| WEBAPP_URL | Base URL of the site. | required | http://localhost:3000 |
| PUBLIC_URL | Base URL for the public domain where surveys and public-facing content are served. If not set, uses WEBAPP_URL. | optional | WEBAPP_URL |
| NEXTAUTH_URL | Location of the auth server. This should normally be the same as WEBAPP_URL | required | http://localhost:3000 |
| DATABASE_URL | Database URL with credentials. | required | |
| NEXTAUTH_SECRET | Secret for NextAuth, used for session signing and encryption. | required | (Generated by the user, must not exceed 32 bytes, openssl rand -hex 32) |
| ENCRYPTION_KEY | Secret used by Formbricks for data encryption and audit log hashing. | required | (Generated by the user, must not exceed 32 bytes, openssl rand -hex 32) |
| CRON_SECRET | API Secret for running cron jobs. | required | (Generated by the user, must not exceed 32 bytes, openssl rand -hex 32) |
| LOG_LEVEL | Minimum log level (debug, info, warn, error, fatal) | optional | info |
| S3_ACCESS_KEY | Access key for S3. | optional | (resolved by the AWS SDK) |
| S3_SECRET_KEY | Secret key for S3. | optional | (resolved by the AWS SDK) |
| S3_REGION | Region for S3. | optional | (resolved by the AWS SDK) |
| S3_BUCKET_NAME | S3 bucket name for data storage. Formbricks enables S3 storage when this is set. | optional (required if S3 is enabled) | |
| S3_ENDPOINT_URL | Endpoint for S3. | optional | (resolved by the AWS SDK) |
| S3_FORCE_PATH_STYLE | Set to 1 to force path-style S3 URLs. Required for S3-compatible storage (MinIO, RustFS, LocalStack). Leave unset or 0 for standard AWS S3. | optional | 0 |
| SAML_DATABASE_URL | Database URL for SAML. | optional | postgres://postgres:@localhost:5432/formbricks-saml |
| PRIVACY_URL | URL for privacy policy. | optional | |
| TERMS_URL | URL for terms of service. | optional | |
| IMPRINT_URL | URL for imprint. | optional | |
| IMPRINT_ADDRESS | Address for imprint. | optional | |
| EMAIL_AUTH_DISABLED | Disables the ability for users to signup or login via email and password if set to 1. | optional | |
| PASSWORD_RESET_DISABLED | Disables password reset functionality if set to 1. | optional | |
| PASSWORD_RESET_TOKEN_LIFETIME_MINUTES | Configures how long password reset links remain valid in minutes. Accepted values are integers from 5 to 120. | optional | 30 |
| EMAIL_VERIFICATION_DISABLED | Disables email verification if set to 1. | optional | |
| DISABLE_ACCOUNT_DELETION_SSO_CONFIRMATION | Skips the SSO identity confirmation redirect for passwordless SSO account deletion if set to 1. Users can delete SSO accounts with only the in-app email text confirmation. Keep unset unless you accept this security trade-off. | optional | |
| RATE_LIMITING_DISABLED | Disables only the application-level rate limiter if set to 1. It does not disable Envoy or an equivalent edge rate limiter. | optional | |
| TELEMETRY_DISABLED | Disables telemetry reporting if set to 1. Ignored when an Enterprise License is active. | optional | |
| DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS | Allows webhook URLs to point to internal/private network addresses (e.g. localhost, 192.168.x.x) if set to 1. Useful for self-hosted instances that need to send webhooks to internal services. | optional | |
| INVITE_DISABLED | Disables the ability for invited users to create an account if set to 1. | optional | |
| MAIL_FROM | Email address to send emails from. | optional (required if email services are to be enabled) | |
| MAIL_FROM_NAME | Email name/title to send emails from. | optional (required if email services are to be enabled) | |
| SMTP_HOST | Host URL of your SMTP server. | optional (required if email services are to be enabled) | |
| SMTP_PORT | Host Port of your SMTP server. | optional (required if email services are to be enabled) | |
| SMTP_USER | Username for your SMTP Server. | optional (required if email services are to be enabled) | |
| SMTP_PASSWORD | Password for your SMTP Server. | optional (required if email services are to be enabled) | |
| SMTP_AUTHENTICATED | If set to 0, the server will not require SMTP_USER and SMTP_PASSWORD(default is 1) | optional | |
| SMTP_SECURE_ENABLED | SMTP secure connection. For using TLS, set to 1 else to 0. | optional (required if email services are to be enabled) | |
| SMTP_REJECT_UNAUTHORIZED_TLS | If set to 0, the server will accept connections without requiring authorization from the list of supplied CAs. | optional | 1 |
| TURNSTILE_SITE_KEY | Site key for Turnstile. | optional | |
| TURNSTILE_SECRET_KEY | Secret key for Turnstile. | optional | |
| RECAPTCHA_SITE_KEY | Site key for survey responses recaptcha bot protection | optional | |
| RECAPTCHA_SECRET_KEY | Secret key for recaptcha bot protection. | optional | |
| GITHUB_ID | Client ID for GitHub. | optional (required if GitHub auth is enabled) | |
| GITHUB_SECRET | Secret for GitHub. | optional (required if GitHub auth is enabled) | |
| GOOGLE_CLIENT_ID | Client ID for Google. | optional (required if Google auth is enabled) | |
| GOOGLE_CLIENT_SECRET | Secret for Google. | optional (required if Google auth is enabled) | |
| AI_PROVIDER | Instance-level AI provider used in the background. Supported values: aws, google, azure, openai-compatible. | optional (required if AI is enabled) | |
| AI_MODEL | Instance-level AI model or deployment name used by the active provider. | optional (required if AI_PROVIDER is set) | |
| AI_GOOGLE_CLOUD_PROJECT | Google Cloud project ID for the google AI provider. | optional (required if AI_PROVIDER=google) | |
| AI_GOOGLE_CLOUD_LOCATION | Google Cloud location for google AI requests. For gemini-3.5-flash, use global, us, or eu. | optional (required if AI_PROVIDER=google) | |
| AI_GOOGLE_CLOUD_CREDENTIALS_JSON | Optional service account credentials JSON override for the google AI provider. Omit when Application Default Credentials are available. | optional | |
| AI_GOOGLE_CLOUD_APPLICATION_CREDENTIALS | Optional path to Google Application Default Credentials used by the google AI provider. | optional | |
| AI_AWS_REGION | AWS region for Amazon Bedrock. | optional (required if AI_PROVIDER=aws) | |
| AI_AWS_ACCESS_KEY_ID | AWS access key ID for Amazon Bedrock. | optional (required if AI_PROVIDER=aws) | |
| AI_AWS_SECRET_ACCESS_KEY | AWS secret access key for Amazon Bedrock. | optional (required if AI_PROVIDER=aws) | |
| AI_AWS_SESSION_TOKEN | AWS session token for Amazon Bedrock temporary credentials. | optional | |
| AI_AZURE_BASE_URL | Azure OpenAI / Foundry base URL. When set, this is preferred over AI_AZURE_RESOURCE_NAME. | optional (one of this or AI_AZURE_RESOURCE_NAME required if AI_PROVIDER=azure) | |
| AI_AZURE_RESOURCE_NAME | Azure resource name used to assemble the Azure OpenAI URL. | optional (one of this or AI_AZURE_BASE_URL required if AI_PROVIDER=azure) | |
| AI_AZURE_API_KEY | API key for Azure OpenAI / Foundry. | optional (required if AI_PROVIDER=azure) | |
| AI_AZURE_API_VERSION | Azure API version for OpenAI-compatible calls. | optional | v1 |
| AI_OPENAI_COMPATIBLE_BASE_URL | Base URL for a Qwen/vLLM OpenAI-compatible /v1 endpoint, e.g. http://vllm:8000/v1. | optional (required if AI_PROVIDER=openai-compatible) | |
| AI_OPENAI_COMPATIBLE_API_KEY | Optional API key for the OpenAI-compatible endpoint. | optional | |
| AI_OPENAI_COMPATIBLE_PROVIDER_NAME | Provider name passed to the OpenAI-compatible adapter. Use vllm for the supported Qwen/vLLM self-hosted path. | optional | openai-compatible |
| AI_OPENAI_COMPATIBLE_SUPPORTS_STRUCTURED_OUTPUTS | Set to 1 when the Qwen/vLLM endpoint supports structured outputs. | optional | 0 |
| AI_OPENAI_COMPATIBLE_HEADERS_JSON | Optional JSON object of string-valued headers to send with OpenAI-compatible requests. | optional | |
| AI_OPENAI_COMPATIBLE_QUERY_PARAMS_JSON | Optional JSON object of string-valued query parameters to send with OpenAI-compatible requests. | optional | |
| STRIPE_SECRET_KEY | Secret key for Stripe integration. | optional | |
| STRIPE_WEBHOOK_SECRET | Webhook secret for Stripe integration. | optional | |
| DEFAULT_BRAND_COLOR | Default brand color for your app (Can be overwritten from the UI as well). | optional | #64748b |
| DEFAULT_ORGANIZATION_ID | Automatically assign new users to a specific organization when joining | optional | |
| OIDC_DISPLAY_NAME | Display name for Custom OpenID Connect Provider | optional | |
| OIDC_CLIENT_ID | Client ID for Custom OpenID Connect Provider | optional (required if OIDC auth is enabled) | |
| OIDC_CLIENT_SECRET | Secret for Custom OpenID Connect Provider | optional (required if OIDC auth is enabled) | |
| OIDC_ISSUER | Issuer URL for Custom OpenID Connect Provider (should have .well-known configured at this) | optional (required if OIDC auth is enabled) | |
| OIDC_SIGNING_ALGORITHM | Signing Algorithm for Custom OpenID Connect Provider | optional | RS256 |
| OTEL_EXPORTER_OTLP_ENDPOINT | Base OTLP HTTP endpoint for traces and metrics export (e.g. http://collector:4318). | optional | |
| OTEL_EXPORTER_OTLP_PROTOCOL | OTLP protocol to use for export. | optional | http/protobuf |
| OTEL_SERVICE_NAME | Service name reported in OpenTelemetry resource attributes. | optional | formbricks |
| OTEL_RESOURCE_ATTRIBUTES | Comma-separated resource attributes in OTel format (key=value,key2=value2). | optional | |
| OTEL_TRACES_SAMPLER | Trace sampler strategy (always_on, always_off, traceidratio, parentbased_traceidratio). | optional | always_on |
| OTEL_TRACES_SAMPLER_ARG | Sampling argument used by ratio-based samplers (0 to 1). | optional | |
| PROMETHEUS_ENABLED | Enables Prometheus metrics if set to 1. | optional | |
| PROMETHEUS_EXPORTER_PORT | Port for Prometheus metrics. | optional | 9090 |
| AUTH_SSO_DEFAULT_TEAM_ID | ID of the team that new SSO users are automatically added to. The owning organization is derived from this team. Must be set together with AUTH_SKIP_INVITE_FOR_SSO=1 for auto-provisioning to work. | optional | |
| AUTH_SKIP_INVITE_FOR_SSO | Set to 1 to allow SSO users to create an account without a manual invite. Keep unset (or 0) for stricter access control where only invited users can join. | optional | 0 |
| HTTP_PROXY | HTTP proxy URL used for outbound requests (e.g., license checks). When both are set, HTTPS_PROXY takes precedence. | optional | |
| HTTPS_PROXY | HTTPS proxy URL used for outbound requests. Takes precedence over HTTP_PROXY. | optional | |
| SENTRY_DSN | Set this to track errors and monitor performance in Sentry. | optional | |
| SENTRY_ENVIRONMENT | Set this to identify the environment in Sentry | optional | |
| SENTRY_AUTH_TOKEN | Set this if you want to make errors more readable in Sentry. | optional | |
| SESSION_MAX_AGE | Configure the maximum age for the session in seconds. | optional | 86400 (24 hours) |
| USER_MANAGEMENT_MINIMUM_ROLE | Set this to control which roles can access user management features. Accepted values: “owner”, “manager”, “disabled” | optional | manager |
| REDIS_URL | Redis URL for caching, rate limiting, and audit logging. Application will not start without this. | required | redis://localhost:6379 |
| AUDIT_LOG_ENABLED | Set this to 1 to enable audit logging. Requires Redis to be configured with the REDIS_URL env variable. | optional | 0 |
| AUDIT_LOG_GET_USER_IP | Set to 1 to include user IP addresses in audit logs from request headers | optional | 0 |
