Configuration overview

Understand the configuration files and how they relate to each other.

discord.place uses two types of configuration: environment files (.env) for secrets and runtime values that must stay private, and config files (config.js / config.yml) for application-level settings that can be committed to version control.

Both the client and server have their own copies of each type.

Configuration files at a glance

client/.env

Secrets and public runtime values for the Next.js client. Includes the Cloudflare Turnstile site key, the CDN URL, the client port, and the shared CLIENT_SECRET.

server/.env

Secrets for the Express.js server. Includes all encryption keys, the Discord bot token, OAuth credentials, MongoDB URL, S3 credentials, Cloudflare Turnstile secret key, and optional service keys (Lemon Squeezy, Sentry, Better Stack).

client/config.js

Application settings for the client: available locales, support invite URL, docs URL, status URL, API base URL, analytics configuration, bot invite URL, and custom profile hostnames.

server/config.yml

Application settings for the server: Discord OAuth scopes, ports, base guild ID, role IDs, channel IDs, category lists, Lemon Squeezy variant IDs, rate limit whitelist, and available locales.

.env files — secrets

Environment files hold values that must not be exposed publicly: API keys, encryption secrets, database credentials, and tokens.

client/.env

ANALYZE=false
NEXT_PUBLIC_PORT=3000
NEXT_PUBLIC_CF_SITE_KEY=
CLIENT_SECRET=
NEXT_PUBLIC_CDN_URL=

Variable	Description
ANALYZE	Set to true to generate a Next.js bundle analysis report.
NEXT_PUBLIC_PORT	Port the client listens on.
NEXT_PUBLIC_CF_SITE_KEY	Your Cloudflare Turnstile site key (public, embedded in the browser).
CLIENT_SECRET	Shared secret used to authenticate SSR requests to the server. Must match the server’s CLIENT_SECRET.
NEXT_PUBLIC_CDN_URL	Public URL of your CDN or S3 bucket, used to serve emoji and sound files (e.g. https://cdn.yourdomain.com).

server/.env

The server .env holds all sensitive credentials. Key groups include:

• Encryption secrets: COOKIE_SECRET, BOT_API_KEY_ENCRYPT_SECRET, USER_TOKEN_ENCRYPT_SECRET, PAYMENTS_CUSTOM_DATA_ENCRYPT_SECRET_KEY, JWT_SECRET — use 256-bit hex keys for the encryption values.
• Discord: DISCORD_CLIENT_TOKEN (bot token), DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET (OAuth).
• Database: MONGO_URL — a MongoDB connection string.
• S3 storage: S3_BUCKET_NAME, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_REGION, S3_ENDPOINT.
• Cloudflare Turnstile: CLOUDFLARE_TURNSTILE_SECRET_KEY.
• Optional: LEMON_SQUEEZY_API_KEY, LEMON_SQUEEZY_WEBHOOK_SECRET, SENTRY_DSN, HEARTBEAT_ID_*, WEBHOOKS_PROXY_SERVER_*.

See the full reference at Server environment variables.

Config files — application settings

Config files hold non-secret settings that control how the application behaves. These can safely be committed to source control.

client/config.js

Located at client/config.js. Key settings:

Setting	Description
availableLocales	Locales the site supports. Must match locale files in client/locales/.
supportInviteUrl	Discord support server invite URL, shown throughout the site.
docsUrl	URL of your documentation site.
api.url	Base URL of the server API. Use http://localhost:3001 in development.
botInviteURL	Invite URL for the discord.place bot.
customHostnames	Custom short hostnames available for Premium profile URLs.

See the full reference at Client config.js.

server/config.yml

Located at server/config.yml. Key settings:

Setting	Description
frontendUrl / backendUrl	Public URLs for the client and server.
port.frontend / port.backend	Ports for the client (default 3000) and server (default 3001).
guildId	Discord guild ID for the bot’s base guild.
roles	Role IDs from the base guild for Premium, moderator, admin, etc.
lemonSqueezy.variantIds	Lemon Squeezy variant IDs for Premium plan products.
availableLocales	Locales the server supports. Must match files in server/src/locales/.

See the full reference at Server config.yml.

The CLIENT_SECRET handshake

CLIENT_SECRET is a shared secret between the client and the server. When the Next.js client makes server-side API requests, it attaches this value to authenticate itself. The server verifies the value before processing the request.

The CLIENT_SECRET in client/.env and server/.env must be identical. If they differ, all server-side rendering requests from the client will be rejected by the server.

Set it to any strong random string. A UUID or a random 32-character hex string works well.

Setting up your Discord application

1. Go to the Discord Developer Portal and create a new application.
2. In the Bot section, create a bot and copy the token — this is your DISCORD_CLIENT_TOKEN.
3. In the OAuth2 section, copy the Client ID and Client Secret — these are DISCORD_CLIENT_ID and DISCORD_CLIENT_SECRET.
4. Under OAuth2 → Redirects, add the redirect URL for your instance (e.g. https://api.yourdomain.com/auth/callback).
5. Enable the Server Members and Message Content privileged gateway intents if your use case requires them.

The Discord OAuth scopes required by the site are defined in server/config.yml under discordScopes. The defaults are identify, email, and guilds.