Environment variables

All VITE_* values are bundled into the browser — never put private keys in them.

Variable	Purpose	Required
VITE_NEWS_PROXY_URL	Worker /gnews URL	No (production default built in)
VITE_GDELT_PROXY_URL	Worker /gdelt URL	No
VITE_NEWSLETTER_SUBSCRIBE_URL	Worker /newsletter URL	No
VITE_API_BASE_URL	Worker origin for /api/* (cache, accounts, admin)	No — defaults to the production Worker
VITE_CLERK_PUBLISHABLE_KEY	Clerk publishable key (pk_…, public)	No — production uses the key committed in src/config/backend.ts; empty means accounts are switched off
VITE_ENABLE_PUBLIC_CORS_PROXY	Emergency public proxy switch	No — keep false
VITE_ENABLE_MOCK_NEWS	Allow demo data when every provider fails	No — keep false in production
VITE_GNEWS_API_KEY	Direct GNews on localhost only	No — dev only
DOCS_URL, DOCS_BASE_URL	Docs deployment target (build time)	No — defaults to /docs/ on www.novareport.net

Build-time variables (not VITE_*, not bundled into the browser):

Variable	Purpose	Default
MAIN_SITE_URL	Canonical URL injected into the Docusaurus config (docs-site/docusaurus.config.ts)	https://www.novareport.net
DOCS_STRICT	When set to 1, a docs build failure fails the whole build (scripts/build-docs.mjs); without it the committed public/docs is kept and a warning is printed	unset (lenient)

VITE_ENABLE_MOCK_NEWS=false

Worker secrets (wrangler secret put <NAME> in workers/news-api; never in the repository):

Secret	Purpose
GNEWS_API_KEY, UNSPLASH_ACCESS_KEY, BEEHIIV_API_KEY, BEEHIIV_PUBLICATION_ID	News, images, newsletter
NEWSDATA_API_KEY	Optional secondary news source
DATABASE_URL	Neon connection string
CLERK_SECRET_KEY, CLERK_JWT_KEY	Verify Clerk sessions (the PEM public key allows verification without a network call)
CLERK_WEBHOOK_SIGNING_SECRET	Verify Clerk webhooks
ADMIN_KEYS_ENCRYPTION_KEY	Encrypt provider keys stored through the admin console

GET /api/health on the Worker reports which of the application secrets are configured, without revealing any value.