Environment Variables & Configuration Matrix

This document provides an exhaustive reference of all environment variables utilized across veridex-hitech-web-application.

Critical variables are strictly validated at startup using Zod in src/lib/env.ts.

:::warning Security Boundary Never commit real secrets, private certificates, API tokens, or production database credentials to source repositories. In cloud deployments (Azure App Services, Vercel), secrets must be injected through environment configuration panels or backed by Azure Key Vault references. :::

---

1. Master Environment Variable Reference Table

Variable	Purpose	Required	Example / Format	Used By
NEXT_PUBLIC_APP_URL	Canonical public-facing base URL of the deployment. Used for canonical redirects, OpenGraph image resolution, and email links.	Yes	https://hitechinsurance.ai (Prod) http://localhost:3000 (Local)	Layout, SEO metadata, Email templates, src/lib/env.ts
NEXT_PUBLIC_APP_ENV	Deployment environment discriminator (development, staging, production). Overcomes Vercel setting NODE_ENV=production on all branches.	Yes	production | staging | development	Deployment routing, environment banners, src/lib/env.ts
DATABASE_URL	MongoDB connection URI including user credentials, hosts, replica set parameters, and database name.	Yes	mongodb+srv://user:pass@cluster.mongodb.net/hitech_insurance?retryWrites=true&w=majority	Mongoose connection manager (src/lib/db/mongoose.ts)
NEXTAUTH_SECRET	Cryptographic 32-byte secret used by Auth.js to sign and encrypt JWT session cookies.	Yes	Hex string generated via openssl rand -hex 32	NextAuth configuration (src/lib/auth.ts)
NEXTAUTH_URL	Canonical URL used by NextAuth to resolve callback handlers and authentication redirection.	Yes	https://hitechinsurance.ai (Prod) http://localhost:3000 (Local)	NextAuth callback router
SEED_SUPER_ADMIN_EMAIL	Default email address provisioned by the super-admin seeding script.	No	super.admin@hitechinsurance.ai	scripts/seed-super-admin.ts
SEED_SUPER_ADMIN_PASSWORD	Initial plaintext password for the seeded super-admin account.	No	High-entropy password string	scripts/seed-super-admin.ts
SWAGGER_DOCS_PASSWORD_HASH	Bcrypt hash of the access password protecting interactive OpenAPI Swagger documentation at /api/docs.	Yes	$2b$12$... (Bcrypt hash)	/api/docs/auth route handler
HTI_LEAD_HMAC_SECRET	15-character shared cryptographic secret used to sign and verify inbound partner lead requests via HMAC-SHA256.	Yes	15-character alphanumeric secret	/api/leads/*, src/lib/hti-leads/verify.ts
HTI_CRM_URL	HTTPS endpoint for forwarding qualified personal and commercial leads to the enterprise HTI CRM.	Integration	https://crm.staging.hightechinsurance.com/api/landing-page/save-leads	src/lib/hti-crm.ts (sendLeadToHtiCrm)
HTI_CRM_USERNAME	HTTP Basic Authentication username for the HTI CRM endpoint.	Integration	Alphanumeric service username	src/lib/hti-crm.ts
HTI_CRM_PASSWORD	HTTP Basic Authentication password for the HTI CRM endpoint.	Integration	Secure service password	src/lib/hti-crm.ts
EMAIL_SERVICE_AUTH_KEY	Secret authorization token passed in headers to the HiTech Azure Functions Email microservice.	Integration	Hex / base64 secret string	src/lib/email.ts
NEXT_PUBLIC_EMAIL_TO	Non-production email redirect override. Diverts all outgoing notifications away from real customers to an internal team inbox.	Dev/Staging	qa-team@example.com	src/lib/email.ts (Form notification dispatch)
TEST_EMAIL_TO	Target email address used by testing scripts in scripts/.	Dev	tester@example.com	scripts/send-test-email.js, scripts/send-*.ts
PRIVACY_DATA_SECURITY_CC	Comma-separated CC email addresses receiving customer data privacy requests (CCPA/CPRA, TDPSA).	Regulatory	datasecurity@example.com,compliance@example.com	/api/forms/privacy/intake, Server Actions
META_VERIFY_TOKEN	Custom token configured in Meta Developer Console to complete initial webhook challenge verification.	Webhook	Alphanumeric secret token	GET /api/webhooks/meta
META_APP_ID	Meta application ID registered with Meta Graph API.	Webhook	Numeric App ID (e.g. 1234567890)	Meta Graph client
META_APP_SECRET	Meta application secret key used to compute HMAC-SHA256 signatures over incoming event bodies.	Webhook	Hex secret string	POST /api/webhooks/meta
META_PAGE_ACCESS_TOKEN	Long-lived System User access token used to query Meta Graph API v25.0 to fetch encrypted lead answers.	Webhook	EAA... (Meta Graph token)	src/lib/meta/leadgen.ts
META_GRAPH_VERSION	Meta Graph API version string.	Webhook	v25.0 (Default)	src/lib/meta/leadgen.ts
GOOGLE_WEBHOOK_SECRET	Shared secret configured in Google Ads Lead Form webhook extensions for payload authenticity.	Webhook	Secret string	POST /api/webhook/google
TIKTOK_VERIFY_TOKEN	Verification handshake token configured on TikTok Lead Generation webhook campaigns.	Webhook	Alphanumeric token	GET/POST /api/webhook/tiktok
RATE_LIMIT_ENABLED	Master switch enabling or disabling the distributed MongoDB sliding-window rate limiter.	Optional	true | false (Default: true)	src/lib/rate-limit/limiter.ts
RATE_LIMIT_LIMIT_AUTH_STRICT	Maximum allowed requests on sensitive authentication endpoints within the configured time window.	Optional	Integer (Default: 5)	src/lib/rate-limit/config.ts
RATE_LIMIT_WINDOW_AUTH_STRICT	Sliding window duration for authentication endpoints in milliseconds.	Optional	Integer (Default: 900000 = 15 min)	src/lib/rate-limit/config.ts
RATE_LIMIT_LIMIT_FORM_SUBMISSION	Maximum allowed public form submissions (Quote, Claims, Contact, Careers) within the window.	Optional	Integer (Default: 10)	src/lib/rate-limit/config.ts
RATE_LIMIT_WINDOW_FORM_SUBMISSION	Sliding window duration for public form submissions in milliseconds.	Optional	Integer (Default: 300000 = 5 min)	src/lib/rate-limit/config.ts
RATE_LIMIT_LIMIT_AUTHENTICATED_MUTATION	Maximum profile and referral mutations for authenticated users per minute.	Optional	Integer (Default: 30)	src/lib/rate-limit/config.ts
RATE_LIMIT_WINDOW_AUTHENTICATED_MUTATION	Sliding window duration for authenticated user mutations in milliseconds.	Optional	Integer (Default: 60000 = 1 min)	src/lib/rate-limit/config.ts
RATE_LIMIT_LIMIT_EXPENSIVE	Maximum expensive analytical operations (reports, retries, PDF exports) allowed per minute.	Optional	Integer (Default: 10)	src/lib/rate-limit/config.ts
RATE_LIMIT_WINDOW_EXPENSIVE	Sliding window duration for expensive operations in milliseconds.	Optional	Integer (Default: 60000 = 1 min)	src/lib/rate-limit/config.ts
RATE_LIMIT_LIMIT_STANDARD_API	Maximum general interactive API requests and partner lead submissions allowed per minute.	Optional	Integer (Default: 100)	src/lib/rate-limit/config.ts
RATE_LIMIT_WINDOW_STANDARD_API	Sliding window duration for standard API requests in milliseconds.	Optional	Integer (Default: 60000 = 1 min)	src/lib/rate-limit/config.ts
RATE_LIMIT_LIMIT_READ_ONLY	Maximum public read queries allowed per minute per IP address.	Optional	Integer (Default: 200)	src/lib/rate-limit/config.ts
RATE_LIMIT_WINDOW_READ_ONLY	Sliding window duration for read-only endpoints in milliseconds.	Optional	Integer (Default: 60000 = 1 min)	src/lib/rate-limit/config.ts

---

2. Environment Validation Schema (src/lib/env.ts)

The application validates mandatory variables at bootstrap time:

import { z } from "zod";

const envSchema = z.object({
  NEXT_PUBLIC_APP_URL: z.string().url(),
  NEXT_PUBLIC_APP_ENV: z
    .enum(["development", "staging", "production"])
    .default("development"),
  DATABASE_URL: z.string().min(1),
  NEXTAUTH_SECRET: z.string().min(1),
  NEXTAUTH_URL: z.string().url(),
});

export const env = envSchema.parse({
  NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
  NEXT_PUBLIC_APP_ENV: process.env.NEXT_PUBLIC_APP_ENV,
  DATABASE_URL: process.env.DATABASE_URL,
  NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET,
  NEXTAUTH_URL: process.env.NEXTAUTH_URL,
});

If any mandatory variable is missing or malformed, the process immediately exits with a descriptive Zod validation error, preventing the application from running in an inconsistent or vulnerable state.