Configuration

Cobblr is configured with environment variables, set in your .env for a self-hosted install. Most have sensible defaults; the ones below are the ones you actually reach for. See Self-hosting for the setup and the privacy controls.

Secrets (set these)

Var	What it is
POSTGRES_PASSWORD	Postgres password (match it in DATABASE_URL).
JWT_SECRET	Signs login sessions. Generate with openssl rand -hex 32.
TENANT_CREDS_ENCRYPTION_KEY	Encrypts stored per-workspace credentials. Any strong secret, 16+ characters (e.g. openssl rand -hex 32). Back it up; losing it is unrecoverable.

Access

Var	Default	Effect
PUBLIC_SIGNUP_ENABLED	off in prod	Allow self-service account signup. Turn on to create your first account, then off.
SUPERADMIN_EMAILS	empty	Comma-separated operator emails that get the admin console.
CORS_ALLOWED_ORIGINS	reflect-any in dev	Allowed web origins in production.

AI

Var	Default	Effect
COBBLR_AI_ENABLED	true	Master switch for built-in AI features. With no provider key nothing is called; set false to guarantee no outbound AI.

Scanning

Barcode scanning contacts third-party product catalogs. Each provider is switchable and takes its own key. Full table in Self-hosting -> Privacy.

Var	Default	Effect
COBBLR_SCAN_EXTERNAL_LOOKUPS	on	Master switch. false means no third-party barcode calls.
COBBLR_SCAN_GOUPC_API_KEY	empty	Use go-upc's official API.
COBBLR_SCAN_UPCITEMDB_KEY	empty	Use your upcitemdb paid quota.

Marketplace

Var	Default	Effect
COBBLR_EXTENSIONS_URL	Cobblr's public catalog	Point the marketplace at your own catalog instead.
COBBLR_ROOT_PUBKEY	empty	Public key used to verify signed extensions.

Email (optional)

Magic-link and invite delivery. Pick a provider with COBBLR_AUTH_EMAIL_PROVIDER and set its keys (COBBLR_AUTH_SMTP_*, or a Mailgun / Resend / Postmark key). Unset means links are shown in the app instead of emailed. Setup walkthrough: Self-hosting -> Email.

(This is the common subset. A full variable list will follow.)