SUPERUSER	Email of the admin account created on first startup
FIRST_SUPERUSER_PASSWORD	Its password

Never leave these as “changethis”

The template ships with all three defaulted to changethis. config.py actually checks for that literal string: in ENVIRONMENT=local it just warns, but in staging or production it raises and refuses to start. Generate real values before you deploy anywhere — a random 32+ character string for SECRET_KEY is enough.

Email (SMTP)

Variable	What it’s for
SMTP_HOST / SMTP_PORT	Your email provider’s SMTP relay
SMTP_USER / SMTP_PASSWORD	Its credentials
SMTP_TLS / SMTP_SSL	Which encryption the provider expects — check their docs, don’t guess
EMAILS_FROM_EMAIL	Must be a sender address your provider has verified

If SMTP_HOST or EMAILS_FROM_EMAIL is blank, the app quietly disables email — password reset just won’t send anything, no error. That’s usually the first thing to check if “forgot password” seems broken.

Recommended: Zoho ZeptoMail — you’re already in the Zoho ecosystem, and it’s built for exactly this (transactional email, not marketing sends):

Variable	Value
SMTP_HOST	smtp.zeptomail.com (or .in / .eu depending on your account’s region)
SMTP_PORT	587
SMTP_TLS	True
SMTP_USER	emailapikey (literal string, not your Zoho login)
SMTP_PASSWORD	The Send Mail Token from your ZeptoMail Mail Agent’s SMTP settings

Paid-tier alternative: Resend — nicer dashboard and deliverability tooling if you outgrow ZeptoMail’s free tier:

Variable	Value
SMTP_HOST	smtp.resend.com
SMTP_PORT	587
SMTP_TLS	True
SMTP_USER	resend (literal string)
SMTP_PASSWORD	Your Resend API key

Either way, EMAILS_FROM_EMAIL has to be an address on a domain you’ve verified with that provider — an unverified sender gets silently dropped or bounced.

CORS

Variable	What it’s for
BACKEND_CORS_ORIGINS	Extra origins allowed to call the API, comma-separated. FRONTEND_HOST is always allowed automatically — you only need this for additional origins.

Monitoring

Variable	What it’s for
SENTRY_DSN	Error tracking — leave blank to disable entirely, nothing else depends on it

Where to look when something’s wrong

Password reset emails not arriving → SMTP_HOST/EMAILS_FROM_EMAIL blank or unverified. CORS error in the browser console → the frontend’s origin isn’t in BACKEND_CORS_ORIGINS or doesn’t match FRONTEND_HOST. App refuses to start in staging → a secret is still changethis.