Skip to content
Flutter News App Toolkit

Configure Environment Variables

The API server uses an .env file to manage environment-specific configuration, such as database connection strings and secret keys. This approach keeps sensitive data out of your source code.

This guide explains each variable found in the .env.example file.

Creating Your .env File

Section titled “Creating Your .env File”

First, copy the example file to create your local configuration file. Run this command from the flutter-news-app-api-server-full-source-code directory:

Terminal window
cp .env.example .env

Now, open the new .env file and fill in the values as described below.

Required Variables

Section titled “Required Variables”

These variables are essential for the server to function correctly.

DATABASE_URL

Section titled “DATABASE_URL”

The full connection string for your MongoDB instance. The application cannot start without a valid database connection.

  • Local Development: mongodb://localhost:27017/your_db_name
  • Production: Use the connection string provided by your database hosting service (e.g., MongoDB Atlas).

JWT_SECRET_KEY

Section titled “JWT_SECRET_KEY”

A cryptographically secure secret key used to sign and verify JSON Web Tokens (JWTs). This key ensures that authentication tokens are not tampered with.

  • Recommendation: Use a secure, randomly generated string with at least 64 characters. You can use an online tool to generate a suitable key.

SENDGRID_API_KEY

Section titled “SENDGRID_API_KEY”

The API key for your SendGrid account. The server uses SendGrid to send transactional emails, such as One-Time Passwords (OTPs) for user authentication.

DEFAULT_SENDER_EMAIL

Section titled “DEFAULT_SENDER_EMAIL”

The “From” email address for all outgoing transactional emails.

OTP_TEMPLATE_ID

Section titled “OTP_TEMPLATE_ID”

The unique ID of the SendGrid dynamic template used for sending OTP codes.

  • To create the template:

    1. Navigate to the Dynamic Templates page in your SendGrid dashboard.
    2. Click Create a Dynamic Template and give it a memorable name (e.g., OTP Template).
    3. Select your new template, click Add Version, and choose the Code Editor.
    4. Replace the default content with the HTML below. This code includes the mandatory {{otp_code}} substitution tag.
    <!DOCTYPE html>
    <html>
    <head>
      <title>Your One-Time Password</title>
    </head>
    <body style="font-family: sans-serif; text-align: center; padding: 40px;">
      <div style="max-width: 600px; margin: auto; border: 1px solid #ddd; padding: 20px; border-radius: 8px;">
        <h2 style="color: #333;">Your One-Time Password</h2>
        <p style="color: #555;">Use the code below to complete your sign-in.</p>
        <div style="font-size: 36px; font-weight: bold; letter-spacing: 5px; margin: 20px 0; padding: 15px; background-color: #f5f5f5; border-radius: 5px;">
          {{otp_code}}
        </div>
        <p style="color: #888; font-size: 12px;">This code will expire in 10 minutes. If you did not request this, please ignore this email.</p>
      </div>
    </body>
    </html>
    1. Save the template. From the Dynamic Templates list, copy the Template ID and paste it into your .env file.

OVERRIDE_ADMIN_EMAIL

Section titled “OVERRIDE_ADMIN_EMAIL”

This variable provides a powerful and secure way to set or recover the application’s single administrator account. On server startup, the system ensures that the user with this email is the one and only administrator.

  • If no admin exists: A new administrator account will be created with this email.
  • If an admin with a DIFFERENT email exists: The old admin account will be removed and replaced by a new one with this email. All associated data for the old admin will be deleted.
  • If an admin with this email already exists: No changes will be made.

Optional Variables

Section titled “Optional Variables”

These variables have default values but can be customized for your environment.

JWT_EXPIRY_HOURS

Section titled “JWT_EXPIRY_HOURS”

The duration, in hours, for which a JWT is valid.

  • Default: 720 (1 month)

CORS_ALLOWED_ORIGIN

Section titled “CORS_ALLOWED_ORIGIN”

The specific origin URL of your web client (e.g., the Flutter Web Dashboard) that is allowed to make requests to this API. This is required for production to prevent Cross-Origin Resource Sharing (CORS) errors.

  • Example: https://dashboard.yourdomain.com

SENDGRID_API_URL

Section titled “SENDGRID_API_URL”

The base URL for the SendGrid API.

  • Default: https://api.sendgrid.com
  • EU Accounts: If your SendGrid account is based in the EU, you may need to set this to https://api.eu.sendgrid.com.

RATE_LIMIT_REQUEST_CODE_LIMIT

Section titled “RATE_LIMIT_REQUEST_CODE_LIMIT”

The number of times a user can request a sign-in code within the defined window.

  • Default: 3

RATE_LIMIT_REQUEST_CODE_WINDOW_HOURS

Section titled “RATE_LIMIT_REQUEST_CODE_WINDOW_HOURS”

The time window, in hours, for the sign-in code request limit.

  • Default: 24

RATE_LIMIT_DATA_API_LIMIT

Section titled “RATE_LIMIT_DATA_API_LIMIT”

The number of general data API requests a user can make within the defined window.

  • Default: 1000

RATE_LIMIT_DATA_API_WINDOW_MINUTES

Section titled “RATE_LIMIT_DATA_API_WINDOW_MINUTES”

The time window, in hours, for the data API request limit.

  • Default: 1