Skip to main content

​
Parameters

​
Parameter reference

​
string
default:"fullstack"
Execution mode.
​
integer
default:"3000"
Port the API server listens on.3000 (default) · 8080
​
string
required
Secret used by Better Auth to sign sessions and tokens. Must be at least 32 characters.
Set this explicitly in production. Never commit it to version control.
​
string
default:"http://localhost:3000"
Public base URL of your Openinary instance. Used for auth callbacks and CORS.http://localhost:3000 · https://media.example.com
​
string
default:"http://localhost:3000"
Public base URL the browser uses to reach the API. Like BETTER_AUTH_URL, this defaults to your instance’s single public URL, set it once and both point at the same place.http://localhost:3000 · https://media.example.com
In the bundled full Docker Compose profile (API + web + nginx behind one port), this is baked in as /api at build time since nginx already proxies the API under that path, you don’t need to set it yourself. Set it explicitly when the API is reachable at a different origin, e.g. an api profile deployment or an external frontend embedding the File Uploader.
​
string
Allowed origin when Openinary is called from a separate frontend. Only set this in production, by default localhost:3001 (Next.js dev) is allowed automatically.https://yourapp.com
Avoid *. Set the exact origin of your frontend.
​
string
Secret used to sign and verify signed URLs and presigned, authenticated uploads (see the File Uploader). Required if you use the /authenticated/* route or presigned uploads. Must be 64 characters.
Never expose this in client-side code.
​
string
default:"/data/auth.db"
Custom path for the SQLite database. Only needed when mounting to a non-standard location./data/auth.db · /mnt/volume/openinary.db

​
Upload

​
integer
default:"50"
Maximum allowed file size for uploads, in megabytes.50 (default) · 500 · 2048
Useful for self-hosted setups where users need to upload large video files. Set it in your .env file or Docker environment, no image rebuild required.

​
Rate limiting

Rate limiting applies to all public routes (/t/*, /download/*, /health, etc.).
​
integer
default:"100"
Maximum requests per window.100 (default) · 200 (high traffic) · 50 (strict)
​
integer
default:"60000"
Window duration in milliseconds.

Storage

Connect S3-compatible cloud storage.

Signed URLs

Use API_SECRET to sign transformation URLs.