Server Environment Variables

Configure the discord.place Express.js server with these environment variables.

Create a .env file in the server/ directory. Use server/.example.env as your starting template.

Required secrets

You should use 256-bit secret keys for BOT_API_KEY_ENCRYPT_SECRET, USER_TOKEN_ENCRYPT_SECRET, and PAYMENTS_CUSTOM_DATA_ENCRYPT_SECRET_KEY. You can generate a 256-bit key in hexadecimal format using a tool like this one.

COOKIE_SECRET · string · required

Secret key used to sign and encrypt session cookies. Use a long, random string.

BOT_API_KEY_ENCRYPT_SECRET · string · required

256-bit secret key used to encrypt bot API keys stored in the database.

USER_TOKEN_ENCRYPT_SECRET · string · required

256-bit secret key used to encrypt Discord user access tokens at rest.

PAYMENTS_CUSTOM_DATA_ENCRYPT_SECRET_KEY · string · required

256-bit secret key used to encrypt custom metadata attached to payment records.

JWT_SECRET · string · required

Secret key used to sign and verify JSON Web Tokens issued by the server.

CLIENT_SECRET · string · required

Shared secret used to authenticate requests from the Next.js client’s server-side rendering.

This value must match the CLIENT_SECRET variable set in the client’s .env file. If these differ, server-side rendering requests will be rejected.

Discord credentials

DISCORD_CLIENT_TOKEN · string · required

The bot token for your Discord application. Found in the Discord Developer Portal under Bot > Token.

DISCORD_CLIENT_SECRET · string · required

The OAuth2 client secret for your Discord application. Found in the Developer Portal under OAuth2 > Client Secret.

DISCORD_CLIENT_ID · string · required

The application (client) ID for your Discord application. Found in the Developer Portal under General Information.

DISCORD_PORTAL_CHANNEL_WEBHOOK_URL · string

A Discord webhook URL used to post notifications to an internal portal channel (e.g. new bot approved, new emoji published). This webhook must be created by the bot itself so that interactive components (link buttons) are included in the messages.

Must follow the format https://discord.com/api/webhooks/XXX/XXX. Safe to leave empty.

Database

MONGO_URL · string · required

MongoDB connection string. Accepts both local instances (mongodb://localhost:27017/discordplace) and cloud-hosted services like MongoDB Atlas.

S3 storage

All S3_* variables (excluding the database backup set) are required. discord.place uses S3-compatible object storage to serve emoji images and sound files. Cloudflare R2 is recommended but any S3-compatible provider works.

S3_BUCKET_NAME · string · required

Name of the S3 bucket used for storing emoji and sound assets.

S3_ACCESS_KEY_ID · string · required

Access key ID for authenticating with the S3 provider.

S3_SECRET_ACCESS_KEY · string · required

Secret access key for authenticating with the S3 provider.

S3_REGION · string · required

Region where the bucket is hosted (e.g. us-east-1, auto for Cloudflare R2).

S3_ENDPOINT · string · required

Custom endpoint URL for S3-compatible providers. For Cloudflare R2 this looks like https://<account-id>.r2.cloudflarestorage.com.

CDN_URL · string · required

Public base URL of the CDN from which assets are served. Must be a valid URL with no trailing slash, e.g. https://cdn.yourdomain.com. This value should match NEXT_PUBLIC_CDN_URL on the client.

S3 database backups (optional)

These variables configure a separate S3 bucket for daily database backups. If left empty the server will still start but will print warnings and skip backups entirely.

S3_DATABASE_BACKUP_BUCKET_NAME · string

Name of the S3 bucket used for database backup archives.

S3_DATABASE_BACKUP_ACCESS_KEY_ID · string

Access key ID for the backup bucket.

S3_DATABASE_BACKUP_SECRET_ACCESS_KEY · string

Secret access key for the backup bucket.

S3_DATABASE_BACKUP_REGION · string

Region for the backup bucket.

S3_DATABASE_BACKUP_ENDPOINT · string

Endpoint URL for the backup bucket’s S3-compatible provider.

Bot protection

CLOUDFLARE_TURNSTILE_SECRET_KEY · string · required

Your Cloudflare Turnstile secret key, used server-side to verify Turnstile tokens submitted by users. Obtain this from the Cloudflare Turnstile dashboard.

Payments — Lemon Squeezy (optional)

LEMON_SQUEEZY_WEBHOOK_SECRET · string

Webhook signing secret used to verify that incoming events are from Lemon Squeezy. See the Lemon Squeezy webhook docs for setup instructions.

LEMON_SQUEEZY_API_KEY · string

API key for making authenticated requests to the Lemon Squeezy API. See the Lemon Squeezy Developer Guide to create one.

Uptime monitoring (optional)

HEARTBEAT_ID_DAILY_DATABASE_BACKUP · string

Heartbeat ID from Better Stack Uptime. A ping is sent to this heartbeat after each successful daily database backup.

HEARTBEAT_ID_S3_BUCKET_AVAILABILITY · string

Heartbeat ID for monitoring S3 bucket availability. A ping is sent after each successful S3 health check.

Bot guild count API (optional)

DISCORD_BOT_GET_APPROXIMATE_GUILD_COUNT_API_URL · string

Base URL of a private API used to look up the approximate guild count for a bot. If omitted, bots will not be able to update server_count via the public API.

DISCORD_BOT_GET_APPROXIMATE_GUILD_COUNT_API_SECRET · string

Secret key for authenticating requests to the guild count API above.

Webhook proxy (optional)

If you route outgoing webhook requests through a proxy server, set these variables. Leave all of them empty to send webhooks directly.

WEBHOOKS_PROXY_SERVER_PROTOCOL · string

Protocol for the proxy server, e.g. http or https.

WEBHOOKS_PROXY_SERVER_HOST · string

Hostname or IP address of the proxy server.

WEBHOOKS_PROXY_SERVER_PORT · string

Port number the proxy server listens on.

WEBHOOKS_PROXY_SERVER_USERNAME · string

Username for proxy authentication. Leave empty if not required.

WEBHOOKS_PROXY_SERVER_PASSWORD · string

Password for proxy authentication. Leave empty if not required.

Error tracking — Sentry (optional)

SENTRY_DSN · string

Sentry Data Source Name (DSN) for error and performance monitoring. Obtain this from your Sentry project settings. Leave empty to disable Sentry.

GitHub translator sync (optional)

GITHUB_AUTO_SYNC_TRANSLATORS_SECRET · string

Secret key used to authenticate the GitHub webhook that triggers automatic syncing of translator roles in the base guild. When configured, a push to the main branch will sync role assignments based on the client/locales/translators.json file.