---
title: "Public environment variables"
description: "Buyer-writable NEXT_PUBLIC_* and public_shared keys on the Order Lab Secrets tab — what ships in the browser bundle."
locale: "en"
---
# Public environment variables

> **Warning**
> Every `NEXT_PUBLIC_*` value is **public** — it ships in the browser JavaScript bundle. Never put private keys, SMTP passwords, or Auth.js secrets in a `NEXT_PUBLIC_` name.

Public vars are classified by prefix (`NEXT_PUBLIC_*` → class `public`) and filtered for buyers by ownership (`public_shared` or `owner_private` with a public class). Buyers edit them on **Secrets** (`?tab=secrets`); integrators also see them on **Env**.

### For founders

## What you typically set

| Variable | Purpose | Guide |
|----------|---------|--------|
| `NEXT_PUBLIC_BASE_URL` / `NEXT_PUBLIC_APP_URL` | Canonical site URL for Auth.js callbacks and links | [Secrets](/docs/configuration/secrets.md) |
| `NEXT_PUBLIC_STORAGE_PROVIDER` | Storage backend label for the client | [Ring Filebase](/docs/integrations/ring-filebase.md) |
| `NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID` | Enables WalletConnect QR / mobile wallets | [WalletConnect](/docs/configuration/walletconnect.md) |
| `NEXT_PUBLIC_FIREBASE_*` | Client FCM / Firebase web config | [Firebase](/docs/backend/firebase.md) · [FCM](/docs/features/push-notifications-fcm.md) |

Brand name, tagline, and logo are **not** set here — use **Project** (`?tab=project`) so deploy mirrors stay consistent.

### Checklist

- [ ] Base URL matches the domain you will go live on (`https://…`, no trailing slash surprises).
- [ ] WalletConnect Project ID set if members should connect phone wallets.
- [ ] Firebase public keys set only if you want push / client Firebase features.
- [ ] Save on Secrets — ask integrator to deploy so ConfigMap picks up changes.

### For developers

## Classification (verified)

| Axis | Rule | Module |
|------|------|--------|
| **class** | `key.startsWith('NEXT_PUBLIC_')` → `public`, else `secret` | `env-template-parser.ts` `classifyKey` |
| **owner** | allowlists in `env-key-ownership.ts` | buyer sees `owner_private` + `public_shared` |

`PUBLIC_SHARED_EXACT` currently includes:

- `NEXT_PUBLIC_BASE_URL`
- `NEXT_PUBLIC_APP_URL`
- `NEXT_PUBLIC_STORAGE_PROVIDER`
- `RINGBASE_API_URL`
- `RINGBASE_PUBLIC_URL`
- `NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID`

Firebase client keys use `NEXT_PUBLIC_FIREBASE_*` prefix → `owner_private` (buyer-writable). Unknown template keys default to `integrator_ops`.

Persist via `PATCH /api/my-orders/[id]/env` → `ProjectDeploymentService.saveEnvConfig` (template allowlist enforced).

## Related documentation

  
- [configuration/secrets](/docs/configuration/secrets.md) — Next-step: private secrets and encryption on the same Secrets tab.

  
- [configuration/walletconnect](/docs/configuration/walletconnect.md) — Deep-dive: create Reown Cloud Project ID for NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID.

  
- [deployment/environment](/docs/deployment/environment.md) — See-also: complete env.local.template catalog.

  
- [configuration](/docs/configuration.md) — Prerequisite: project configuration hub.