Environment variables

Environment files hold values that change by machine or deployment. Ludicord loads the project environment before evaluating ludicord.config.mjs, so configuration can read process.env safely on the server.

#Generated variables

1LUDICORD_DISCORD_CLIENT_ID=
2LUDICORD_DISCORD_CLIENT_SECRET=
3LUDICORD_SESSION_SECRET=
4LUDICORD_DISCORD_PUBLIC_KEY=
5# LUDICORD_DISCORD_BOT_TOKEN=

Copy this file to .env.local. The generated .gitignore excludes .env.local.

#Understand each credential

Never prefix a secret to make it available in browser code. Ludicord intentionally exposes only the public configuration required by the client runtime.

#Environment file order

Use the conventional files for shared and mode-specific values:

1.env
2.env.local
3.env.development
4.env.development.local
5.env.production
6.env.production.local

Local variants override shared values and should remain uncommitted. Keep .env.example aligned with required names but leave secret values empty.

#Generate a session secret

Use a cryptographically random value, not a memorable password. Your deployment platform can generate or store the secret. Rotating it intentionally invalidates existing sessions.

Do not print secrets in build logs, error panels, screenshots, or client diagnostics. Ludicord redacts known sensitive values from its runtime error reporting, but application logging must follow the same rule.

#Platform variables

PORT and HOST may override the configured server address at runtime. This lets managed hosts select a port without changing source.

1PORT=8080
2HOST=0.0.0.0

Set production credentials in the hosting provider's secret manager, then run npm run build and npm run start in the same release environment.

#Public values in client code

The generated TypeScript declaration permits the public Client ID through the framework environment. Prefer framework hooks and configuration over reading arbitrary environment variables in components.

If UI needs a public application setting, serve it from checked configuration or a public API response. Never serialize process.env or return it from a route.

#Secret handling checklist

• Keep .env.local and production secret files out of Git.
• Use different Session Secrets for development and production.
• Rotate the Client Secret or bot token immediately after exposure.
• Never include a bot token in Discord SDK command options.
• Do not send raw OAuth access tokens to components.
• Restrict who can read or edit deployment secrets.
• Review tunnel and platform logs before sharing them.

#Next step

Continue to Development for the edit/compile/recovery loop and the Ludicord error panel.