Environment Variables

Complete reference for all environment variables.

Required Variables

Database

DATABASE_URL="postgresql://user:password@localhost:5432/atract_dev"

Hyperliquid API

Public (client-side):

NEXT_PUBLIC_HL_API_BASE_URL="https://api.hyperliquid-testnet.xyz"

Private (server-side):

HL_AGENT_PRIVATE_KEY="0x..."  # Never expose to client

Oracle Service

HL_RPC_URL="https://rpc.hyperliquid-testnet.xyz/evm"
ORACLE_PRIVATE_KEY="0x..."  # Server-only

Authentication

SESSION_SECRET="your-random-256-bit-secret"
NEXT_PUBLIC_SITE_URL="http://localhost:3000"

Optional Variables

Email Notifications (Future)

SENDGRID_API_KEY="SG...."
NOTIFICATION_FROM_EMAIL="[email protected]"

Monitoring

SENTRY_DSN="https://..."
SENTRY_AUTH_TOKEN="..."

Rate Limiting

RATE_LIMIT_REQUESTS_PER_MINUTE="100"

Network-Specific Variables

Testnet

NEXT_PUBLIC_HL_API_BASE_URL="https://api.hyperliquid-testnet.xyz"
ARBITRUM_RPC_URL="https://sepolia-rollup.arbitrum.io/rpc"
NEXT_PUBLIC_USDC_ADDRESS="0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d"

Mainnet (Future)

NEXT_PUBLIC_HL_API_BASE_URL="https://api.hyperliquid.xyz"
ARBITRUM_RPC_URL="https://arb1.arbitrum.io/rpc"
NEXT_PUBLIC_USDC_ADDRESS="0xaf88d065e77c8cC2239327C5EDb3A432268e5831"

Security Guidelines

Never Commit

Do NOT commit these to git:

  • HL_AGENT_PRIVATE_KEY

  • ORACLE_PRIVATE_KEY

  • SESSION_SECRET

  • DATABASE_URL (if contains credentials)

  • Any API keys

Safe to Expose

These are safe as NEXT_PUBLIC_ (client-accessible):*

  • NEXT_PUBLIC_HL_API_BASE_URL

  • NEXT_PUBLIC_SITE_URL

  • NEXT_PUBLIC_USDC_ADDRESS

  • NEXT_PUBLIC_VAULT_FACTORY_ADDRESS

Generation

Generate secure secrets:

# Session secret
openssl rand -hex 32

# Private keys (use existing wallet or generate)
# Never use production keys in development

Loading Order

  1. .env.local (local overrides, gitignored)

  2. .env.development (development defaults)

  3. .env.production (production defaults)

  4. .env (fallback, committed)

Validation

On startup, Atract validates required variables:

const required = [
  'DATABASE_URL',
  'HL_AGENT_PRIVATE_KEY',
  'ARBITRUM_RPC_URL'
];

for (const key of required) {
  if (!process.env[key]) {
    throw new Error(`Missing required env var: ${key}`);
  }
}

Related Pages

PreviousLocal DevelopmentNextSecurity

Last updated