Environment variables

None of these are needed for backend: { type: 'local' } in development.

Identity

Variable	Required for	Where it comes from
COPY_INK_GITHUB_CLIENT_ID	Sign-in	An OAuth App, or a GitHub App's client credentials
COPY_INK_GITHUB_CLIENT_SECRET	Sign-in	The same app

Without both, GET /auth/signin fails with CONFIG_INVALID and copy-ink doctor reports oauth-credentials.

The app's callback URL must be https://your-site.com/api/copy-ink/auth/callback — or the same path under a custom apiPath.

Sessions

Variable	Required for	Where it comes from
COPY_INK_SESSION_SECRET	Sessions that outlive one process	openssl rand -base64 32

Set it on anything serverless, or anything running more than one instance — which is most production hosting. Without it sessions live in one process's memory, so a client is signed out the moment a request lands somewhere else. copy-ink doctor reports session-secret when it is missing.

The same value has to be set everywhere the site runs, and changing it signs everyone out. See Sessions.

Committing

Pick one of the two groups.

GitHub App installation (recommended)

Variable	Where it comes from
COPY_INK_GITHUB_APP_ID	The App's settings page
COPY_INK_GITHUB_PRIVATE_KEY	A generated private key, PEM format
COPY_INK_GITHUB_INSTALLATION_ID	The installation's settings URL

The App needs one repository permission: Contents: Read and write. Install it on the single repository named by backend.repo.

COPY_INK_GITHUB_PRIVATE_KEY is a multi-line PEM. Keep the newlines when pasting it into a host's environment UI, or store it base64-encoded and decode it before handing it over.

Personal access token

Variable	Where it comes from
COPY_INK_GITHUB_TOKEN	A fine-grained PAT with Contents: write on the repo

A PAT works as a ContentBackend but never as auth — a shared token cannot identify who made a change. copy-ink doctor warns (pat-backend) when one is in use. It is a reasonable choice for a staging environment and a poor one for a site a client edits.

If neither group is present, setupCopyInk throws CONFIG_INVALID on the first publish attempt and doctor reports github-credentials.

Standard Node variables

Variable	Effect
NODE_ENV=production	Disables the local auth provider unconditionally, whatever the config says
NO_COLOR	Turns off CLI colour

Local development

.env.local

# Nothing at all — this is the point of the local backend.

copy-ink.config.ts

backend: { type: 'local' }

Outside production, the local backend installs a local auth provider that signs you straight in. No App, no OAuth credentials, no allowlist check.

A production .env

COPY_INK_GITHUB_CLIENT_ID=Iv1.0123456789abcdef
COPY_INK_GITHUB_CLIENT_SECRET=…
COPY_INK_SESSION_SECRET=…
COPY_INK_GITHUB_APP_ID=123456
COPY_INK_GITHUB_INSTALLATION_ID=12345678
COPY_INK_GITHUB_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
…
-----END RSA PRIVATE KEY-----"

Verify with:

npx copy-ink doctor

against the deployed environment, not your laptop.