Configuration

All configuration is done via environment variables.

Core

Variable	Required	Default	Description
BASE_URL	✅	—	Public URL of the AUMS instance (e.g. https://admin.example.com)
BETTER_AUTH_SECRET	✅	—	32-byte random secret for session signing. Generate with npm run auth:secret

Caution

PLAN_TIER must match the Docker image you are using. The plan is baked into the image at build time.

Database

Variable	Required	Default	Description
DATABASE_URL	✅	—	PostgreSQL connection string (e.g. postgresql://user:pass@host:5432/aums)
DATABASE_DIALECT	—	postgresql	Database dialect. Only postgresql is supported
DATABASE_CLIENT	—	postgresql	Database client. Only postgresql is supported
DATABASE_AUTO_MIGRATE	—	true	Run migrations automatically on startup

Email

Variable	Required	Default	Description
EMAIL_FROM	✅	—	Sender address (e.g. AUMS <noreply@example.com>)
EMAIL_SERVER	✅	—	SMTP connection string (e.g. smtps://user:pass@smtp.example.com)

OIDC / SSO (optional)

Protect the AUMS dashboard behind your own OpenID Connect provider.

Variable	Required	Default	Description
AUTH_CLIENT_OPENID_CONFIGURATION_URL	—	—	OIDC discovery URL (e.g. https://oauth.example.com)
AUTH_CLIENT_ID	—	—	OIDC client ID
AUTH_CLIENT_SECRET	—	—	OIDC client secret
AUTH_CLIENT_SCOPE	—	openid profile email	Space-separated OIDC scopes

Auth0

Variable	Required	Description
AUTH0_DOMAIN	✅	Auth0 tenant domain (e.g. your-tenant.auth0.com)
AUTH0_CLIENT_ID	✅	Management API M2M application client ID
AUTH0_CLIENT_SECRET	✅	Management API M2M application client secret

Firebase

Variable	Required	Description
FIREBASE_PROJECT_ID	✅	GCP / Firebase project ID
FIREBASE_PRIVATE_KEY	✅	Service account private key (PEM, include newlines as \n)
FIREBASE_CLIENT_EMAIL	✅	Service account email address

AWS Cognito

Variable	Required	Description
COGNITO_REGION	✅	AWS region (e.g. us-east-1)
COGNITO_USER_POOL_ID	✅	User pool ID (e.g. us-east-1_xxxxxxxxx)
AWS_ACCESS_KEY_ID	✅	AWS access key ID
AWS_SECRET_ACCESS_KEY	✅	AWS secret access key