Settings and secrets

Two kinds of value. A var is public: it ships in the Worker’s configuration file and is meant to be read. A secret is set out of band and never committed. Putting one in the other’s place is the mistake this page exists to prevent.

Secrets

Every one of these is optional in the same sense: unset means the feature it unlocks reports itself unavailable. None of them ever opens anything up by being absent.

• ANTHROPIC_API_KEY or DEEPSEEK_API_KEY, to match whichever provider you selected. Without the matching key, generation refuses.
• CLERK_SECRET_KEY, and CLERK_PUBLISHABLE_KEY at build time for the interface. Without them nobody can sign in, and every protected endpoint refuses.
• PREVIEW_INTERNAL_SECRET, shared with the sandbox Worker. Both sides must carry the same value.
• PUBLISH_INTERNAL_SECRET, shared with the publish Worker. Deliberately a different value from the one above: a leak of one must not compromise the other.
• STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET, only if you are charging.
• VIBLD_MODEL_POLICY, JSON naming which models each identity may use. A secret rather than a var because it names people. Absent means no policy: everyone may use whatever the deployment can serve.

The GitHub App’s four values (VIBLD_GITHUB_APP_ID, VIBLD_GITHUB_PRIVATE_KEY, VIBLD_GITHUB_CLIENT_ID, VIBLD_GITHUB_CLIENT_SECRET) are secrets too. The private key is a PEM file that downloads once; it belongs in a secret store and nowhere else, not in an email and not pasted into a chat window.

Vars you have to set

• VIBLD_PROVIDER: anthropic or deepseek. Explicit beats inferred, so set it rather than relying on which key happens to be present.
• CLERK_FRONTEND_API_URL: your Clerk instance’s Frontend API URL. A public identifier, not a secret. It is both the issuer the Worker matches tokens against and the base it fetches the signing keys from.

Vars that bound spend

• VIBLD_ACCOUNT_DAILY_MICRO_USD: what the whole deployment may spend per UTC day, across every account. This is the one that stops a compromised account spending the month. The shipped default is a starting point, not a measured figure.
• VIBLD_FREE_MONTHLY_MICRO_USD: the Free tier’s monthly allowance. Set it only to change that figure. Paid tiers are not configurable here, since their included spend is fixed by the price table rather than by an operator.
• VIBLD_MAX_IN_FLIGHT: concurrent runs per user.
• VIBLD_SIGNUP_CREDIT_USD_CENTS and VIBLD_SIGNUP_CREDIT_FROM: the one-time grant for a new account, and the instant from which accounts count as new. The second has no default on purpose. Any default early enough to catch new accounts also catches every account that already exists, and this is money.

Vars you should probably leave alone

VIBLD_USD_MICRO_PER_INPUT_TOKEN and VIBLD_USD_MICRO_PER_OUTPUT_TOKEN override the running model’s own rate. There is one good reason to set them, which is that the built-in rate for your model is wrong.

Setting them for any other reason has a specific failure that has already happened once here: pinning one provider’s prices while running another’s model ceilinged every run at roughly forty times its real cost, which turned a budget that afforded forty generations a day into two.