Environment Variables
title: Environment Variables
description: Environment variables reference for self-hosted HeyForm. icon: 'lucide:variable'
| Name | Type | Required | Description |
|---|---|---|---|
| APP_LISTEN_PORT | Number | Port to listen (default is 8000) | |
| APP_LISTEN_HOSTNAME | String | Hostname (default is 0.0.0.0) | |
| APP_HOMEPAGE_URL | String | Website homepage URL (e.g. https://exampledomain.com) | |
| APP_DISABLE_REGISTRATION | Boolean | Disable user registration (default is false) | |
| COOKIE_MAX_AGE | String | Cookie max age (default is 1year) | |
| SESSION_KEY | String | ✅ | Session encryption key |
| SESSION_MAX_AGE | String | Session max age (default is 15days) | |
| UPLOAD_FILE_TYPES | String | Upload file types (e.g. .jpg,.png,.bmp,.zip) | |
| UPLOAD_FILE_SIZE | Number | Upload file size (default is 10mb) | |
| S3_ENDPOINT | String | S3 API endpoint URL (e.g. https://s3.amazonaws.com or provider endpoint like MinIO/Cloudflare R2). Required when using S3-compatible storage for uploads. | |
| S3_REGION | String | S3 region for the bucket (e.g. us-east-1). Required by most S3-compatible providers for request signing. | |
| S3_BUCKET | String | S3 bucket name used to store uploaded files. Required when using S3-compatible storage. | |
| S3_ACCESS_KEY_ID | String | Access key ID used to authenticate with S3-compatible storage. Required for authenticated bucket access. | |
| S3_SECRET_ACCESS_KEY | String | Secret access key paired with S3_ACCESS_KEY_ID for S3 authentication. Keep this value private. | |
| S3_PUBLIC_URL | String | Public base URL used to serve uploaded files (e.g. CDN/custom domain or bucket public URL). If empty, application should fall back to provider object URL. | |
| FORM_ENCRYPTION_KEY | String | ✅ | Form encryption key |
| BCRYPT_SALT | Number | Bcrypt salt (default is 10) | |
| MONGO_URI | String | ✅ | MongoDB URI, for docker it should be like mongodb://mongo:27017/heyform |
| MONGO_USER | String | MongoDB user | |
| MONGO_PASSWORD | String | MongoDB password | |
| MONGO_SSL_CA_PATH | String | MongoDB SSL CA path | |
| REDIS_HOST | String | Redis host (default is 127.0.0.1), for docker it should be redis | |
| REDIS_PORT | Number | Redis port (default is 6379) | |
| REDIS_PASSWORD | String | Redis password | |
| REDIS_DB | Number | Redis DB (default is 0) | |
| VERIFY_USER_EMAIL | Boolean | Whether it is necessary to verify the email addresses of the new users (default is false) | |
| SMTP_FROM | String | SMTP from (e.g. Heyform <[email protected]>) | |
| SMTP_HOST | String | SMTP host | |
| SMTP_PORT | Number | SMTP port | |
| SMTP_USER | String | SMTP user | |
| SMTP_SECURE | Boolean | If truethe connection will use TLS when connecting to server | |
| SMTP_IGNORE_CERT | Boolean | If true will ignore TLS certificate errors | |
| SMTP_PASSWORD | String | SMTP password | |
| GOOGLE_RECAPTCHA_KEY | String | https://cloud.google.com/recaptcha-enterprise/docs/create-key-website | |
| GOOGLE_RECAPTCHA_SECRET | String | Google reCAPTCHA secret | |
| AKISMET_KEY | String | Akismet key | |
| APPLE_LOGIN_TEAM_ID | String | Apple login team ID | |
| APPLE_LOGIN_WEB_CLIENT_ID | String | Apple login web client ID | |
| APPLE_LOGIN_KEY_ID | String | Apple login key ID | |
| APPLE_LOGIN_PRIVATE_KEY_PATH | String | Apple login private key path | |
| GOOGLE_LOGIN_CLIENT_ID | String | Google login client ID | |
| GOOGLE_LOGIN_CLIENT_SECRET | String | Google login client secret | |
| STRIPE_PUBLISHABLE_KEY | String | https://docs.stripe.com/keys | |
| STRIPE_SECRET_KEY | String | Stripe secret key | |
| STRIPE_CONNECT_CLIENT_ID | String | Stripe connect client ID | |
| STRIPE_WEBHOOK_SECRET_KEY | String | Stripe payment webhook secret key | |
| BULL_JOB_ATTEMPTS | Number | Bull job attempts (default is 3) | |
| BULL_JOB_TIMEOUT | String | Bull job timeout (default is 1minute) | |
| BULL_JOB_BACKOFF_DELAY | Number | Bull job backoff delay (default is 3000) | |
| BULL_JOB_BACKOFF_TYPE | String | Bull job backoff type (default is 'fixed') | |
| INVITE_CODE_EXPIRE_DAYS | Number | Invite code expire days (default is 7) | |
| FORM_REPORT_RATE | String | Form report rate (default is 5seconds) | |
| VERIFICATION_CODE_EXPIRE | String | Verification code expire (default is 10minutes) | |
| VERIFICATION_CODE_LIMIT | Number | Verification code limit (default is 5) | |
| ACCOUNT_DELETION_SCHEDULE_INTERVAL | String | Account deletion schedule interval (default is 2days) | |
| UNSPLASH_CLIENT_ID | String | Unsplash client ID (Access Key) | |
| OPENAI_BASE_URL | String | https://github.com/openai/openai-node/blob/11c2f361ddf6d75ec3706cbdfd5dfc60e4293368/src/index.ts#L130https://github.com/openai/openai-node/blob/11c2f361ddf6d75ec3706cbdfd5dfc60e4293368/src/index.ts#L130base URL (default is https://api.openai.com/v1) | |
| OPENAI_API_KEY | String | OpenAI API key, you can find it on https://platform.openai.com/api-keys | |
| OPENAI_GPT_MODEL | String | GPT model (default is gpt-3.5-turbo-0125) |