Environment Configuration Guide for 0xramp Developers

How environment variables are organized in 0xramp: public VITE_ variables safe for the browser bundle vs server-side secrets never exposed in docs.

0xramp separates environment variables into two strict categories: public VITE_* variables that are bundled into the frontend at build time and are safe to expose, and server-side secrets that are only ever read by the Express backend and are never documented publicly. This page covers only the former — if you’re looking for server-side configuration, you’ll find placeholder keys in .env.example in the repo, but their values are your responsibility to manage securely.

Public Environment Variables (VITE_*)

These variables are inlined into the browser bundle by Vite at build time. They must never contain sensitive credentials.

Variable	Description	Required
VITE_P2P_SDK_ENV	Controls which P2P.me SDK environment to target (e.g. production or staging).	✅ Yes
VITE_THIRDWEB_CLIENT_ID	thirdweb project client ID for wallet connection features. Depends on partner or configuration setup.	⚙️ Config-dependent
VITE_APP_URL	The app’s canonical public URL (e.g. https://www.0xramp.app).	✅ Yes

These variables are bundled into the frontend at build time and are safe to expose publicly. Do not place any secret or credential in a VITE_* variable.

Server-Side Secrets

The Express backend requires additional configuration: database connection strings, P2P.me API credentials, session signing secrets, and similar values. These are never documented here. The general categories include:

• Database — connection details for the PostgreSQL session store
• P2P.me API — credentials for server-side SDK and API calls
• Session management — signing/encryption secrets for session state
• Other integrations — any partner or service credentials specific to your deployment

Store these using a secrets manager, a CI/CD secrets store, or an environment-specific .env file that is excluded from version control via .gitignore.

Never commit server-side secrets to git. Never include secret values in documentation, GitHub issues, or pull requests. If you accidentally expose a secret, rotate it immediately.

Feature Flags and Partner Configuration

Some 0xramp features — including certain wallet providers, KYC flows, and fraud engine integrations — are gated by configuration or require partner-specific credentials. They will not be active in a default local setup. Refer to the project README or the ADR directory for which features require additional setup and how to enable them in a development or staging environment.

Copy .env.example from the repo as a starting point for local development. It lists all required variables with placeholder values so you know exactly what to fill in.

TODO: Link to .env.example when the repository is public.