ADMIN_USER / ADMIN_PASSWORD | First administrator, created on first start. If unset, the first visitor is asked to create one, so set it or sign in right away. |
SESSION_SECRET | Random text that protects sign-ins. Render generates one. |
MFA_REQUIRED | 1 requires two-step sign-in for every account from the first start. Otherwise an administrator turns it on in 👥 Users & access. |
ANTHROPIC_API_KEY | Optional. Turns on AI for everyone signed in, billed to this key. |
SIGNUP_CODE | Optional. The company code to start with, e.g. GULF-2026. Otherwise one is generated, and you can change it in the app. |
SIGNUP_OPEN | 1 turns the sign-up link on at first start. Otherwise you turn it on in the app. |
SESSION_HOURS | How long a sign-in lasts on a device. Default 168 (7 days). |
DATA_DIR | Where claims and accounts are stored (default server/data). Use a persistent disk. |
ADMIN_ONLY | 1 lets only administrators sign in, for example to pause the team. |
TRUST_PROXY | 1 if a proxy on a public address sits in front of the server, so sign-in limits apply per person rather than per proxy. Render, nginx and Cloudflare on a private network are detected automatically. |
COMPANY_EMAIL_DOMAINS | Optional. Requires an address at your domain. Leave it unset if independent adjusters use personal email. |
CERT_SIGNING_KEY, CERT_VOUCHER_SECRET | Turn on Academy exams and signed certificates. Make them with node tools/academy-keys.js; use the same values on every workspace. |
ACADEMY_WORKSPACE | Optional. The workspace name vouchers are tied to. Default: the host name in APP_URL. |
ACADEMY_DEMO | 1 for practice mode: exams need no voucher and certificates are marked PRACTICE. The start files use it. |
APP_URL, TZ, MAIL_, SMTP_, GRAPH_* | Optional email notifications, the same as the main Claimsfy. You can also set these in the app: 👤 → Email & notifications. |