Operations
Backend Configuration
The API environment variables that matter to web and mobile clients.
For whoever runs the deployment:
| Variable | Purpose |
|---|---|
MOBILE_ORIGIN | Comma-separated extra CORS/trusted origins for WebView shells (capacitor://localhost, http://localhost). A native build sends no Origin and needs nothing here. |
API_PUBLIC_URL | Public base URL(s), listed as servers in the OpenAPI spec. |
ENABLE_API_DOCS | true to serve /api/v1/docs in production. Off by default there. |
FCM_PROJECT_ID, FCM_CLIENT_EMAIL, FCM_PRIVATE_KEY (or FCM_PRIVATE_KEY_BASE64) | Push. With none set, push is a silent no-op and everything else still works. |
WEB_ORIGIN | The web app's origin. Unchanged. |
WEBSITE_REVIEW_API_KEY | Lets the superlabs.co admin approve posts for the public Office Updates page. At least 32 characters (openssl rand -hex 32); the same value goes into the website admin's PEOPLE_REVIEW_API_KEY. Unset, only a super admin's own session can review. |
After deploying, run npm run db:migrate -w api — the platform column on
push_token and the post_website table are new.