src/lib/server/env.ts and the adapter selectors. Values live in .env.local (gitignored) for local dev and in Vercel’s encrypted env for deploys. This page is the authoritative list, it reflects what the code actually reads.
Required
The app throws on startup if these are missing (or, for the DB, when a/live query runs).
botConfigured() returns true only when the three TWILIO_* vars and ANTHROPIC_API_KEY are all present. Outbound SMS (clinic/owner notify, ops reply) is gated on this.Optional toggles
Adapter flips (stub → live)
These are read only insrc/lib/server/adapters/index.ts. No call site branches on them, so setting them switches stub → real with zero code change. Redeploy after adding them: env changes do not apply to an existing deployment.
With Clover live, “sending an invoice” mints a signed, expiring link to the branded public
/pay/[token] page. The PUBLIC token renders Clover’s hosted card iframe in the customer’s browser (card data never touches the app); the PRIVATE token charges server-side via the Clover Ecommerce API. The charge response is synchronous: a succeeded charge commits the order and notifies the clinic inline, no webhook involved.
Related optional variables, read by the adapters, pay flow, and webhooks (not by the selector):
All three inbound webhooks (Twilio SMS, Clover, Uber) also reject replays: a correctly signed request is processed exactly once (tracked in the shared Redis store), so a captured request cannot be re-sent to repeat its effect.
Neon-managed variables
The Neon Vercel integration managesDATABASE_URL, POSTGRES_URL, DATABASE_URL_UNPOOLED, PGPASSWORD, etc., they share one credential. In Vercel they are rotated via Settings → Environments → Production → ⋯ → Rotate Integration Secrets (not a manual edit), then a redeploy. See Deployment.