Configuration

api (apps/api/.env.local)

Variable	Function
PORT	The port the api listens on. Default 3100 locally (see AGENTS.md, “Local ports”); Railway sets its own.
DATABASE_URL	Postgres connection.
BUDI_ADMIN_KEY	Admin key for scripts and curl, at least 32 characters. Acts as the owner User.
BUDI_OWNER_EMAIL	The owner’s email. That User is the Admin.
BUDI_OWNER_NAME	The owner’s name. Default Owner.
TENKI_API_KEY	Creates the Volumes and starts and closes the sessions.
BUDI_SESSION_IMAGE	The pinned session image, printed by image:build.
ANTHROPIC_API_KEY	The model key Claude Code uses inside the session. Give it a spend limit.
BUDI_MODEL	The Claude model. Default claude-sonnet-5-5.
R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY	R2 access.
R2_BUCKET	The private file bucket. Default budi-artifacts.
PRIVY_APP_ID	The Privy app. The signing keys come from Privy’s public key endpoint.
PRIVY_VERIFICATION_KEY	Optional override of Privy’s key.
CORS_ORIGIN	The web origins allowed to call the api, comma separated. Default http://localhost:5173.
CAREER_OPS_SOURCE	Only for workspace:seed: a local career-ops checkout.
PRIVY_TEST_EMAIL	Only for seed:test-user.

web (apps/web/.env.local)

Variable	Function
VITE_API_URL	The api address. No trailing slash.
VITE_PRIVY_APP_ID	The Privy app for sign-in.
VITE_POSTHOG_KEY, VITE_POSTHOG_HOST	Product analytics. Optional locally.
PRIVY_TEST_EMAIL, PRIVY_TEST_OTP	Only for the smoke test.

Rules for secrets

• Never commit a secret. .env*.local files are ignored.
• Put a secret only in the service that uses it.
• Use a service API key for model calls, never a personal subscription.
• Keep a spend limit on the model key. Each Claude Code call also has its own dollar cap (see Runs).