Every Cloud Control environment variable: storage driver selection, platform owner, CC_DATA_KEY, lockout window, CC_CLOUD_MODE, CRON_SECRET and the test-only seams.
Configuration is entirely through environment variables. This reference groups them by purpose; the local .env.example is the authoritative template.
Postgres connection string. When set, the postgres driver is selected (wins over Turso).
TURSO_DATABASE_URL
libSQL/Turso URL. Selects the turso driver. A file: URL runs libSQL locally. Any integration prefix (e.g. cloudcontrol_TURSO_DATABASE_URL) is recognized.
TURSO_AUTH_TOKEN
Auth token for a remote Turso database.
SQLITE_DIR
Local SQLite directory (defaults to ./data). SQLite is the local fallback only — serverless filesystems are ephemeral, so Vercel needs Postgres or Turso.
Platform-admin email, upserted on every boot. Set both on production.
PLATFORM_OWNER_PASSWORD
Platform-admin password — rotate by changing this and redeploying. When unset, a default admin is seeded everywhere (admin@snoweasl.com / SnoweaslAdmin!2026) — change it immediately.
Base64 of 32 random bytes — the AES-256-GCM key protecting stored secrets (org SSO client secrets). Required on Vercel before an org can save SSO; local dev has a documented fallback.
LOGIN_LOCKOUT_SECONDS
Lockout window in seconds (default 900 = 15 min). Only override for testing.
APP_BASE_URL
Public base URL for emailed reset links and OIDC redirect URIs, when behind a proxy/CDN. Falls back to the request origin.
RESET_EMAIL_WEBHOOK_URL
Optional webhook for delivering password-reset links (POST { to, resetUrl }). Without it, links are logged server-side only.
Canonical origin for this documentation site's canonical URLs, Open Graph tags, sitemap and robots.txt. Defaults to https://cloud-control.snoweasl.com.
E2E_EXPOSE_RESET_TOKEN=1 returns reset tokens in the API response; E2E_MOCK_IDP=1 serves an in-process mock OIDC IdP at /api/e2e-idp (a hard 404 otherwise, always disabled on Vercel). They exist only for the end-to-end suite.