Environment Variables

All environment variables required to run Mais Hábito API.

The API is configured entirely through environment variables. Copy .env.example to .env and fill in the values before starting the server.

.env.example

.env.example

# Server
PORT=3000
NODE_ENV=development

# Database
DB_HOST=localhost
DB_PORT=5432
DB_NAME=mais_habito
DB_USER=postgres
DB_PASSWORD=your_password_here

# JWT
JWT_SECRET=your_super_secret_key_here

FRONTEND_URL=http://localhost:PORT_HERE

Variable reference

Variable	Default	Required	Description
PORT	3000	No	Port the HTTP server listens on
NODE_ENV	development	No	Runtime environment (development or production)
DB_HOST	localhost	Yes	PostgreSQL host
DB_PORT	5432	Yes	PostgreSQL port
DB_NAME	mais-habito-db	Yes	Database name
DB_USER	postgres	Yes	Database user
DB_PASSWORD	(empty)	Yes	Database password
JWT_SECRET	change-this-secret	Yes	Secret key used to sign JWT tokens
FRONTEND_URL	—	Yes	Allowed CORS origin for the frontend app

Variable details

env.PORT · number · default: "3000"

Port the Express server binds to. Override this when running multiple services on the same host or deploying behind a reverse proxy.

env.NODE_ENV · string · default: "development"

Controls runtime behavior: logging verbosity, .env file loading, SSL enforcement, and migration file extension. Accepted values are development and production.

env.DB_HOST · string · default: "localhost" · required

Hostname or IP address of the PostgreSQL server.

env.DB_PORT · number · default: "5432" · required

TCP port PostgreSQL is listening on.

env.DB_NAME · string · default: "mais-habito-db" · required

Name of the PostgreSQL database. The .env.example uses mais_habito; make sure the value matches the database you created.

env.DB_USER · string · default: "postgres" · required

PostgreSQL role used to connect to the database.

env.DB_PASSWORD · string · required

Password for the PostgreSQL role specified in DB_USER.

env.JWT_SECRET · string · required

Secret string used to sign and verify JWT access tokens. Must be kept private — never commit it to version control.

env.FRONTEND_URL · string · required

Full origin URL of the frontend application (e.g. http://localhost:5173). This value is passed directly to the CORS middleware as the allowed origin.

In production, JWT_SECRET must be a long, randomly generated string. Using a weak or guessable secret allows attackers to forge valid tokens and authenticate as any user.

Generate a cryptographically secure secret with:

openssl rand -base64 32

When NODE_ENV is set to development, the API automatically loads variables from a .env file at the project root via dotenv. In production, environment variables must be injected by the host environment (e.g. Docker, Railway, or a process manager) — the .env file is not read. SSL for the database connection is also enabled automatically in production.