Configuration
All variables are read in src/config.ts. Reference: .env.example. .env, .env.development and .env.production are committed; .env.local (gitignored) overrides.
| Variable | Set in | Purpose |
|---|---|---|
VITE_API_BASE_URL | .env.development (https://dev.emaw-app.com), .env.production (https://app.emaw-app.com) | Backend origin, no trailing slash. Also decides whether the dev environment banner shows |
VITE_API_PROXY | both (true) | Call the app's own origin at /rest (Vite proxy in dev, the Worker in deployment) instead of the backend directly |
VITE_DEV_SEND_GROUP_IDS | default 36 | Group ids campaigns may target against the dev backend ("Email Testing") |
VITE_CARTO_BASEMAP_KEY | .env | CARTO map tiles (watermarked without it) |
VITE_GOOGLE_CLIENT_ID | .env | Google sign-in button on /login |
Worker variable
API_ORIGIN is not a Vite variable. scripts/deploy.mjs reads VITE_API_BASE_URL from the mode's env file and passes it to wrangler deploy --var API_ORIGIN:<value>; worker/index.ts forwards /rest/* there.
Security headers
public/_headers applies to every path: X-Frame-Options: DENY, CSP frame-ancestors 'none', X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, HSTS for one year, and a Permissions-Policy that disables camera, microphone, geolocation and payment.
Backend-side configuration that affects this app
| Backend variable | Effect here |
|---|---|
CF_ACCESS_TEAM_DOMAIN, CF_ACCESS_AUD | Staff endpoints require the Access JWT the Worker forwards; a password alone is not enough in deployed environments |
CAMPAIGN_SENDING_ENABLED, CAMPAIGN_SEND_ALLOWED_GROUP_IDS | Server-side send guard matching VITE_DEV_SEND_GROUP_IDS |
CRM_CONTACT_LIST_CACHE_SECONDS | Contact list pages are cached per scope and query; edits bump the cache version |
R2_* | Resource media upload returns 503 until set |
GOOGLE_OAUTH_* | Connect-Google-for-Meet is off without them |