> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orca.0-9.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> Configure OpenIndex behavior with environment variables.

OpenIndex reads configuration from environment variables at startup. Set these in your deployment environment to customize behavior.

## Timezone

<ParamField path="OPENINDEX_TIMEZONE" type="string" default="Australia/Perth">
  Default timezone for the Convex backend. Affects scheduling, display, and audit timestamps. Use any valid IANA timezone identifier (e.g. `America/New_York`, `Europe/London`).
</ParamField>

<ParamField path="NEXT_PUBLIC_OPENINDEX_TIMEZONE" type="string" default="Australia/Perth">
  Default timezone for the web UI. Set this to the same value as `OPENINDEX_TIMEZONE` so the web UI and backend agree on time rendering.
</ParamField>

<Note>
  Both variables must be set if you want consistent timezone display across the backend and the web UI.
</Note>

## CORS

<ParamField path="OPENINDEX_ALLOWED_ORIGINS" type="string">
  Comma-separated CORS allowlist for Convex HTTP actions. In production, set this to the explicit origin of your deployment (e.g. `https://app.example.com`).

  Supports wildcard host suffixes for preview environments:

  ```
  http://localhost:3001,https://*.vercel.app
  ```

  Also supports wildcard loopback ports (e.g. `http://localhost:*`) for local development.
</ParamField>

<Warning>
  Leave this variable unset only during initial local development. In any shared or production environment, restrict it to the specific origins that should be allowed to call your API.
</Warning>

## Authentication email

<ParamField path="AUTH_RESEND_KEY" type="string" required>
  Resend API key used to send authentication emails (magic links, invite emails). Starts with `re_`.
</ParamField>

<ParamField path="AUTH_EMAIL_FROM" type="string" required>
  The sender address for authentication emails. Use the format `Display Name <address@example.com>`. The sending domain must be verified in your Resend account.
</ParamField>

## Inbound email

<ParamField path="RESEND_WEBHOOK_SECRET" type="string" required>
  Webhook signing secret from Resend, used to verify inbound email webhook payloads. Starts with `whsec_`. Required when you provision an inbound receiving domain through the email infrastructure settings.
</ParamField>

<Tip>
  `RESEND_WEBHOOK_SECRET` is also used for work-item comment email threading by default. You can override this with `COMMENT_EMAIL_WEBHOOK_SECRET` if you use a separate Resend webhook endpoint for comment replies.
</Tip>

## Attachments

<ParamField path="ATTACHMENTS_MAX_BYTES" type="number" default="104857600">
  Maximum file attachment size in bytes. Defaults to 100 MB (104857600). Uploads that exceed this limit are rejected before storage.
</ParamField>

## Calendar sync

<ParamField path="CALENDAR_SYNC_BASE_INTERVAL_MS" type="number" default="1800000">
  Base interval for calendar sync in milliseconds. Defaults to 30 minutes (1800000). The sync scheduler uses this as the starting backoff interval.
</ParamField>

<ParamField path="CALENDAR_SYNC_MAX_INTERVAL_MS" type="number" default="172800000">
  Maximum interval between calendar syncs in milliseconds. Defaults to 48 hours (172800000). The sync scheduler will not wait longer than this between attempts, even under exponential backoff.
</ParamField>

<Note>
  Manual syncs triggered via `POST /calendar-sources/:id/sync` or `oi calendar-sources sync` run immediately regardless of the interval settings.
</Note>

## CLI troubleshooting

<ParamField path="OPENINDEX_API_URL" type="string">
  Shell environment override for the `oi` CLI base URL. Use this to point the CLI at a specific deployment when troubleshooting, without updating your stored CLI profile.

  ```bash theme={null}
  OPENINDEX_API_URL=https://your-deployment.convex.site oi auth check
  ```

  This variable is not persisted — it applies only for the duration of the shell session or command.
</ParamField>