> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/discordplace/discord.place/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration overview

> Understand the configuration files and how they relate to each other.

discord.place uses two types of configuration: **environment files** (`.env`) for secrets and runtime values that must stay private, and **config files** (`config.js` / `config.yml`) for application-level settings that can be committed to version control.

Both the client and server have their own copies of each type.

## Configuration files at a glance

<CardGroup cols={2}>
  <Card title="client/.env" icon="lock" href="/self-hosting/env-client">
    Secrets and public runtime values for the Next.js client. Includes the Cloudflare Turnstile site key, the CDN URL, the client port, and the shared `CLIENT_SECRET`.
  </Card>

  <Card title="server/.env" icon="lock" href="/self-hosting/env-server">
    Secrets for the Express.js server. Includes all encryption keys, the Discord bot token, OAuth credentials, MongoDB URL, S3 credentials, Cloudflare Turnstile secret key, and optional service keys (Lemon Squeezy, Sentry, Better Stack).
  </Card>

  <Card title="client/config.js" icon="file-code" href="/self-hosting/config-client">
    Application settings for the client: available locales, support invite URL, docs URL, status URL, API base URL, analytics configuration, bot invite URL, and custom profile hostnames.
  </Card>

  <Card title="server/config.yml" icon="file-code" href="/self-hosting/config-server">
    Application settings for the server: Discord OAuth scopes, ports, base guild ID, role IDs, channel IDs, category lists, Lemon Squeezy variant IDs, rate limit whitelist, and available locales.
  </Card>
</CardGroup>

## .env files — secrets

Environment files hold values that must not be exposed publicly: API keys, encryption secrets, database credentials, and tokens.

### client/.env

```env theme={null}
ANALYZE=false
NEXT_PUBLIC_PORT=3000
NEXT_PUBLIC_CF_SITE_KEY=
CLIENT_SECRET=
NEXT_PUBLIC_CDN_URL=
```

| Variable                  | Description                                                                                                   |
| ------------------------- | ------------------------------------------------------------------------------------------------------------- |
| `ANALYZE`                 | Set to `true` to generate a Next.js bundle analysis report.                                                   |
| `NEXT_PUBLIC_PORT`        | Port the client listens on.                                                                                   |
| `NEXT_PUBLIC_CF_SITE_KEY` | Your Cloudflare Turnstile **site key** (public, embedded in the browser).                                     |
| `CLIENT_SECRET`           | Shared secret used to authenticate SSR requests to the server. Must match the server's `CLIENT_SECRET`.       |
| `NEXT_PUBLIC_CDN_URL`     | Public URL of your CDN or S3 bucket, used to serve emoji and sound files (e.g. `https://cdn.yourdomain.com`). |

### server/.env

The server `.env` holds all sensitive credentials. Key groups include:

* **Encryption secrets**: `COOKIE_SECRET`, `BOT_API_KEY_ENCRYPT_SECRET`, `USER_TOKEN_ENCRYPT_SECRET`, `PAYMENTS_CUSTOM_DATA_ENCRYPT_SECRET_KEY`, `JWT_SECRET` — use 256-bit hex keys for the encryption values.
* **Discord**: `DISCORD_CLIENT_TOKEN` (bot token), `DISCORD_CLIENT_ID`, `DISCORD_CLIENT_SECRET` (OAuth).
* **Database**: `MONGO_URL` — a MongoDB connection string.
* **S3 storage**: `S3_BUCKET_NAME`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`, `S3_REGION`, `S3_ENDPOINT`.
* **Cloudflare Turnstile**: `CLOUDFLARE_TURNSTILE_SECRET_KEY`.
* **Optional**: `LEMON_SQUEEZY_API_KEY`, `LEMON_SQUEEZY_WEBHOOK_SECRET`, `SENTRY_DSN`, `HEARTBEAT_ID_*`, `WEBHOOKS_PROXY_SERVER_*`.

See the full reference at [Server environment variables](/self-hosting/env-server).

## Config files — application settings

Config files hold non-secret settings that control how the application behaves. These can safely be committed to source control.

### client/config.js

Located at `client/config.js`. Key settings:

| Setting            | Description                                                              |
| ------------------ | ------------------------------------------------------------------------ |
| `availableLocales` | Locales the site supports. Must match locale files in `client/locales/`. |
| `supportInviteUrl` | Discord support server invite URL, shown throughout the site.            |
| `docsUrl`          | URL of your documentation site.                                          |
| `api.url`          | Base URL of the server API. Use `http://localhost:3001` in development.  |
| `botInviteURL`     | Invite URL for the discord.place bot.                                    |
| `customHostnames`  | Custom short hostnames available for Premium profile URLs.               |

See the full reference at [Client config.js](/self-hosting/config-client).

### server/config.yml

Located at `server/config.yml`. Key settings:

| Setting                          | Description                                                             |
| -------------------------------- | ----------------------------------------------------------------------- |
| `frontendUrl` / `backendUrl`     | Public URLs for the client and server.                                  |
| `port.frontend` / `port.backend` | Ports for the client (default `3000`) and server (default `3001`).      |
| `guildId`                        | Discord guild ID for the bot's base guild.                              |
| `roles`                          | Role IDs from the base guild for Premium, moderator, admin, etc.        |
| `lemonSqueezy.variantIds`        | Lemon Squeezy variant IDs for Premium plan products.                    |
| `availableLocales`               | Locales the server supports. Must match files in `server/src/locales/`. |

See the full reference at [Server config.yml](/self-hosting/config-server).

## The CLIENT\_SECRET handshake

`CLIENT_SECRET` is a shared secret between the client and the server. When the Next.js client makes server-side API requests, it attaches this value to authenticate itself. The server verifies the value before processing the request.

<Warning>
  The `CLIENT_SECRET` in `client/.env` and `server/.env` must be identical. If they differ, all server-side rendering requests from the client will be rejected by the server.
</Warning>

Set it to any strong random string. A UUID or a random 32-character hex string works well.

## Setting up your Discord application

1. Go to the [Discord Developer Portal](https://discord.com/developers/applications) and create a new application.
2. In the **Bot** section, create a bot and copy the **token** — this is your `DISCORD_CLIENT_TOKEN`.
3. In the **OAuth2** section, copy the **Client ID** and **Client Secret** — these are `DISCORD_CLIENT_ID` and `DISCORD_CLIENT_SECRET`.
4. Under **OAuth2 → Redirects**, add the redirect URL for your instance (e.g. `https://api.yourdomain.com/auth/callback`).
5. Enable the **Server Members** and **Message Content** privileged gateway intents if your use case requires them.

<Note>
  The Discord OAuth scopes required by the site are defined in `server/config.yml` under `discordScopes`. The defaults are `identify`, `email`, and `guilds`.
</Note>